Next-Generation CAPTCHA Exploits the Semantic Gap

captcha_fun writes "Researchers at Penn State have developed a patent-pending image-based CAPTCHA technology for next-generation computer authentication. A user is asked to pass two tests: (1) click the geometric center of an image within a composite image, and (2) annotate an image using a word selected from a list. These images shown to the users have fake colors, textures, and edges, based on a sequence of randomly-generated parameters. Computer vision and recognition algorithms, such as alipr, rely on original colors, textures, and shapes in order to interpret the semantic content of an image. Because of the endowed power of imagination, even without the correct color, texture, and shape information, humans can still pass the tests with ease. Until computers can 'imagine' what is missing from an image, robotic programs will be unable to pass these tests. The system is called IMAGINATION and you can try it out." This sounds promising given how broken current CAPTCHA technology is.

Comments

Too hard.

[Whiney Mac Fanboy]

The general public will not know what "geometric" means*.

This Captcha suffers from the same old problem. As Captchas get harder more humans will fail them.

*or annotate... or centre

Re:Too hard.

[The Ancients]

The general public will not know what "geometric" means*.

This Captcha suffers from the same old problem. As Captchas get harder more humans will fail them.

*or annotate... or centre

If this is the case, do the captchas have the issue, or does humankind?

Re:Too hard.

[T-Bone-T]

I noticed RapidShare has a new CAPTCHA involving writing only the letters and numbers that have a cat in a certain pose and the rest of the letters have a cat in a different pose. The letters were very distorted and the cats were on top of the letters or underneath. It was actually a little bit challenging.

Re:Too hard.

[edittard]

I don't know.

Maybe if we were to gather statistics on which one has managed to survive longest without the other it would give us a clue?

Re:Too hard.

[MichaelSmith]

The general public will not know what "geometric" means*.

This Captcha suffers from the same old problem. As Captchas get harder more humans will fail them.

*or annotate... or centre Soon we will welcome computers to our online forums for their insightful, informative and interesting comments. The CAPTCHA will be there as an initial filter on the quality of posters. It will exclude stupid computers and stupid people.

Re:Too hard.

[Smidge204]

Definitely the human's problem, although presumably if a human is smart enough to make it then a human is smart enough to figure it out...

To be optimistic, I actually like to think of it the other way around:

CAPTCHAs are providing a valuable evolutionary pressure on machine vision/artificial intelligence development!

=Smidge=

Re:Too hard.

[A Friendly Troll]

It's just the beginning; it's going to get worse as they become more aggressive. RapidShare wants your money, simple as that, and rest assured that the frustration with discerning those silly cats and dogs _will_ make some people pay.

The only challenge is how to get you to pay. :)

Re:Too hard.

[morgan_greywolf]

The general public will not know what "geometric" means*.

Oh, gimme a freaking break. I am sooooo sick of everyone worrying about pandering to the lowest common denominator. But I have a solution to this particular problem.

Here's my plan: cleanse the gene pool. We'll just eliminate warning labels from everything and when the stupid freaking idiots fry themselves blow-drying their hair in the bathtub because there was no warning label on the hair dryer saying "WARNING: RISK OF DEATH!!! DO NOT USE IN OR NEAR WATER!!!", Darwin's theory of survival of the fittest will kick in and we'll be rid of the bloody morons.

Re:Too hard.

[cp.tar]

To be optimistic, I actually like to think of it the other way around: CAPTCHAs are providing a valuable evolutionary pressure on machine vision/artificial intelligence development!

... so when the machines decide to exterminate us, camouflage clothing will be of no use to us.

Welcoming our seeing and intelligent machine overlords seems futile. We will be exterminated.

Thanks. Now I'm depressed.

/me goes off to his Computational Linguistics class. Guess the overlords will understand language as well.

Re:Too hard.

[jo42]

The politicians won't like that one bit - as it would reduce the tax base by about 95%.

Re:Too hard.

[ais523]

That CAPTCHA strikes me as being easier for a computer than for a human. Recognising upside-down cats when they're always pixel-for-pixel the same is quite easy, and likewise for the letters the cats are next to.

Re:Too hard.

[endersshadow7]

I've used the Asirra Project for about a year now on my site with fantastic results. I've had absolutely 0 bot registrations, when I was getting 10-20 a week with the old CAPTCHA. Given all the press CAPTCHA's have been getting lately, it makes me wonder why more people aren't implementing something of this nature.

Re:Too hard.

[morgan_greywolf]

Who says the politicians won't be going out with them?

Re:Too hard.

