Slashdot Mirror

← Back to Stories (view on slashdot.org)

Evolution of the 'Captcha'

Posted by CmdrTaco on from the why-can't-i-even-read-them-half-the-time dept.

FireballX301 writes "The New York Times is running an article about the small word puzzles various sites use in order to defeat automated script registration while still letting humans through. It seems many people can't actually solve them anymore, so new alternatives (image recognition) are being created. This, of course, seems breakable as well — is there a feasible alternative to the captcha, or are we stuck jumping through more and more hoops to register at places?"

11 of 383 comments (clear)

  1. Alternative? by morgan_greywolf · · Score: 3, Insightful

    In my mind, anything that can be put out by an automated system for purposes of determine whether the communications on the other end is from an automated system can, with enough ingenuity, be answered by an automated system. IOW, all 'captchas' and similar methods are ultimately defeatable. It's an arms race, just like DRM: clever people will always figure out how to defeat what protections you put in place no matter how clever your protections are.

    --
    My blog
    1. Re:Alternative? by moranar · · Score: 4, Insightful

      Doesn't work well: a bot will be right 25% of the times, just by answering at random. And more pictures mean difficult layout, or small picture size. Plus, it becomes an undue hassle on real users.

      --
      "I think it would be a good idea!"
      Gandhi, about Internet Security
    2. Re:Alternative? by twistedsymphony · · Score: 4, Insightful

      What ever happened to email validation?

      You give script your email address, it sends you an email and you follow a validation link within the email. Implementing this on my website where I had a captcha before got rid of 100% of the spam.

      There are also other little dirty tricks you can do to ensure it's a human on the other end, one of my favorites is to check the referrer URL when accepting a comment... if it's not being referred from my entry forum then it just happily throws the request away. Even if it's not spam it's probably something malicious anyway.

      Another thing I used to use that worked really well in conjunction with registration is "approving" any account in which the first post doesn't contain any links or any words on a "spam list". If the first post of the newly registered account contains any links or spam words at all, it's held for moderation and must be approved manually. A vast majority of the legit people leaving comments for the first time wont be including any links or talking about viagra on a tech site, no links or spam words means they've been validated as "not spam" and if they've included links it only takes a human a few seconds to qualify if the account should be canceled as spam or approved as a non-spam account. This one obviously takes some man power so it only really works on smaller sites. It might be easy for a spam bot to counteract this but the way it validates is not apparent, not to mention this is already after an email has been validated.

      --
      Collector's Edition
  2. Great idea by grimdawg · · Score: 3, Insightful

    What word did you have to type to prove you weren't a bot? A good sample might give us an insight into which words are used: why? I had to type 'interest' - which seems to have no real distinguishing feature.

    Are they chosen for any good reason, or are they completely arbitrary? Are there letters that bots have trouble with? Fonts? Who knows?

    The only thing that's sure is that every protection will eventually be broken.

    What's more, maybe if you can't solve a simple word puzzle, I don't want you registering at my site...

    --
    There are 10 kinds of people in this world: those who understand binary, and nine other kinds of people.
    1. Re:Great idea by Turn-X+Alphonse · · Score: 4, Insightful

      So people with eye sight problems aren't welcome on your site then?

      I have perfect vision and I struggle to tell if some S/5/Zs are one of the letters. The fonts and distortion is getting worse and worse to the point where it's usually 2 or 3 attempts before I can get one correctly, purely because letters are so distorted in them these days.

      --
      I like muppets.
    2. Re:Great idea by 0123456 · · Score: 5, Insightful

      Indeed: these things are getting to be an appalling nuisance. If I see a site that use them I increasingly just say 'fuck it' and leave; particularly the sites that keep asking for another one every few pages.

      Meanwhile, having an automated system feed them to Chinese people on $0.50 an hour can't be too hard, and they'll have at least as good a chance of getting the correct result as I do.

  3. Captcha too hard by aepervius · · Score: 4, Insightful

    OK, I am a bit shrotsighted, but still, some of the captcha are so garbled with bright color random pixel/forms while the font color of what was to be read was light gray/pink/blue on white background (and naturally distorted) that frankly I swore loudly while trying for the 5th time to enter the correct random combo of lower case, upper case and digits.

    I am not sure if a picture is better, but it is defintively a step forward if I don't have to spend 5 time retrying.

    --
    C. Sagan : A demon haunted world:
    http://www.amazon.com/gp/product/0345409469/
    visit randi.org
  4. Stop testing the Humans, test the Robots by Anonymous Coward · · Score: 5, Insightful

    I always get annoyed by captchas.. its like a forced human intelligence test.
    We know that humans are more intelligent than scripts, so I always thought it should be easier to test the lack of intelligence in scripts than proving intelligence in humans.

    For example just use a simple honeypot in a html form. Put a dummy input field in a form. You can hide the field with CSS/noscript tag or just mark it: "This field should be left intentionally blank" or something of that nature to make it more human friendly.

    Seeing that all form fields are generally blank, the spambot/script will fill your dummy field. On server side check if the field has data, ignore the submission. It would be a VERY intelligent script that could COMPREHEND the purpose of any particular html input field.

    my anonymous 2c

  5. Digital Certificates are the answer by rtobyr · · Score: 3, Insightful

    One day, everybody will have a digital ID. You know, the kind used to digitally sign e-mail. If you had to digitally sign your request to create an account with a certificate issued from a trusted CA, then using a bot creates the potential of the user having his digital certificate revoked.

  6. Re:Knowledge tests... by kbox · · Score: 5, Insightful

    If there are four possible answers even a script will be right 1 in four time... So if they make a registration attempt every second they will still get 900 successful registions an hour.

    --
    God Be Gone
  7. Re:Knowledge tests... by mu22le · · Score: 3, Insightful

    Your captcha can be defeated by a simple parser + google. Just see if "food+pink" has more hit than "food+hamburger".

    Also you would need a small army of people to write the question in the first place (actually you could try to generate category/item couples from a statistical analysis of wikipedia).

    Now that I think of it... it's just too easy to beat your captcha randomly (1/4 chances is not that bad for a script).

    On a funny note... captcha similar in spirit to the one you propose is http://www.hotcaptcha.com/ based on hotornot. At least it's worth a laugh :)