Slashdot Mirror
Yahoo CAPTCHA Hacked
Hell Yeah! reminds us of a 2-week-old development that somehow escaped notice here. A team of Russian hackers has found a way to decipher a Yahoo CAPTCHA, thought to be one of the most difficult, with 35% accuracy. The Russian group's notice, posted by one "John Wane," is dated January 16. This site hosts a rapidshare link to what looks to be demonstration software for Windows, and quotes the Russian researchers: "It's not necessary to achieve high degree of accuracy when designing automated recognition software. The accuracy of 15% is enough when attacker is able to run 100,000 tries per day, taking into the consideration the price of not automated recognition — one cent per one CAPTCHA."
by having a teenage boy do it in exchange for letting him see porn.
They're used to seeing Cyrillic, the captcha has got to be easier to read!
A few months ago Yahoo introduced a CAPTCHA to prevent bots entering their chatrooms. Within a few days every room on yahoo was filled with bots once more, and still are to this day.
Given the current situation of the chat rooms on yahoo, it comes as no suprise at all that the other parts of the Yahoo system are inadequately protected from bots either.
Why are they called a researcher?
What other tough AI problems can we foist onto spammers? People who buy V1agra through email ads could be the single largest source of computer science research "grants."
I did my own captcha, but I'm not sure how much its worth - figured any non-standard one is better than none (or a std one).
Please take a look - are the effects actually helping the recognition process?
--
social bookmarking widget for your site
Teh slashdot captcha has been broken for YEARS on trolltalk...can commander kotex won't fix it.....
go look!
I've found Yahoo's CAPTCHA to be really annoying. I probably get it wrong about 20% of the time because the picture is so distorted (and I've been surprised that I got it right a lot of the time). I even considered writing them an email complaining about it, but then I realized they probably don't give a crap.
We hate CAPTCHA. Most thing they do to make it difficult for computers to decode, make it a lot more difficult for humans to decode. Most of them are not usable by text browsers (dah), and the blind. Some have audio that is hard for people to hear, and sill easy for computer to decode. Last, CAPTCHA's are so over used that people just do them without thinking. For all you know that Porn/ware site is using you to do CAPTCHA for them. Not that it is needed. This is just one more nail in the CAPTCHA coffin.
33% of Yahoo capitchas isn't really impressive - you still get a large quantity of negative hits, and unless you have an array of IP addresses (most people don't), there will still be a large quantity of addresses registered from a given IP. Also, a large quantity of negatives would cast doubt on any positive matches from the same IP.
Also, Yahoo captchas aren't that "hard" - they are black text from known font pools on a white background that get slightly warped and have black lines drawn on some characters. This is hardly strong since it doesn't hit all letters within the word (which is done by reCAPTCHA) or use a large font-pool variety.
Even the Slashdot Captcha is harder - it hits the whole image and uses different fonts within the word.
Ya, if its not malware, I'll buy a bridge from somebody, and then go bungee jumping without a chord...
This might account for the recent increase in spam chat messages I've been seeing there. My guess is that the spam filtering is not as effective on chat as email. Indeed, chat may not pass through any kind of filtering at all afaik. That will probably change soon, but in the meantime I suppose the people who cracked the captcha will make a tidy profit.
To the making of books there is no end, so let's get started
... I mean just look at their tagline: ''Gotta captcha 'em all'' !!
I'm impressed. That's better than I can do. Some CAPTCHAs take me five or six tries to get right.
-William Brendel
I've had mine for years.
You must be signing up for lots of fake porn accounts.
Are you bashing MS just to bash them. Honestly, their so called 'stupid system' is the best thing I've seen out there. Please enlighten me wise one, and link me to a better alternative.
/. , might be a challenge for yourself, wise one.
p.s. How do you know that Gmail accounts haven't been hacked into? Do you have data validating this?
It's not a challenge to bash MS, that comes way to easy, but to add some useful content to
Bellybutton. Do I get a peek?
--
make install -not war
This is why you need a queryable, updateable public spam database like Akismet where, with a little effort in telling it the odd time it gets it wrong, you can eliminate 99% of spam. This might not help for a registration script, but you could use it on the content ultimately used by the registered user to determine whether the signup was likely a bot or a human.
It's better to vote for what you want and not get it than to vote for what you don't want and get it.