[ronanbear]

Half the problem is the over-reliance on Captchas. Most of the cracks work by educated guessing and have large error rates. This fact could be exploited by the webmail companies. Additional Captchas for sending suspicious messages (lots of messages) and early activity.

That a Captcha is the only thing standing between a gmail account and the ability to send large numbers of spam messages is more of the problem. Run the spam filters on outgoing messages and delay some of them to give time for the new address to be blacklisted if it's sending spam and especially if there were large numbers of Captcha failures.

Re:Too hard.

[Anonymous Coward]

"Guess the overlords will understand language as well"
Well if they understand the female human langage, they deserved to be our overlord !

Re:Too hard.

[Anonymous Coward]

If this is the case, do the captchas have the issue, or does humankind? It's "mankind" or "humanity". "Humankind" or "manity" sounds silly.

Re:Too hard.

[Anonymous Coward]

The general public will not know what "geometric" means*.

Really? How deep did you reach in your ass for that gem?

This Captcha suffers from the same old problem. As Captchas get harder more humans will fail them.*or annotate... or centre

Doesn't matter anyway. The site has been slashdotted......

Re:Too hard.

[sshir]

As I mentioned it before.

That's how to break it: google talk: 'Using Data to "Brute Force" Hard Problems in Vision and Graphics' by A. Efros.

Re:Too hard.

[makomk]

Exactly. IIRC, if you get the CAPTCHA wrong, they make you go through the entire two-minute waiting period again (and the message displayed tells you that you can skip the CAPTCHA by paying). Then, half the time, they then tell you that you've tried too many times and should try again later - but only after you've waited two minutes. Oh, and I suspect that entering the CAPTCHA too long after it's first displayed counts as a failed attempt for the "tried too many times" logic.

The whole thing is cleverly designed to be as annoying as possible while still actually functioning correctly. As you say, they want to get people to pay them money.

Re:Too hard.

[gnick]

Manatees look a little silly too...

Re:Too hard.

[redxxx]

Do you really want these 'humans' mucking up your website anyway? If anything we should be looking for more difficult Captcha. Shame no one's figured out how to get a gom jabbar to work over the internet.

Re:Too hard.

[MazzThePianoman]

Good. Education and common sense have taken too much of a back seat in recent years because everybody now-a-days is allowed a crutch to get past them. Spammers are also using humans to crack captchas so eliminating robot programs only slows the problem. The solution is harsh punishment for spammers in order to make spamming just not worth it anymore.

Re:Too hard.

[Anonymous Coward]

The general public will not know what "geometric" means*.

We do not care half a hoot about [knowing wink] those [does that hand action] members of the general public.

Yours sincerely,
      Ron Paul

Re:Too hard.

[LunaticTippy]

If Asirra became the dominant CAPTCHA the spambots would adapt to it. There is something to be said for using an unpopular CAPTCHA and not telling anyone about it.

Re:Too hard.

[mdmkolbe]

That is a cool project, but in all fairness that CAPTCHA probably works for the same reason "the Mac has no viruses". That is, it is so little used that spammers have focused their efforts on bigger targets. Thus an inherently less secure system can be less likely to be broken.

As as example, since the Asirra project takes its photos from Petfinder.com, all a spammer has to do is scrape all the Petfinder photos and categorize them by what words (e.g. "cat" vs "dog") are near by in the HTML. Once this database is built, it simply becomes a problem of looking up the images in the database (likely an easy task).

As long as Asirra doesn't become popular, it will be successful, but if it becomes popular, expect it to start failing.

Re:Too hard.

[kaens]

I would think that this would just drive people to use a different upload service. Well, hopefully at least.

Re:Too hard.

[VeNoM0619]

It doesn't even matter, this looks even easier than a regular captcha;

Test 1: I literally clicked in the middle of the "image" (whatever geometric was supposed to mean in context. I didn't know if I had to click the center of an image, or center of the subject in the image). Which was laid out in a nice 3x2 grid, meaning halfway over, and quarter way down = jackpot.

Test 2: The site was slashdotted, so I couldn't see the image, but I could see the options. 15 options. That's a 1/15 chance, so the basis is going off of adding more options to make this harder for a computer. Decent thought, but 1/15 chance of a computer being successful regardless of the image AND knowing your subscribers have to read 15 words to find the answer.

No offense to the guy, but this seemed easier than a captcha requiring an OCR. To be honest, the cute captcha"/kittenAuth was still the best idea(s) I've seen, cause it's based on human opinion opposed to an "absolute" answer.

Re:Too hard.

