Slashdot Mirror
Will Solve Captcha for Money?
alx_lo writes "Captchas are a nice idea to protect your blog or guestbook from being spammed by robots.
But what good is this protection when you can hire "data entry specialists" to solve captchas for $0.60 per hour for 50 hours a week?
Anyone here who can think up a solution that does not include drastically changing the global economy? How about captchas that require cultural background knowledge to solve?"
The cultural background idea sounds good, but that may just reduce the number of Captchas these laborers can solve in an hour. A simple internet search should be able to solve these questions. What would be a few examples of a good Captcha for Americans. You will always find a good portion of Americans that are unable to answer even the simplest.
US customs has been known to ask cultural questions at border crossings. My sister was once asked what Dan Quayle's parents did for a living after she said she lived in Indiana. This question is a bit before her time. (His parents ran a newspaper in Indiana.) This also brings into question age. My parents kill me in the original version of trivial pursuit that they play, but I win when playing the newest version.
A temporary stop gap measure might be to use the current Captchas in combination of looking at the users geolocation. I can see how this measure though would really anger free speech advocates for the third world.
How about a mathematical Captcha that cannot be solved with a calculator. Well educated foreigners will not even work for $.60. Then again, how many Americans could solve these.
quis custodiet ipsos custodes
I remember seeing an example of a captcha type game a while back where you would have to pick the hottest girl out of 3 pictures in order to continue..
problem of course is when people disagree on what's "hot"..
MABASPLOOM!
I agree with the parent post...put up a captcha picture of a PDP-11/40, PDP-11/45, PDP-11/70 and I can identify all of them within half a second.
However....my wife will correctly identify it as a "PDP" but probably won't identify the model
My sister (who is smarter than me) will say "it looks like a computer of some sort"
My niece will identify that it is something electrical
I don't want to see captchas that start to depend on a specific culture to use.
I admin a PHPBB-based forum and the spam (from bots) was getting out of hand. They were going through the built-in CAPTCHA with no problem. The solution ended up being that I had to modify the registration form so that it wasn't just the default form. Throw a couple of oddball questions on the form, make them required, and bots can't deal with it since the bot script can't account for deviations from the norm.
Transistors and Beer!!
My team of fine Southeast Asian workers will remove spam from your web site/bulletin board/blog for a low low price of $.60 US/hour.
Incidentally, for those of you in the market to advertise your wares: My team of fine Southeast Asian workers will circumvent those inconvenient captchas on web sites/bulletin boards/blogs for a low low price of $.60 US/hour.
Here at SweatShopSoftware.com, we have a solution to every problem.
Why are you letting these clowns ruin our country?
This still hurts spammers, because spamming is otherwise pretty cheap. Once you've grabbed bots, all you have to do is upload a few hundred KB of scripts to an IRC channel. It's practically zero overhead. This adds some to the equation. Adding overhead puts smaller spammers out of business, and it's the way to win. We can't stop spam, just make it harder.
I wish they would go away. It usually takes me 2 or 3 tries to get them right. I guess I over analyze it. I see stuff and think "wow - is that a one or an L" and so on. Normally after I've gone through a few, I get to see some of the characters I'm confused about in different images and finally figure it out.
It's hard to believe that's how Micronians are made. Why don't we see it right now by having you both kiss one another?
Yesterday, I saw a presentation by Dr. Luis Von Ahn (developer of the ESP Game, and other CAPTCHA type games). He claimed that spammers and porn companies are willing to pay about $2.50 an hour for 720 CAPTCHAs an hour, or about 1/3 cent per CAPTHCA. (The CAPTCHA solcing is needed to create more free email spamcounts.) I don't know why people would solve them for so much less...
Perhaps a solution is making the captcha time-intensive? If it takes an additional 30 seconds of 45 seconds, it might cut down on the number of captchas a person could solve in an hour.
This would probably work better for sites where you only enter the CAPTCHA once, say for creating an account.
Refundable micropayments. Seriously. Require people pay $1 to post a comment, payable via paypal or whatever. Once you have checked their comment, you can add them to a whitelist that will never be charged again and refund them their $1. Spammers don't get their dollar back, don't get added to the whitelist, and have their comment removed. The result over the course of a large number of blog entries would be to significantly increase the cost of doing business for spammers, while providing only a very minor inconvenience for legitimate users.