- E. Debs
Did anyone notice that the image recognition code is imported from a binary DLL? I was under the impression that the Russian hackers would provide the source for the recognition code as well. But then, the people who released this are only interested in generating as much spam. Why should you trust them? You would be foolish enough to _not_ execute your test program that imports this dll in a vmware instance instead of your actual machine. Anybody done a comprehensive strace to determine sockets/descriptors opened by using this dll?
I don't know about anymore, but traditionally GMail only allowed people to invite a few of their friends occasionally, thereby limiting the effectiveness of getting one hacked account. For those without an invite, a cell phone number was required to receive your invite code, again limiting this.
I haven't looked at gmail's sign up anymore, but those were obviously pretty good techniques to limit the ability of spammers to get new accounts.
http://blog.slaingod.com
What about the form that is around the captcha, generally a new account application, etc? What if those were to be made dynamic so the automated software trying to look for a hard-coded form fail?
Have the captcha be at the beginning, sometimes middle, sometimes at the end of the form. Mix it up a bit. Have no two application forms look the same.
Or better yet, have questions that modern computer AI has yet to break. Show a picture of a circle and ask "is this round?" or "is this not round?". Generally make the questions a bit more complex as AI gets better.
I wonder if there could be some sort of AI research project that works in conjunction with a captcha system.
Aren't there humans doing CAPTCHA? What is the cost there? I think slashdotters focus more on technology, but putting up a cheap and workable system to get humans anywhere to do this is also important.
Microsoft's CAPTCHA is very effective against bots, but it doesn't solve the accessibility issue. You can read letters out loud, I don't think you can do that with cats.
Maybe they also have an archive of meows and barks?
Soon, the cost of identity on the internet will be money. The technology circumventing human-being verification is growing faster, and with greater economic motivation, than the technology preventing non-humans from registration. Soon there will be no way to distinguish between a human and computer on an independent web-sites.
Cometh the centralized, homogenized, certified verifying-as-human web-sites (vis-à-vis facebook?).
Botnets have a whole bunch of IP addresses. Simply deploy your Yahoo CAPTCHA cracker code on a botnet that some other fine internet entrepreneur has assembled, and it doesn't matter how many negatives you generate because they will be from a variety of hosts. Certainly with 33% success rate, you're doing pretty well, especially considering your typical spray-and-pray spam blitz.
Once you get the question in text form, it would be easy for a BOT to use Google to find the answer.
My guess is that the lack of security will do more harm than good.
The Net is an unforgiving beast.
-- Tigger warning: This post may contain tiggers! --
I have to agree with you here.
When I try to post at the Seattle Times their Captcha is nigh unreadable. It's dark and frequently I only succeed with maybe one try out of five.
Which really frosts my cookies and has made it so I try not to buy their print edition, choosing instead the more user-friendly system at the much more urban-focussed Seattle Post-Intelligencer instead.
It's a royal pain.
-- Tigger warning: This post may contain tiggers! --
Yahoo!'s captcha has been hacked, perhaps not as well, in the past. I've seen open http proxies pounding away at Yahoo to the tune of 100,000 per hour and more. Hotmail's is broken, so are others. The real shame is that the Storm Worm controllers are being protected by a national government and law enforecement system.
So what's the answer?
I'm sure I don't know. I do know that the wild west theory of accepting any kind of behaviour isn't acceptable. I know that some minimum standard of what's allowed and what isn't is going to have to take place. Where these limits are placed is a thing for a global conversation, and there will be differances of opinion.
Is cracking a captcha acceptalbe? Is phishing and identity theft acceptable? Is fraud and uncontrolled spam acceptable? What limits, and on what actions?
I'm just not that smart. But I think we can agree on a few things. Let's start to find out what those things are... and acting in concert with other network operators to enforce those standards. Fail to meet them, and your network routing gets dropped...
Necessity is the plea for every infringement of human freedom. It is the argument of tyrants; it is the creed of slaves.
Segmentation and intersecting arcs can be difficult for automated attacks: http://portal.acm.org/citation.cfm?id=1054972.1055070
You know those annoying flash advertisement games (shoot the monkey for a free iPod)? Well, they could potentially be adapted for CAPTCHAs as well: http://cups.cs.cmu.edu/soups/2006/posters/misra-poster_abstract.pdf
MMORPG gold farming is starting to be locked down now, how much will a spammer pay for 100,000 email addresses?