[NeutronCowboy]

And if these CAPTCHAs become widespread, they'll be cracked just like the previous ones were initially... by giving free porn to people who'll crack the Captchas for the spammers.

Re:Too hard.

[arth1]

The general public will not know what "geometric" means*.

Oh, gimme a freaking break. I am sooooo sick of everyone worrying about pandering to the lowest common denominator. But I have a solution to this particular problem.

Here's my plan: cleanse the gene pool. We'll just eliminate warning labels from everything and when the stupid freaking idiots fry themselves blow-drying their hair in the bathtub because there was no warning label on the hair dryer saying "WARNING: RISK OF DEATH!!! DO NOT USE IN OR NEAR WATER!!!", Darwin's theory of survival of the fittest will kick in and we'll be rid of the bloody morons.

So, if I show your mother a map of the US, including Alaska and Hawaii, and she can't point out the geometric centre, should I kill her? (And presumably all her offspring, since society failed in culling the gene pool before she reproduced?) Or just deny her services like banking, bill paying, pension plans, paying taxes, or anything else that could possibly be online and use a captcha?

Re:Too hard.

[Wellington Grey]

As Captchas get harder more humans will fail them.

No kidding. It's difficult to describe what love is.

Re:Too hard.

[Anonymous Coward]

Pfftt... evolution's overrated... I'm waiting for some intelligent designer to get it right.

Re:Too hard.

[v1]

The first captcha was to pick the center of an image, but of the seven or so images, at least two were melding well enough with an adjacent image to make it questionable as to whether they were parts of the same image, so finding the center of the image was not quite straightforward, given the amount of distortions present.

I passed the first one by clicking on the center of one image I was fairly certain was stand-alone, and went on to "annotate". Of the available options in the list, I looked in vane for "hairball". There were some vague shapes in the highly scribbled up image, but nothing I could make out. I picked wrong and was told I was not a human.

I think if they want to go this route they should make the user have to process the information. How about asking you 10 short questions - single sentences you have to either mark "fact" or "fantasy". That would require a small database of unambiguous statements, that could be randomly selected from. Miss any one and you lose. The odds of someone missing that would be much lower than this is.

I had a what, 1 in 10 chance of guessing the annotation correct. If that had been even 5 fact/fantasy questions, I would have had a 1 in 32 odds of guessing them all correctly. Easier to do, fewer false negatives, and lower odds of a correct guess. But so far I don't think anyone's tried "reading comprehension" as a test. That's something that's very hard for computers to simulate.

Re:Too hard.

[steelfood]

Agreed. Webmail should have filters that limit the e-mail sent based on common spam behaviors. For example, limiting the number of recipients based on a certain criteria (e.g. unlimited the first message, +10 recipients for every minute after a message with over 50 recipients), limiting the recipients to only people in the address book, etc.

As for spam on boards and comments systems, /. has a decent system of CAPTCHAs and filters. It's not perfect (I'd rather be able to post anon more frequently), but it keeps everything but the trolls away.

Re:Too hard.

[shellbeach]

The general public will not know what "geometric" means*.

This Captcha suffers from the same old problem. As Captchas get harder more humans will fail them.

*or annotate... or centre If a member of the general public doesn't understand what "click the centre of one of these images" means, then the robots have indeed won ...

Re:Too hard.

[Eivind]

You'll also need to stimulate the non-stupid to have kids. As in make it more attractive to have kids even if you're well-educated and smart.

Currently there is a strong negative correlation between education and intelligence on one hand, and kids on the other hand.

For fairly obvious reasons really, first the smart girls tend to be smart enough to avoid getting pregnant with 17. If they are well-educated, this also means they spend a lot of time studying, and most want to work for a year or two to be established before getting kids, which mean many are like 30 before they even start considering it.

End-result ? 90% of the women with only basic-schooling have children, and they have 2.4 each on average.

35% of the women with a Masters or Doctorate (Hi Miriam!) never get children, and they have 1.3 each on the average.

Currently, in the west, the dumber you are, the more you're likely to breed. (said the guy with 3 kids *grin*)

Don't take my word for it. I think I just proved I'm dumb. Or something.

Re:Too hard.

[runeks]

I'm not holding my breath. They've been saying that for the last 50 years... not much has happened to support this view yet.

Re:Too hard.

[Chubby_C]

Very true, it took me 3 tries to get the annotate, none of the words for the first 2 seemed to match (to me at least)

Re:Too hard.

[Anonymous Coward]

The general public will not understand, because this is not the geometric center but the "semantic" center.

Re:Too hard.

[hritcu]

I don't think geometric is a problem, but WTF is a "geometric center"?

curses...

