Slashdot Mirror
Porn Rewards Users To Get Past Anti-Spam Captchas
Stalke writes "Spammers are now usings a new technique to circumvent the 'captchas,' the distorted text in graphics, that users must input to receive the free email account. The spammers have cracked the system by displaying the 'captchas' on free porn sites in real time. Since there are always a large number of people signing up for free porn, they do the work of decripting the 'captchas' which is then replayed back into the spammers program to create a new email account. Who thought that porn could be a hacking technique!" Sure sounds plausible, though the link here says only "someone told me."
Porn, the foundation of the internet. It will never go away or die. It has more uses then we can even imagine.
Evolution or ID?
What is everyone in the Slashdot crowd gonna do? On one hand you dont want to get spammed, but on the other hand you NEED your pr0n. However, i think this will take care of itself because eventually people will be too busy deleting spam to look at pr0n online, reducing the amount of spam....Ok, i'm half kidding, but i really do think this is an ingenius way of spammers getting around certain barriers. Say what you will, but spammers have shown/proven that they can overcome many obstacles to continue their spamming.
Two reasons this sounds like rubbish: The catchups are generated on a per session basis for the person trying to sign up for the email address . Surely if they then try and get a third party to do the decoding the session will be expired. Also The article points out that Optical Character recognition is more than adequate to break this so I can not see a situation that spammers would do this elaborate probably unworkable method over OCR. No facts and a friend of a friend source makes this sound like total BS.
The internet makes me stupid.
Is it just me or are people becoming less critical about what a valid news sources is?
'Someone told me...' on a 'blog'?
That doesn't carry quite the weight of the BBC and Reuters to me, but I suppose there's a good chance no-one was threatened by a 'democratic' government during the production of the article, so maybe it's less biased than some.
"Those who cast the votes decide nothing; those who count the votes decide everything." (attrib. Joseph Stalin)
You're right. But. A) you're repeating what the editor already said, and B) you are overstating your case a bit for the following reasons:
In fairness, the poster on the blog was Cory Doctorow, who is a long time, well-known net-citizen and isn't exactly some random guy, although you may not know him. For a sample of his work, see this piece in Salon which mentions that he won the John W. Campbell Award for best new science fiction writer at the 2000 Hugo Awards. He's not a journalist, he's a blogger, but it's an interesting tidbit nonetheless...
And even if he was a random blogger, his credentials are much less important than the core concept he's disclosing: that someone seeking to generate email accounts (or open bank accounts or whatever) could have porn-seeking humans workaround the turing-ish test security measures. The story is less that someone is doing it, than that someone could be doing it. At least to me.
Plus this is a hacker-type story... I wouldn't expect Reuters, etc. to carry it first.
I actually was glad to see the Slashdot editor point out the "someone told me" caveat... it's a sign to me that the editors here are getting better. They're warning us about the weaknesses in the story, not just slapping stuff up here without a care.
--LP
The referrer field is easily forged.
Prescriptive grammar:linguistics
Rather than guess a single image, how about a feature on the page at random? For example Yahoo Mail can ask "What is the menu to the immediate right of Addresses. (which according to my Yahoo Mail screen would be "Calendar"), Or even "What company is the banner ad up top advertising" which serves 2 purposes 1) Captcha Test and 2) Ensuring the advertising is looked at :-)
Unless a Spammer plans on building a porno site exactly like Yahoo (and incur the wrath of a zillion lawyers consequently), this would be a difficult one to counter attack (unless someone here could prove otherwise). Thoughts?
...in bed
I thought that'w why there's something called ethics, which tells you when an ingenious thing may be good or bad.
IMHO, you can't applaud unethical uses of ingenuity.
It's a clever idea (even if nobody has actually done it yet) but I think Captchas will always be ahead in the arms race.
.sig
Cut and paste my Captchas? Ok, I'll embed it in a java program.
Screen capture? I'll make it dependant on the web-site you're visiting.
(which of these objects starts with the same letter as the third letter of my website?)
In the end though, the best a captchas can do is prove there's a human somewhere in the loop.
A spammer (or anyone else for that matter) could hire real people to answer them.
Automate the non-captcha part of the signup, and you could generate several hundred accounts per hour.
-- this is not a