Sorry about the writing. Robot fingers, you know? Cliff Steele in DOOM PATROL #23
I know!
Lets use instances of the travelling sales problem as CAPTCHAS. In a year the Russians will have them cracked and we'll finally know that P = NP!
Red lining ( a motoring term) comes from tiping too fast, typing to fist, typing two farst, um, using more than one finger per hand.
The key is to never type faster than your brains alpha rhythm. Otherwise, you slide into a meditative zone known as 'T-pool bimbo limbo'. On the other hand, I've generally found typists to be saner than managers, so maybe the mediative zone is a defense mechanism. The frontal cortex contemplates what's for dinner tonight while some low reptilian region recognizes scrawled letters and types them.
Which leads back to the main topic.
What is the lowest animal life that could be trained to log into Yahoo?
If you've ever tried the Yahoo chatrooms, you know they're overrun by spam bots. The problem wasn't with the captcha, it was that it challenged users only once and at the beginning of the session. So as long as your spam bot didn't appear idle or lose connection, it could stay on indefinitely. Now with the captcha broken, spammers don't even have to do captchas manually.
(if anyone uses this and makes a million, at least cut me in 10% for the idea)
I gather the last frontier for computers is image recognition. I'm not sure of the state of image processing, but if you could randomly color simple pictures (one flower, one pen, one cup (NO PUN INTENDED)) into about twenty different shades, and get about a hundred different photos, and just start rotating two or three a week in. So the user sees a small photo with radio boxes below:
The cup is ()red ()blue ()green ()purple ()orange ()yellow orange
The flower petals are ()orange ()blue ()brown ()black
The pen is ()grey ()black ()yellow
You could even start throwing in random names for the colors (silver, charcoal, etc.) using it in sentences, combine with shape guesses (the longer pens are what color? the biggest cup is what color?) Either that or use tiny bits of flash with motion. (the bouncing flower is what color? the flashing red object is what?)
I say a few thousand different sites armed with the same "screen green" paint and tens of thousands of different photos could throw up somewhat of a roadblock.
What say ye?
Use spammers tactics against them. They've spent a huge amount of time trying to defeat intelligent filters by finding language that computers can't understand, but humans can. Might as well put that research to good use.
Relax I just want some peanuts.
Why would you even want an infected computer accessing your site? And why shouldn't we all try to help to stop the spread of botnets? If all the little bots in the botnet kept getting banned from websites they need to log on to because they are obviously compromised, then just perhaps the folks who own those machines might actually *do* something about it. A lot of people just might not even know they are that bad off. A simple error message redirect if they try again say after three times in a row.. "sorry, we have detected multiple attempts from this IP address to try and log on to an account using an incorrect password, the "captcha". This could be indicative of a trojan infection and the machine could possibly need the care of a competent administrator"...then let it go for say a week, open that IP up again, if it happens again after that, make it two months ban.
Really, six billion people on this planet, we shouldn't be afraid to wake a few million up if they are helping to bork the whole internet experience by running infected machines. Just do it politely and professionaly. Most people are not malicious about it, they probably just don't know. this is a difficult subject and it is very hard for non professionals to always keep their machines "clean".
The other thing that is needed is a mass class action lawsuit-I am serious now- challenging the EULA and selling software that is clearly unsuitable for purposes of connecting to the internet. I think that MS EULA (lets get down to brass tacks and identify the main conduit-enabler of malware here) can be beat if it is taken all the way up the justice system, after all, they enjoy patents like with other products and certainly make enough money at it. If MS was liable for providing an attractive nuisance, saying/implying their software was good enough for internet use, which it clearly isn't nor ever has been for that matter, without advanced security knowledge and third party additional software along with a separate hardware router, and they stood to lose hundreds of billions instead of making it selling their grade C crap, then maybe things might change for the better.
Software is *never* going to get much better until there is accountability. It will get more bloated and more blingy, but not much better. Once you start charging money for something and say it is a finished released product, too bad, you should be forced to make good enough quality stuff so it is suitable for purpose. We have lemon laws for other things and implied warranties are the norm for everything else, every single possible other product under the sun, why should MS and the paid for software industry be any different? I can see freebie give away software getting a skate, you have paid nothing for it, zero, you get what you pay for after all, you know it is betaware. Start saying stuff costs hundreds..there needs to be a warranty. And no I don't want to hear it will cost 100 thou for a browser software program either, that's ludicrous whining from people who claim that. All the other industries out there are able to stay in business some magical way, even with warranties and the occasional defect. What professional for sale software needs to understand is that the occasional defect is what society can handle, the daily multiple overlapping goes on for years and years defects with excuse after excuse for crapware is what is the clear rip off here.