[Anonymous Coward]

It's already spotted that I am a computer and it won't even load.

worthless

[tritonman]

who needs to write CAPTCHA exploits when you can just hire 50 chinese kids for 3 cents per day to create email accounts and send spam out for you?

Re:worthless

[Mipoti Gusundar]

you can just hire 50 chinese kids for 3 cents per day

If is really being true that they can be cutting us under by fifety percents then fine hai-tech industry of my dear INDIA is doomed. Ah well, nice while was lasting. Perhaps my medical degree is being useful after all!

Re:worthless

[ahuimanu]

Sounds like a variation on the Chinese Macro Miners in various MMPORGs.

Life is cheap in China.

Re:worthless

[deroby]

Given the 'randomness' of these things, it might be that the results aren't very re-usable, hence it becomes almost required to keep paying some "sweatshop" to figure them out over and over again. It might not seem expensive at couple a cents per 'unit', but it surely will add up to much more than finding a clever way to brute-force your way through the tests using thousands of stolen zombie-computers.

Anyway, I find it a comforting feeling to know that all the spam I receive is helping out the poor in China; makes me all warm inside.

Re:worthless

[dns_server]

You do not need the Chinese to break the captcha when you can forward the captcha to someone else and get them to break it for you.

What i have heard is that some adult websites have a captcha that is forwarded from a site like yahoo. The visitor will be presented the picture and solve it and then the adult site will use the solution to register with yahoo or whatever.

If all you need to do is pass on the solving to someone else then there is no way of telling between a real person and a real person by proxy.

Re:worthless

[Anonymous Coward]

Even a small increase in cost and time would make spamming at current scales a lot less economic, given the vast quantities spewed out by botnets. Wikipedia says we're currently at about 90 billion spams per day.

Re:worthless

[dextromulous]

In the '90s, before many "warez d00ds" discovered scripting, this was the norm as well. This was even before captchas, when all you had to do to get accounts anywhere was send some post data and reply to the confirmation email. Submit 50 (or some other number) new accounts + passwords, and you're in. Ah, the good old days.

Blind people?

[tepples]

As Captchas get harder more humans will fail them. And as the population of the Internet grows, more blind and hard-of-sight people will be using the Internet, and they will fail visual tests deployed by web site operators who don't bother to deploy a decent audio test.

Re:Blind people?

[Ngarrang]

The blind and hard-of-sight have always been poorly served by what is a very visual medium. I don't think will be changing anytime soon. And for that matter (and this may across harsh), I don't if it should be a concern. Do we lament that the blind and h-o-s cannot drive?

The cost of being all-inclusive can be too high for some budgets.

Re:Blind people?

[Anonymous Coward]

Do we lament that the blind and h-o-s cannot drive? The difference is that the web consists mainly of textual information that blind people can use.

The cost of being all-inclusive can be too high for some budgets. The same could be said for supporting minor browsers, such as Safari.

Re:Blind people?

[csnydermvpsoft]

The blind are able to use braille displays and screen readers to access well-designed sites. The whole point of CAPTCHAs, however, is to have images that computers are unable to read. Accessible design and CAPTCHAs have exactly opposite goals.

The Internet is becoming much too important to leave a significant amount of the population (pardon the pun) in the dark. We have the technology to help the blind navigate web sites independently. Unfortunately, CAPTCHAs are hindering much of that progress.

Re:Blind people?

[Ngarrang]

csnydermvpsoft wrote, "The Internet is becoming much too important to leave a significant amount of the population (pardon the pun) in the dark. We have the technology to help the blind navigate web sites independently. Unfortunately, CAPTCHAs are hindering much of that progress."

No, spammers are. The root problem of this "solution" is the spammers, who do not care our personal feelings of privacy. They don't care that their messages cause everyone else's costs to rise.

Without CAPTHA technology, none of the web mailers would be usable, as they would all be blocked by every known blacklist.

For this reason, I think the penalties for convicted spammers should be far higher than what they are now. Their actions are subverting the ease of use for a very large group of people.

Re:Blind people?

[cthulu_mt]

The Internet is becoming much too important to leave a significant amount of the population (pardon the pun) in the dark. Since when are the blind a significant number of the population?

Re:Blind people?

[Anonymous Coward]

not to mention all the color blind folks...

Re:Blind people?

[iangoldby]

I don't if it should be a concern. Do we lament that the blind and h-o-s cannot drive?

I think that's a pretty outrageous attitude.