Maybe I missed the memo/boat on this, but aren't CAPTCHAs here specifically to stop automated spamming, automated account creation, etc.? After all CAPTCHA == Completely Automated Public Turing test to tell Computers and Humans Apart.
So the real problem is coming up with CAPTCHAs in real-time with no permanent (this session ID) correlation made between the image link and the answer. Then hiring "slave labor" to make this mapping for you will be completely useless.
Then the "other side" will volly back with an image algorithm to thwart CAPTCHA, then we'll get CAPTCHA 2.0 with synergistic AJAX-enabled authentication, and then we'll have Terminators ruling the world.
:wq
This issue quickly runs into the same sorts of problems that copy protection on software does. People who are dedicated to breaking the system will still be able to, but normal people trying to work with the system are just getting annoyed.
It's a mild pain in the ass to match a swirled up picture of letters (I've known the alphabet for about 25 years, and I still get them wrong sometimes), but I'll usually go through it. Make it much more difficult than that, however, and I'm pretty likely to decide it's not worth it, and go waste my time on another website.
The solution to this problem is not to make the visitor do more work, because you can easily drive your visitors away by making your website a hassle. The spam needs to be filtered on the server side, or just deleted as it appears.
I've encountered this problem on my own neglected website, and I haven't found a good solution that I have the skills to implement. I generally just delete the spam as it appears, and I turn off commenting on older posts. This works for my personal site, because it's low traffic, but I'd imagine someone who gets more readers and spam could find the motivation to set up some sort of filtering, similar to email spam filters.
One time I threw a brick at a duck.
I wish I had someone that could have answered the questions at the beginning of Leisure Suit Larry for me when I was 11...I would have broken open the piggy bank to play!
This is why I believe in the future there will be two Internets. The one we have now which is wild and wooly where you can remain anonymous, and one where you can't do anything without a Reputation ID that is tied to a biometric identification method (fingerprint, voiceprint, etc.). There will be third party companies like Google that have Reputation ID accounts and will handle the authentication. The Reputation ID based Interent is where eCommerce, government and medical records, etc. based web sites will live.
I hope to heaven that instead of a biometric authentication, someone can come up with a card reader for driver's licenses or some other ID method, but current events seem to indicate biometric authentication will prevail. Even in that case, I hope it is a "authenticated-user" token passing scheme so that the web site that you want to visit never knows who you are, just that you are a valid user that owns the account ID you claim to own (the Reputation ID web site acts as middleman and privacy shield, pray they are never hacked).
By the way, I don't like the thought of privacy problems and Reputation ID spoofing scenarios this implies. I just don't see any other way way to build an Internet with a high degree of trust. As I type this I am looking at the SlashDot captcha box for comments.
Robert Oschler - RobotsRule.com
...but haven't they been doing this for a few years now? I seem to remember a story, at least a year back, where spammers were giving porn away for free, as long as you solved a captcha every couple views.
Mod me down with all of your hatred and your journey towards the dark side will be complete!
I helped develop one of the largest websites in Europe (in terms of traffic and volume of content). Human spammers have been bypassing our CAPTCHA for a while now. We still keep the CAPTCHA to block most bots. The data input goes through a custom spam filter. These human spammers are trying to spread their URLs, email addresses, and phone numbers just like most spam, so this helps to a large extent. Anything that gets through that can be flagged as spam by users. On top of all that there's some human moderation by the business which owns the site.
So in the end spam filters can help but human moderation is still the only real working solution today.
Developers: We can use your help.
Match each band to the model of truck its music is eminating from:
1. Metallica
2. Billy Ray Cyrus
3. Lynnrd Skynnrd
a. GMC truck with double tires on the back
b. Primer-color El Camino with beer cans in the back
c. Shiny red F-150 with aerodynamic truckbed lid
Step into a huge movement. Don't Tread In Me.
It would be a fine idea if you were trying to keep access down to certain sub-cultures (ie, a captcha showing a picture of Linus Torvalds and one of Linus from Peanuts, asking what they have in common), but on a larger scale it just isn't going to work.
To register, you have to be a "confident" user of a parternship website, like say ebay, paypal, amazon, yahoo, hotmail, google, etc, etc. They can proof that you are a real user, and an open api allows 1-1 relations between your accounts. If you are not registered to any of those website, you have to get X points using Folding@Home to be trusted.
Running with your cultural background idea:
Why not take this to the local level, ie, make your captcha refer to website content.
The spammers can circumvent captchas effectively because they make sense out of context. But if your captcha asks for the Author's surname, the name of the website, or the news item's title; suddenly you need to actually know about the blog before posting.