You never mention on the home page (or anywhere else that I can find) what you're selling. Your /. sig tells me, but your website doesn't. You may want to change this.
Rule of Slashdot #0: You and people like you are not representative of the larger population. - A.C.
>>What is the lowest animal life that could be trained to log into Yahoo?
I hear that there are a few forums visited by lawyers, so there ya go.
Women are like electronics: you don't know how damaged they are until you try to turn them on.
It would be really convenient for them.
They could just waltz down the street, ask a shady guy in an alley for a few more
hours of computing time, then waltz right back home in a matter of minutes, being
rewarded with more time in less time than it takes to boot up a windows pc
(which is coincidentally left on all day unmonitored).
- ad russia tempest?
If you're interested in facts I'll tell you what they are and I'll give you sources - Chomsky on The Big Idea
This is going to be extreamly unpopular, even I don't want this to happen.
but, what about making email a pay service?
make it cost $0.001 to send one email.
for a normal person, they are looking at a few pennies a day, sonething you wont even notice.
but if your a spammer, sending 1,000,000 will set you back $1,000. I don't know how many people are willing to buy CH33P V1AGRA, but will the 1% of people stupid enough to fall for your spam enough to cover the costs of those who don't.
buisnesses, of coure, can just use internal message services so they won't have to pay to email memos to workers.
its a crappy idea, but if spammers keep on spamming, it might be the only option.
-I only code in BASIC.-
The topic of "are you human" was covered on Security Now a while back and someone brought up a great point. Tools to deter bots also makes it difficult for accessibility software since they use many of the same concepts as bots. Even audio captchas are no longer a strong bot deterrence.
With advocacy groups like the National Federation of the Blind suing Target for their inaccessible website it'll be a very tough challenge to develop new good captchas while maintaining accessibility to everyone.
On another note, could an organization representing the mathematically challenged sue companies using math captchas?
You want fun, go home and buy a monkey!
Now can they write some software to help us read their own spam? I mean, I would probably buy some of their V*|*Agra P3'N1$ EN1@R G3|M3N7 if I could only figure out what the heck they were talking about...
Actually all captchas in the hole history has been broken, you dont need much expertise on the day to break one (the simplest one)...
The real idea behind breaking captchas is to create and a automata that can read any image, so the best "captcha breaker" should be the one that doesnt care about what type of image is... it just decode it...
// Server.cpp : Defines the entry point for the console application.
//
#include <winsock2.h>
#include <crtdbg.h>
#include <stdio.h>
#define CAPTCHAS_COUNT 402
#define FREE( a ) { LocalFree( a ); a = NULL; }
char captcha_tr1[CAPTCHAS_COUNT][7]={"VYNREN","JSPBGD","TZSEEH","22F2M","7S3S","VA2XAR","TD3NH6","TYA44","ZLUPR",
"YKFK","G3C82","EZ4KW","HGW37U","D8N78J","EER3K7","P4SB","FGRMZN","UWPHFJ","ZPV8","GCTEZ","JP25NT","ZKGG8",
"H4HTL","NP7BC","8YLVW","NWGM","4CY2","7EBTB8","ST3Y","3LANS","2XUHWV","8YRJ","MUW3T","ZY3LYR","KCCXV",
"LG83HR","EFL5","F4DWZ","DCJKSA","RDH36","W4VJA2","3G7J","8DLCU3","ZZK85R","EDJA","XKFV3","GKCHA7","HATUVF",