Think about it. What is the cost of making a car that a blind person could drive? Prohibitive, I suspect. Given the current state of technology it may not be quite possible even (though we could pay for human chauffeurs if we were really determined).

What's the cost of making a printed newspaper accessible to a blind person? Quite high I suspect. The technology to read shapes on a page and convert them to something the blind person can read or listen to is not straighforward.

What's the cost of a system that allows a blind person to access text stored electronically on a computer? Pretty-much negligible.

The thing is, the web should be a superb medium for making its content accessible to practically everyone. The information is already in a form that computers can manipulate easily.

If you use HTML as it was designed to be used, there is no additional cost in making it accessible.

Come on people, this is not rocket science! Here we have a golden opportunity to make, for practically no additional cost, something that can be accessed by everyone. It's not like designing a driverless car, or backfitting access ramps and lifts to historic buildings. Why on earth wouldn't we do this?

</rant>

Re:Blind people?

[jackb_guppy]

CAPTHA are already dumping people with color issues, not blind but do not have the ability to perceive color differences.

Others are using letters / numbers that after distortion could be a,d,9,g for example.

Personal, I give a site two tries before I give up and dump them.

Re:Blind people?

[Kam Solusar]

According to Wikipedia: In November 2004 article Magnitude and causes of visual impairment, the WHO estimated that in 2002 there were 161 million (about 2.6% of the world population) visually impaired people in the world, of whom 124 million (about 2%) had low vision and 37 million (about 0.6%) were blind.

Re:Blind people?

[AF_Cheddar_Head]

I thought it was just me, yes I am colorblind, that was having issues with the way that so many of the CAPTHAs are constructed.

Re:Blind people?

[rapoZa]

There is no reason to neglect web site accessibility. People that can't see, or find it difficult to do so, have been poorly served by bad web developers, not by the technology. In fact, I think the technology has been very liberating. The cost of failing to implement enabling technologies is far higher to the whole of society than the 'insignificant' cost of implementing an accessible web site, which is why society should require accessible information. In what sense is driving comparable to web browsing?

Re:Blind people?

[Anonymous Coward]

Death penalty to spammers (and those who use their services), problem solved.

Re:Blind people?

[poetmatt]

The few times I've seen a different scenario is where they have an option of listening to an audio version of whatever word they produce in the captcha.

In the defense of many, I've seen some captcha's so distorted that I can't even make out the damn words/letters within it. I welcome a new method like this, but I'm suspecting that it will eventually be beaten as well.

Re:Blind people?

[CogDissident]

Because, you know, its not as if spammers are from serbia and nigeria, where there are already such tough laws against spamming.

I know I've said this before, but american spammers are the equivalent of the short-bus kids. They think they're doing well, but they are actually being rather ineffective and risking their necks when they don't have to.

Re:Blind people?

[phoenixwade]

I don't if it should be a concern. Do we lament that the blind and h-o-s cannot drive?

I think that's a pretty outrageous attitude.
{SNIPPED}
What's the cost of a system that allows a blind person to access text stored electronically on a computer? Pretty-much negligible. Here is where you fail to understand the problem.
    First, creating content is not negligible in cost.
    Second, creating an interface to deliver the content is not Negligable in cost.
    Third, Actually delivering the content to the masses isn't negligible in cost either.
    Fourth, as has been pointed out in other comments and in the article, the problem involves the creation of a technology that will allow your audience to access the content/service you are providing, while simultaneously preventing the use of automated systems to exploit your services by appearing to be your audience (i.e. a Human), because the failure to do so means that you may lose the entire technology, or at the very least render it substantially less useful and more expensive. Email, for example, is only being used 5% of the time as intended, the other 95% being spam (As seen on /. recently)

The thing is, the web should be a superb medium for making its content accessible to practically everyone. The information is already in a form that computers can manipulate easily.

If you use HTML as it was designed to be used, there is no additional cost in making it accessible. AH! Now I understand! You are in the wrong conversation and didn't realize it.

if you are using HTML only, the whole captcha debate is meaningless for you. HTML is designed for PUBLISHING information, captcha applies to web based applications that HTML is only a SMALL part of. After all, the only interactive part of HTML are the form elements. Since YOU aren't actually doing anything with the posted form information, YOU have no need for security and little to no need to verify that the entity on the other end of that pipe is a human, spyder, or spambot.

However, some of us do create applications that need to know this, because we want to provide services for actual humans, but do not want to provide another place for spambots to send out their crap.

Re:Blind people?

[Yvan256]

You may perceive the Web as a "visual medium", however technically the information is zeros and ones stored in files on a server.