Take this to far though, and it starts to look like those discriminatory voter tests of yesteryear.
The real problem with spam after all is not the spammers but the people who respond to it, if nobody bought from spam then there would be no spam. Well at least much less of it. After all it is advertising and spammers are not selling say viagra but selling spam itself.
In any case with this log of users who actually click on spam links you could then A compile an overview of what kind of user actually is stupid enough to respond, B educate them or C ban them for being to stupid to live.
Considerring the offered budget in this ad for (30-100 dollars) I don't think the guy is operating with that big a margin already. If you can reduce the number of people who respond to these spams then perhaps simple economics makes the problem go away.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
Just have a human authorize every account creation. For smaller sites (the vast majority of the web) this might introduce a load of one authorization a month. As site size scales upwards, you have more people available to help with authorization. Could use the principles of the turing test to work through a 2 or 3 email exchange.
;)
Could make the supporting cgi scripts as simple or as complicated as one's willing to author. One forum I maintained for a while had a low level "all access" section where new users posted an application. Forum regulars would respond, and eventually grade the new user. If they passed, they were given full access to the board. Granted, this system was employed more to limit the quantity of asshats than spammers, but the same principles apply.
It might even benefit society in the long run as a spammer's urge to do his work forces him to develop a "true" AI.
I've visited a Japanese art site (ie pictures of characters from fighting games drawn in alarmingly extreme detail) which had roughly this on the front page:
"Because there have been some people coming in here and stealing pictures or linking without permission, I have had to put this small test up. Please enter the Emperor's birth date in Japanese calendar in the box below. I'm sorry for this inconvenience and I will remove it when they forget about this site."
I've also seen a site (again in the 'students with too much time on their hands' sector) that asked for some other date in Japanese calendar. There are also a fair few personal sites that have a front page with just one link that takes you in, and several spurious links, with the page being 100% japanese text -- which I think serves about the same purpose.
On a related note, there also used to be WinMX groups which required that you say something in Japanese on entering or be booted. The point there was that otherwise you'd get masses of Korean 12-year-olds coming in and going 'Fuk Japanese bitch! dokdo nun uri tang!!lolz0rz!' and generally spamming the place. At least, I hope they were 12.
So, cultural captchas certainly exist... but it's easy to see why they work better on 'my pictures of Vampire Hunter D' sites than in the commercial world.
Whence? Hence. Whither? Thither.
How about captchas that require cultural background knowledge to solve?
If the captcha does not itself contain all the information required to solve it, some legitimate users will be unable to solve it.
Now, simple riddles would at least require mastery of the language instead of mere character recognition skills. However, requiring language only raises the $/hour cost of solving them a little. More importantly, even easy riddles are much harder to generate for captchas than random strings. E.g., "What word is fourth in this sentence?"
"We reject as false the choice between our safety and our ideals." --The American President (20.1.2009)
CAPTCHA's can either be easily bypassed by script, or you can get people to do it. The thing is, if you make it harder you start blocking out visitors, maybe those with sight problems who have to use a screenreader, or people with a text only browser.
My blog recently had issues with automated spam, and I found two possible ways of dealing with it.
1) Use a filter like email. Wordpress has one available called Spam Karma 2, which measures time it took to fill in the form, Javascript payload, URL levels, and other things. I found it rather good at catching spam after a little training, but it was quite resource heavy, and even scripts make mistakes once in a while.
2) Use something abnormal. I decided to add a math script. Basically, it produces a simple math question (4 + 9) and asks for the answer. The comment will only submit if a correct answer is provided (the form has a hidden input with a server-side produced hash) which is checked against the hash (if hash is missing it automatically fails). Many spam bots don't know how to handle math, so they fail. To disquise the question for 'alert' bots people only need to add surrounding characters or convert things (+ => plus, 9 => nine) etc.
i could see it if it was something related to the message board,,,
something that has the topic about electronics could have somethign like that.. it might also help keep idiots off..
but on slashdot.. all you have to do is bang on a keyboard
'...if only "Jumping to a Conclusion" was an event in the Olympics.'
Kitten authentication! It's perfect! Identifying small, cute, furry animals needs a basic cultural background in animals common to the West, but at the same time requires little or no intelligence (plus, it's fun!).
Try it out at http://www.kittenauth.com/node/5. It's currently being rewritten; if you can't see any animals the first time, click 'submit'.