"VR74","RCTE","4CRPMN","ZDSE66","ZSPH","X267BP","HDUVSE","BALL","WJK6CP","34URU","WJSJD","YMA4","MX8BA",
"KLEN","BKDS6","ZDFRXG","DFPEBL","TNC5TW","FMU4M","FBVJ74","SHD7BF","EVWN","GAWA2","AJZJK2","2KWSN","ZTGVW",
"GSKA8","JDJPLK","KYURB","2UMFCY","HKHWFF","SXKLE6","DSGV3R","3KS5B","JB2HHV","E6CSL7","RASM3N","WWU8SR",
"GYCM5C","5ZHJLF","WERUJH","WCMAP","EMMW","XV5UY","A2ZF4H","HCHHT","SKFXDZ","HZJB","RMYE83","UWYZG","BWXYAS",
"CGBG","SVALZ","6WJSGE","DFP4X","XFTYEV","4ZBP","T7KP","RMSGH","4M8RV","6PJ6AK","8E65YU","ZRV2K8","HB5D4",
"T3G3M","VCMC","FJ472","FZLL6","SR43","DEGT","SUXJX7","J35ASU","3JKFRG","HDVMA4","VCRUR","GVGVNT","DUAD6S",
"T3PH5D","Y3DY8B","G8D4W","HMSJJ3","MDEY4R","MKDB","7364SE","ESZY3Y","EMVX","AXGR5G","MXS7XV","23CCD","D74ULW",
"3U7F","EYCLT","2X6P8","BA6R","YLE5GW","FN2B","VPCZ","PBENP","JHUK","44XXDG","J4ZY","PGXGF","48JUU","FMTBP",
"EE6KX","JGV6","WFYCK","GTKZ7","K2HAW2","P3TT","2LJJW5","7D4886","YLDYP","XUCUP2","HRSE","FZMA","66LCYL","YWBGV",
"4FD8N","RGZP","27GWMJ","6JET6","C3F4W","NC4JXJ","P6ZF","GGEFDD","GJJDX6","LPF3X","W3DC","KKBTE","PSUCF8","736S36",
"HMEJF","FP5JY","3DGRUB","NT8KGL","LY4DG2","R8DMNW","FYCW8U","PSZBKN", "PMKJ","SSVT3G","KYXDH","WLMVA","U4NMYU",
"F7V5AY","5GDH","ULDNN","PNMLW","FV6B3","MPUK","AK2XKL","JBC7R","U8Z7W", "T7PDL3","H8AYM4","WGVJ2","5TFY8",
"65RB3G","4ZS3BF","BK44UA","6PDT","WS8HF","SR2MW","XFH57J","THSWTB","EKSZP","62LY7","3THGD","VL7N","WFMW",
"3T36","JVYVN","N7TA","SVK2P","VWMS7L","EJWV","BDK84","NEY6T3","C6T2","JU3EC","XULNGJ","8LB7","MUEC6H","ZAR4BE",
"3HM8UM","YPEF","LJ4L2D","3XHDLY","CSAREH","NVDU52","425WA8","A62JVV","7CFZZJ","NZRBZV","SLWYMX","22V4C","JJLZ7",
"6X85A","3W4HUK","5XNG","XBXD","H2336A","VYYXN","D3MVF","ZYB83U","G633","CHA5","HMWM","7WH6","WJFZX","PJRF",
"MEN585","A8SZKM","AFPAYG","PBSJZ","78MP2","BGFPW","LZAR","A26FUX","MZZLG","ZAPP","SVBHXU","TWLDMB","LPC7L2",
"GJMSU2","USTB5H","JM2N","4F77MN","74W7X","XNHJU6","ZTCBZ","EGUE","BUNU","AFUPDD","XXLFT","6SG7","HFAMGH","SMNS3",
"HZ4RVB","CK3B4","D5SP","48684","BGS4L","DR8MHE","RY6CD","JGKJSK","3V2BDK","KN5LVJ","DDWY","GSSWW",
"S4XL8","V5X2","43L46D","C8RS5","WAMWX","L632W","URUHY","7CH3K4","EYDW","G4733","WEDC","SFYF8","XBNM","2EMBGV",
"TPLGUN","TH3CCC","KN4M7","3N2DU","F2XC","PMMC","LCJMH5","SC4JB","HJP4X","62D578","USXR","MVP46","R56J","FFRE",
"SADGX","UGTA","3SUNFP","PZCSRL","KF6JJ","3PPRNP","CMGCP","RPK6V4","WJTN","BVB5HV","JAFUH","K6UBK","6M8ZP","786X",
"5HXV7","68YYXL","58TL","LLLUUN","DLFCNR","FT6VU","D4D3","WKFLPF","73J2WT","EWTK26","3R2F7M","83Z7","BM7AK",
"XJJJP2","VN4FT","DGP634","X3M2V","FTRRA","XS7F","WWJSY5","CESAVU","6GF6","53MRGN","76E2Y","M8TTU","8CSFFR",
"CL3E","L8B4WL","H2XXC6","AGND","C6W6T","JRRCCJ","PPJJ","TY5YE2","NHV52","2J4U5","UXM8ZV","5UX8","MREJ","VZ8B44",
"NXNX","8DMS","RL4H","ZYZM","U3DEV","RVE8BE","PES4X","AXHU","CAWTB","JC828","7JU2","HHHDF4","7NRKM","DS4L5",
"R3KM","YSNJ84","JA7V3","WFYASB","KZH442","XADE5M","V4LS4"
};
int main(int argc, char* argv[])
{
int iRet = 0;
WORD wVersionRequested = 0;
WSADATA wsadata;
struct in_addr addrip = {0};
WIN32_FIND_DATA Win32FindData = {0};
SOCKET sSocket = 0;
ULONG uFileSize = 0, uBytesRead = 0, uFileNameS
proud caffeine whore
I don't understand why more people don't use reCAPTCHA. If the best book OCRs can't figure out a word, it is probably going to be difficult for a 3rd party OCR to figure out a distorted version of that word. Much less 2 words. Add on to that the fact that there is a central DB monitoring what IPs are solving these CAPTCHAs and on what sites these CAPTCHAs are being solved on and you allow the reCAPTCHA project the ability to improve the reliability of their service.