You can see? Fine, your browser renders that information as text that you can read on your screen.

You can't see? Fine, your browser renders that information as speech that you read hear via your speakers/headphones.

Re:Blind people?

[gnick]

The same could be said for supporting minor browsers, such as Safari. I believe that's why many web pages don't bother testing for compatibility with minor browsers, such as Safari.

Some sites (www.google.com, slashdot.org) can be adapted for use by the blind, so the admins need to consider them when incorporating a captcha. Others (images.google.com, www.hotmonkeylove.com) are inherently based for people with normal vision, so these image based captchas should be just fine.

Re:Blind people?

[D'Sphitz]

Not even necessarily just the blind, what about color blindness? It's much less rare than most people think, nearly 1 in 10 males is color blind to some extent. So far i've not run into much of a problem with captchas, but as they get more complex and start incorporating color more I can forsee it becoming a problem.

Re:Blind people?

[TapeCutter]

"In what sense is driving comparable to web browsing?"

Far to many 'drivers' think they can do whatever they like as long as they don't get caught. As other have pointed out - spammers are the root cause. OTOH: The arms race has created some interesting technology.

Re:Blind people?

[Richard W.M. Jones]

Email, for example, is only being used 5% of the time as intended, the other 95% being spam

CAPTCHAs are a strange way to solve the problem anyway. A lot of spammy accounts (particularly wiki spam accounts) are signed up by humans.

The thing is though that spammers have to access the net from an IP address. Sure, they use grandma's compromised computer so they effectively have thousands of IPs, but they still access from an IP. So score the IP addresses. When spam comes from them, knock them down one point. When something good comes from an IP address, notch it up one point. (And score the scorers as well).

This will suck if your computer is compromised by a spammer, but so what. Fix your computer or your server, stop running malware, and you'll be OK again.

Rich.

Re:Blind people?

[Bastard of Subhumani]

The difference is that the web consists mainly of textual information that blind people can use.

Only a blind person could be unaware that 99.99% of the intarwebs are composed of pr0n.

Re:Blind people?

[iangoldby]

Here is where you fail to understand the problem.
        First, creating content is not negligible in cost.

But the cost is the same whether you are making it accessible or not.

Second, creating an interface to deliver the content is not Negligable in cost.

But the cost is the same whether you are making it accessible or not.

Third, Actually delivering the content to the masses isn't negligible in cost either.

But the cost is the same whether you are making it accessible or not.

In case you haven't picked up the theme yet, my original point was about the incremental cost of making content accessible - that it is very small compared to for example, driverless cars or retrofitting lifts and ramps to historic buildings.

if you are using HTML only, the whole captcha debate is meaningless for you. HTML is designed for PUBLISHING information, captcha applies to web based applications that HTML is only a SMALL part of.

That's a false distinction. HTML is an example of an inherently accessible medium (when used properly) but anything stored on a computer as text is inherently accessible. It is only the short-sightedness of some developers that makes it inaccessible.

Re:Blind people?

[$rtbl_this]

Oh, they're aware. How do you think most of them got to be blind?

Re:Blind people?

[Darundal]

Yeah, anyone try to pull anything off of rapidshare recently? I am not hard of sight, blind, or colorblind, but have yet to been able to *LEGITIMATELY* download anything off their service because of their captcha.

Re:Blind people?

[tinkerghost]

Unfortunately, CAPTCHAs are hindering much of that progress."

No, spammers are. The root problem of this "solution" is the spammers, who do not care our personal feelings of privacy. They don't care that their messages cause everyone else's costs to rise.

I have to agree, right now I am running a small website which is showing a horrendous spam problem: 300-500 messages per day despite almost no real traffic (& no Google presence). I spend almost an hour a night cleaning up the days crap. This weeks project is coding to blacklist every IP address that submits a comment with a blacklisted domain name as a src or href. We'll see how that works.

If I sue, do you think the Judge will let me break their kneecaps as a remedy? I haven't lost any money, but I have lost a lot of enjoyment. I figure a few whacks with a bat would be quite enjoyable. That's equitable, right?

Re:Blind people?

[ultranova]

The blind are able to use braille displays and screen readers to access well-designed sites. The whole point of CAPTCHAs, however, is to have images that computers are unable to read. Accessible design and CAPTCHAs have exactly opposite goals.

No, the point of a CAPTCHA is to have a test which a human can pass easily, but a computer can't. Most current CAPTCHAs are image-based, since that is simple to implement, but this is by no means a requirement.

Re:Blind people?

[Narpak]

No worries, in a few generations Genetic Manipulation and homegrown eyes will remove Blindness as an issue ;)

Re:Blind people?

