Slashdot Mirror
Windows Live Hotmail CAPTCHA Cracked, Exploited
eldavojohn passes along what may be the last nail in the coffin for CAPTCHA technology. Coming on the heels of credible accounts of the downfall of first Yahoo's and then Gmail's CAPTCHA, Ars Technica is reporting on Websense Security Labs' deconstruction of the cracking and tuning / exploitation of the Live Hotmail CAPTCHA. Ars calculates that a single zombie computer can sign up over 1400 Live Hotmail accounts in a day, and alternate account creation with spamming. Time to dust off Kitten Auth?
Who's killing kittens?
/.ed.
Cutest kitten
Absolute power corrupts absolutely. indymedia
KittenAuth, Hot or Not, simple math, word tests, anything to get rid of those pain in the ass CAPTCHAs.
"Most people in the U.S. wouldn't know they live in a tyrannical state if it walked up and grabbed their junk." - MyFirs
I could even have them send mail to each other to lend a thin veneer of realism to discourage the account provider just wiping them automatically.
Why are they allowing the same computer multiple accounts in the same day?
Why are they allowing the same account creation attempt to fail over three times?
Still... I guess as computers get smarter, this is unstoppable.
All my accounts are white-listed. If I don't know you, I don't see your email.
She was like chocolate when she drank... semi-sweet at first and then increasingly bitter.
For as long as I can think, hotmail has been a spam source. "not blacklisted"? My ass.
Assorted stuff I do sometimes: Lemuria.org
Oh Boy - here come the endless "we should do THIS" scenarios.... we should pay for each e-mail... we should all whitelist... we should throttle how many messages a person can send each day... we should outlaw webmail like Yahoo or Gmail...
Problem is that none of them really will work in the Real World (RW).
In the RW people like webmail. In the RW people like to change e-mail addresses, or create new ones for specific needs. In the RW some people like "real" e-mail, downloaded to a local PC, and others like Google or Yahoo or Hotmail and keeping everything on the host server.
In the RW a lot of people and businesses send a lot of bulk e-mail, very legitimate opted-in e-mail. In the RW a lot of people get important messages from entirely new people, people who haven't been whitelisted, and who are unlikely to bother going through the whole "If you want to e-mail me you need to click the link below and prove that you exist" process. After all, clicking links in e-mail is something that we teach people to NOT do.
And in the RW the spammers always stay one step ahead of the ISPs and mail providers anyhow.
No, what's needed is a real ground-up redesign of how e-mail works. we need something that encompasses the ease of current POP/IMAP/Webmail services, but which somehow includes ways to authenticate and/or block mail without user intervention, and which does so with near perfect reliability. And which maintains some backwards compatibility for at least a few years.
Adding more hoops or captchas or whitlelists to the existing mail sysytems just isn't going to solve the problem.
Three Squirrels
I love the idea of ReCAPTCHA and its novel side-effect of helping digitise old books. But that doesn't mean it won't be cracked eventually, especially not since a computer could look at the example given on ReCAPTCHA's website:
'This aged portion of society were distinguished from'
The OCR read 'portion' as 'pntkm.' This doesn't mean it's hard for computers to decipher, it just means that the OCR programme sucks. Hello! 'pntkm' is not a word. It's not caps, so it's probably not an acronym. It has no vowels, so it's not pronounceable. It also doesn't appear in any dictionary. Heck, even if it was scanned as some similarly-spelt word like 'abortion,' it makes no sense in the context of the sentence, and presumably if the software was sophisticated enough, it could recognise that.
Take off every sig. For great justice.
Your solution doesn't account for one thing:
Botnets. If someone really wanted to make 10,000 accounts, just have each computer on a botnet make 1 account each, with a botnet of 10,000 computers. Different IPs, etc to make them difficult to differentiate from legitimate creations.
As computers get more powerful and AI gets better, CAPTCHAs have to get harder or they are broken.
And then there is the "porn for CAPTCHA" hack, where you have a second site where you have people solve a CAPTCHA to get access to porn, and then the hacker uses that solution to make an account on the original site. The only solution is to have a short timeout, but if the porn site gets enough traffic, even that isn't an issue.
AI may be hard, but it isn't impossible to have real intelligence used en masse.
If I have nothing to hide, don't search me
The fatal flaw in your logic is in assuming that a human can discern spam.
I do not respond to cowards. Especially anonymous ones.
Then a computer will be able to discern spam, and the problem will solve itself. The two problems are not really of the same nature. Solving a CAPTCHA means getting at least 5% of your answers correct, while solving the spam detection problem means getting at least 99% of your answers correct. If those two figures were the same (e.g. 70%), then we could indeed construct a spam filter from a universal CAPTCHA solver: the CAPTCHA question would be an email, and the answer would be whether it is spam. But the figures are vastly different, so unfortunately it's highly possible that we can't find any secure CAPTCHA *and* we can't find any reliable spam filter.
I think I see a wonderful circle here. The basic problem is spam. It's a problem, because we can't seem to make a computer program which can reliably determine whether an email is spam.
Wait a second. We can't make a computer program which can reliably tell if an email is spam. So that's your CAPTCHA right there -- present the user with a selection of emails, approximately half of which are spam, and ask them to identify which is which. Since computers are not good at this task (thus the entire problem!) it seems this would be the ideal challenge.
What is absolutely wondrous about this, is that if the spammers try to solve this problem, what they will create is basically a program which can reliably distinguish spam from non-spam. No spammer would ever do that, because if that piece of miracle technology ever got out in the wild, it would render the spam problem obsolete.
Internet's not only used in the US, remember that.
The issue with your solution is that it completely destroys the reliability of the e-mail system. The reason we use e-mail is because we are certain that the messages we send will arrive in a timely, reliable fashion. If you remove that guarantee, then why would anyone use e-mail?
We all know what to do, but we don't know how to get re-elected once we have done it
Canned response: you have spyware; you're not allowed to create an account on $FOO. Everyone wins, Google/Yahoo/Hotmail get slightly more secure, spambots are identified, and lusers eventually, after several failed attempts clean up their computing habits.