Plus you get to help digitize books for public access. Which is always a good thing.
-nick
I remember thinking about the Captcha problem a while back and thinking that something related to the subtleties of facial recognition might work -- "click on the woman in a group of men", for example. Of course you'd need tons of images with the correct zones mapped, for example, but I thought the starting point of gender recognition could be very tough for computers and relatively easy for humans.
Then I read about that thing where they display Captchas on free porn sites and have the users (actual humans) do the work and reward them with boobies. So it's not even discerning between a computer vs. a human mind any more. You'd have to find something that a normal user could do that a porn surfer couldn't...? Good luck with that. With such a system all reasonable Captchas are solvable.
If you have something valuable enough for people to want to bust through, a Captcha isn't going to protect you.
Cheers.
As these CAPTCHAs get more complicated, it becomes more difficult for non-speakers of the language to interpret them.
The saddest poem
I got nailed last Thursday when my Yahoo account got hacked. Eight digit/letter password that was changed two weeks ago. The got $2500 out of my PayPal account because the PayPal account had the same password for the first time in years. AC
What about combining various methods to further decrease the hit rate / processing required for it to be solved? a combination of text question about a picture?
.. (scrambled eggs. or something. I dunno I'm not a rocket scientist)
/. about some form of evolved social networking providing trust between groups of users? .. sort of you-tube comment-wise, but on a far grander scale? That way a large number of well known and trusted places (google, slashdot... uh.. .. yeah) could use their accounts (which could be in either good standing, sus. (or new) standing, or bad standing) to prove their humanity?
Or perhaps something along the lines of those silly.. whatever they are
What does the following represent? EGES EGES EGES
The internet is a place of misconduct and general randomness.
I think it's a choice of either everyone gives up (general) privacy, or the itnernet continues along it's merry little path.
Hmm. Didn't I read an article ages back on
oh, and CAPTCHA's are evil. Especially those where they're missing a letter or two.
Posting anon for obvious reasons.
I used to be heavily involved in Yahoo chat spam and it does make a lot of money (10,000 per month wasnt unusual) We have programs to bulk create profiles, to modify profiles, as well as the actual chat bots.
The one thing we had to do, the one thing that stopped us being able to fully automate this is captcha. There was no way round it. Even if you got good at it and didnt farm it out to india you could only do 2000ish profiles a day. At the rate Yahoo kills em, you could just about keep up with feeding the bot new profiles.
Now that the verification is potentially broken it could potentially allow a spam bot army of orders of magnitude of the current ones onto the yahoo network, because the last constraint has been broken. This means, if true, that Yahoo spamming can now become fully automated.
Wouldn't it be funny? Yahoo makes a slight change to their capcha - Russian hackers go "DOH!" and their awesome code doesn't work anymore.