[JasterBobaMereel]

So you have CAPTCHA on you signup screen and immediately cannot have any customers that ...

Are Blind
Are colour blind
Have limited vision
Do not speak English
Do not know Western Culture

That's a LOT of people ...!

Re:Blind people?

[Narpak]

I think that as the amount of data being transfered continue to increase bandwidth will become more of a commodity. The more bandwidth is worth the harder spammers, and other resource "drains", will be viewed and dealt with.

Perhaps it is just speculation but I think that the internet will continue to be integrated into the infrastructure of society. And the amount of persons with access to the net will also continue to grow. The more people and services depend on the system the greater the problem of spammers will become. The answer might not be harder punishments; but better laws and regulations concerning the usage of the net in general.

Part of the reason behind the current state of affair is the fact the governments haven't really used as much time and resources on understanding the Internet in relations to our society as they should have. Proper and public debate on the issue is a first step; however, so far politicians seem to avoid really thinking about the wider questions regarding the Internet.

Sorry, I seem to have wandered off for a bit here. But just seems to me that the problem with spammers is just a small part of a greater problem. To recap; the Internet is big, complex and still a fairly new concept. Most seem content to just sit back and let uninformed politicians and lobbyists (more informed; but agenda not always for the best of society) make the laws and decisions regarding the future of the Internet. Be it small problems like Spammers, or big concepts like Net Neutrality.

Re:Blind people?

[rapiddescent]

The blind and hard-of-sight have always been poorly served by what is a very visual medium.

This is not true, I once worked for a genius of an architect at a very large organisation - he was blind and told me that the web had opened up whole new avenues of access to research material that was not available as braille from the library etc. he used to clatter away on a braille 'screen' accessing google and so on.

I've said it on slashdot a few times, but I had to change a large banking authentication system in the UK from using CAPTCHA because the RNIB basically said that any large UK company using CAPTCHA would be taken to court (or the front page of the Daily Express - not sure which is worse) if an accessible alternative to CAPTCHA was not provided on the same page at no cost or hassle to the user. The Disability Discrimination Act states that 'reasonable measures' have to be taken to provide for visually impaired users, however, the RNIB has a very strong powerbase in the UK and have will fight an applicationthat has only CAPTCHA - of course, if you provide an alternative, what will the crackers use?

visual impairedness is more common than you think. many people are not registered blind, like my dad with his 19" screen and nose marks against it, doesn't call himself blind.

Re:Blind people?

[Anonymous Coward]

Sir, i take my hat off. Bravo!

Re:Blind people?

[rapoZa]

Here is where you fail to understand the problem.

AH! Now I understand! You are in the wrong conversation and didn't realize it. Huh? I think the OP was clear in explaining what he or she was talking about. No one is saying that we don't need a way of preventing our apps. (HTML or otherwise) from being 'harvested' by bots; the important thing is not to categorize huge numbers of people as bots, particularly people who may have been excluded from things in the past and actually have a chance of living a more fulfilled, independent life if we get things right now.

Re:Blind people?

[Anonymous Coward]

The difference is that the web consists mainly of textual information that blind people can use.

Don't worry. We'll fix that in the flash-required Web 3.0 version. Out website design and hosting is by VPI.Net

Captcha: erotica

Re:Blind people?

[Anonymous Coward]

Demographics?

How many of those are in countries with internet access?
One might think that a large number of those have easily treatable ailments which would have been fixed in more developed nations.

Re:Blind people?

[yukk]

No problem. Open up the system to everyone and redirect all the resulting spam straight to the inboxes of the RNIB folks. If they say this is not acceptable then remind them that is what you said in the first place. I understand the plight of 'blind' people. My mother-in-law has become legally blind from macular degeneration in the last couple of years. Fact is, she can still call up the bank and do her banking by phone if the online version is inaccessible. On the other hand if there aren't enough protections and someone breaks into her account and steals all her money, I think that would be less convenient for her.

Re:Blind people?

[seeker_1us]

OK so we use these new captchas on pr0n sites only.

Re:Blind people?

[nickos]

I had the same problem, and I was able to solve it in 2 steps.

1. Strip links from messages. The spammers are trying to game Google's (and other search engine's) page ranking, and they can't do this if you don't allow them to post links. The incentive to spam your site has now gone.

2. Insert some primitive captcha. In my case this was just a question asking the user to add 2 small numbers together. The reason this step was necessary was because despite implementing step 1, I was still getting a huge amount of automated spam from spam bots which didn't realise there was no point in spamming my site. Once a human spammer realises you've added captcha he'll come and have a look to see how easy it is to circumvent (very easy in my case). However after running a test personally he'll see there's no point and (hopefully) remove you from his list of sites to spam.