What's purple and commutes? An Abelian grape.
One thing I did just 2 days ago has stopped the CAPTCHA attacks cold. I modified my registration page just slightly to alter it's URL. Now, if some lackeys are manually doing every phase of the registration, this is no help at all, but they're trying to be more efficient than that. They don't make their lackey's click the "register" link, and then click on the link confirming they are over 13, etc, etc. Rather, they have tools that automatically traverse these paths or mimic their traversal, and those tools require your installation to literally be identical to all PHPBB installations, as it is their syntax it is capable of parsing and triggering.
The result is that no lackey, apparently, is ever getting rushed right to where s/he sees a CAPTCHA and has a textfield into which to type its text. I've fallen off the radar by opting out of a monoculture in a very tiny fashion. I'm glad to think I've turned the spammer's trick (obfuscation to defeat automated tools) against them.
tone
tone
What about reducing it to a single problem again by accepting comments only via email? Then you can bring the usual tools to bear - forcing server retries, greylists, whitelists, blacklists, analysis, etc.
Just provide the comment email address at the bottom of the article and a uid in the address would make it post to the proper article/story/whatever. Reply to email addresses would have a different uid as well.
Make the mail server moderate for you.
You are checking your backups, aren't you?
I am surprised that all slashdot can come up with so far is cultural or mathmatical solutions.
I think some sort of game would be a good idea, sorta like the crappy games in flash advertisements now days. Make it difficult enough that it is too time consuming for spammers, but easy enough that people do not get frustrated when trying to register or post.
Ultimately I think that better filtering is probably the solution
One of my message boards has been getting spammed a bit lately, despite the CAPTCHA..
We have recently installed a mod that we can add keywords and urls to. So posts from new users are checked with this.. it needs a bit of fine tuning, but I think eventually it should get rid of most of the spam.
In addition, users can flag posts as spam which are then checked by a moderator
Not a perfect solution of course. Someone could still pay for the answers, but it would take them more time to watch a video than look at one image. The videos might be related to the subject matter of the site and actually be entertaining or informative for valid users to watch. Captcha questions might be a little harder for a topically relevant video to further insure a user is worth the price of admission.
For each client, send a series of captchas: "solving" "captchas" "formoney?" "one" "thousand" "usdollar" "reward" "for-arrest" "of-your" "employer".
(obviously in later stages you need to make sure the division x/g is done to necessary precision, but keeping numbers in fractional rather than decimal form makes the mental calculation easier, if you can handle an answer in that form.)
this method converges quadratically whereas 'trial and error' or a 'binary search' converges linearly. this means by using this method a simpleton from the 16th century could beat you quite easily doing 3-4 digits of accuracy, and could probably find 6 or 7 digits faster that you could if you were doing the divisions on a calculator.
btw i'm not sure if this is the same method you outline above, or if by 'divide, refine' you are simply deciding whether your guess is too big or too small, based on whether g or x/g is bigger. taking the average of the 2 is much better, and not computationally expensive.
my password really is 'stinkypants'
I prefer the Bilbo line of questioning.
"What's this in my pocket?"
It is by the juice of the coffee bean that thoughts acquire speed, the teeth acquire stains. The stains become a warning
I've managed to cut down blog spam significantly lately after installing an Anti-CAPTCHA: http://www.timtucker.com/weblog/?p=74
The basic idea is to present a CAPTCHA image that's as easy for a machine to understand as possible and then ask the user to type in something else. (in the system that I'm using, users are presented with an unobscured image of a 6-digit number and asked to type in a different 6-digit number).
One of the great things about asking a user to type in something other than what's shown is that it's much more accessible than a regular CAPTCHA, since there's only a 1/1,000,000 chance that someone who can't see will accidentally type in the "right" six digit number.
Which biological characteristics, exactly, cause someone to know who Britney Spears is?
Stupidity?
Peer pressure?
Infuriate left and right
This talk on Google Video has a bit of info about CAPTCHAs. Apparently some porn sites are displaying occasional CAPTCHAs that their users have to solve before seeing the next page of porn, and then using these solved CAPTCHAs to spam blogs and other sites. The developers get bonus points for creativity, anyway.
How about taking a page out of "Last Crusade" and having multiple "submit" links, only one of which works. In plain text near the links, say something like "click the blue triangle submit button to not have your post marked as spam." As long as there aren't too many choices to wade through, users won't be terribly inconvenienced.