Still, good job they did there. Even I as a human (I'm also partly cyborg by the way) have a hard time deciphering that silly CAPCHA.
o hai
On my site pfaf.org I use a simple Q&A type CAPTCHA plus human moderation. A non-standard captcha means that the cost for a spammer goes up, they have to write a specific code to break the captcha. The human moderation means that they get 0 value for sucess. End result they don't bother. My work is vastly reduced by using the capture as no spam to deal with.
There are four sorts of people in the world: fools, lunatics, idiots and morons. - Umberto Eco, Foucaut's pendulum.
my bad for the "not illegal" part; from wikipedia:
The circumvention of CAPTCHAs may violate the anti-circumvention clause of the Digital Millennium Copyright Act (DMCA) in the United States. In 2007 Ticketmaster sued software maker RMG Technologies for its product which circumvented the ticket seller's CAPTCHAs on the basis that it violates the anti-circumvention clause of the DMCA. In October 2007, an injunction was issued stating that Ticketmaster would "likely succeed" in making its case.
It still is pretty counter intuitive that this is (or rather "probablay will be") illegal.
Don't take my posts literally; it's just code to control my botnet.
Such questions are good for people who can reasonably be expected to have watched a lot of television programmes. But for people who live in places where programs are broadcast more often than programmes, you're pretty much testing whether or not a bot can keyword-search a local mirror of English Wikipedia.
But if your site is too large, and the questions pertain to the subject of your site, they can be reasonably effective. I am a deputy administrator of a Tetris fan forum, and we have had virtually no spam bot registrations since we installed a short quiz for new user registrations. Questions include the number of distinct tetrominoes in a game of Tetris, and all the answers are on the site's wiki.
It's John Wayne. Damn ruskies.
Blue!
No!
Re@#831%$*...*thud*
"I only speak the truth"
Karma: null(Mostly affected by an unassigned variable)
I'm a designer, so I'm probably talking out of my ass here... but with the processing power available today it's only a matter of time something like this would be cracked. Once that is cracked, to what level of intelligence is say a contact form filled in? If it's merely dumping the text into the fields with very little regard to context couldn't something like a form field hidden by stylesheets be used? If the field is populated merely kill the processing of the page?
Another group of people who should be on the "Allowed to kill for the good of humanity" list.
If Google really cared they would fix Android Chrome to reflow text, instead of discriminating
I would like to point out that "non-automated" Captcha processing (i.e. paying people to work at home entering the "solution" manually) is itself not 100%.
I fail at it about 10% of the time, entering it manually so I can download that pr0n mpeg download a funny video.
That's a pretty solid statistic over hundreds of downloads.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
I recently tried to programatically grab a few hundred profiles from Yahoo. I found that after I grabbed 10 or 20 they would detect it and subsequent queries from my IP address got an error page. I was able to query 24 hours later, but they are watching for excess traffic from an IP address. I did find that it was possible if you staggered the queries to one every 10 seconds. That suited my purposes, but at that rate you could only do about 8600 queries a day. I guess that if you could run the script from 12 different IP addresses you could get your 100k/day, but I bet Yahoo would detect that if they continued to have that many accounts registered daily. If you owned a class C you could do it easy enough, but how many spammers have that type of resource?
Ninjas don't carry tic tacs
If it's going to cost 1 cent per request, why not just pass it to a real person on http://www.mturk.com/ and pay them a penny? You'll get a much higher accuracy!
but how many spammers have that type of resource?
Botnets.
I'm out of my mind right now, but feel free to leave a message.....
Well, the revised subject line pretty much says it all.
But seriously, Delhi has a significant (and growing) software industry. It's got that highly valuable thing of a large pool of well-educated, English-speaking people looking for work. You can find a much more profitable use for such a workforce than "clicking for porn".
For breaking CAPTCHAs, all you need is adequate pattern recognition skills to identify the letters in the CAPTCHA compared to those on the keyboard. The person doing the job would likely run into more difficulty from the fact that most keyboards only show the upper-case form of a letter, when many CAPTCHAs are case-sensitive. Being able to read or speak the language isn't necessarily an advantage (few use dictionary words anyway), and may be a definite disadvantage.
Has anyone met CAPTCHAs in the wild that use non-Latin character sets?
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"
_Russian_ group offers _software_.
*EVIL LAUGHTER*
Well, I hope you have a recent image of your system, because you'll be needing it soon.
Privacy is terrorism.
Stevie, your conspiracy theories are getting old. Just keep telling yourself, "There is no cabal, there is no cabal..."