Hope that helps anyone reading this...

Re:Blind people?

[guruevi]

And there wouldn't be any spammers if there weren't any prospects for them.

Stupid people are the cause of a lot of limitations, problems and laws in our society. Not only causing handicapped people problems but everybody else, raising costs for everyone.

If we had a way to weed out the stupid, greedy people from society we wouldn't have a credit crisis, we wouldn't have spammers or junk mail.

Re:Blind people?

[shmlco]

"The spammers are trying to game Google's (and other search engine's) page ranking..."

Well, yes and no. But one thing you can do is do a simple scan and add a rel="nofollow" to any hrefs. This allows you to keep user-generated links on sites where they may be useful, while zapping the spammer's ability to game Google.

'Course, this doesn't help block spam links for Viagra.

Re:Blind people?

[bickerdyke]

you realize that most people dont have static IPs? I get a new one usually twice a day,but at least once a day

Re:Blind people?

[shmlco]

If adding proper title and alt tags take more time and add more work, then the cost is not the same, now is it?

Re:Blind people?

[Richard W.M. Jones]

you realize that most people dont have static IPs? I get a new one usually twice a day,but at least once a day

And if your ISP runs such a system, then it becomes the ISPs problem to clean up the spam-spewing bots on their network, or else give people static IPs. (IPv6 will make this a lot simpler, but both approaches - static IPs and ISPs filtering malware spew, are common in the UK).

Rich.

Re:Blind people?

[apt-get moo]

They are aware of that, they're just converting the porn to Braille.

Re:Blind people?

[Anonymous Coward]

The percentage of blind people walking the planet is about the same as the percentage of people using IE5 last month. If your website doesn't work at all in IE5, how much effort are you going to put into fixing that?

Re:Blind people?

[csnydermvpsoft]

No, the point of a CAPTCHA is to have a test which a human can pass easily, but a computer can't. Most current CAPTCHAs are image-based, since that is simple to implement, but this is by no means a requirement.

Point taken. Revise my original post to say "... image-based CAPTCHAs..."

Of course, virtually all CAPTHCAs currently in use are image-based, so this is more of an academic distinction right now.

Re:Blind people?

[assassinator42]

The only reason Rapidshare has CAPTCHAs is to sell their premium service. It's certainly not to prevent spam like a majority of sites use CAPTCHAs for. They say it has to do with people not being able to steal the service, but it seems a properly configured service shouldn't need to do what they're doing.
One of the reasons I wish everyone would use MegaUpload, it's in general a far better site. Although I hear it's not as good for people outside of the US?

Re:Blind people?

[steelfood]

But the cost is the same whether you are making it accessible or not.

The costs are not the same. Additonal time and energy has to be spent, and regardless of how negligable this is per instance, it still adds up over a large body of content, and a long period of time. For an example of a costly implementation, the addition of an MP3 CAPTCHA on top of the visual CAPTCHA like what /. has takes considerable resources.

In addition, a new set of interface tools must be developed to allow the blind to "read" the text on the screen in the first place, and the costs for this is certainly not trivial. In this case, these costs are covered largely by the generic user as is the case with the tools included in Windows or Office, or by the handicapped users themselves through the purchase of a 3rd party product.

The only reason for commercial sites to go out of their way to make content accessible is the good PR it brings, which may or may not be reason enough to do so. The only other reason (and this applies to a minority of the commercial websites out there) is to fulfill legal requirements.

HTML is an example of an inherently accessible medium (when used properly) but anything stored on a computer as text is inherently accessible. It is only the short-sightedness of some developers that makes it inaccessible.

It's not short-sightedness at all. It's simple laziness or a lack of financial incentive. It is, however, short-sighted to think that everything on the WWW can or should be reduced to text.

Re:Blind people?

[bwy]

No, spammers are. The root problem of this "solution" is the spammers, who do not care our personal feelings of privacy. They don't care that their messages cause everyone else's costs to rise. Thank you, thank you, thank you! I am getting annoyed at everyone complaining about CAPTCHAs. I don't like them either but if anybody complaining has EVER tried to run any type of online service, they'd realize how friggin bot-infested, spam-infested and disease-laden the Internet has become. Something simple like runing a small phpBB system is now a full time job because of all the bots infesting it. You're always trying to stay one step ahead of the spammers, and at best you still spend a few hours a week manually cleaning up bogus accounts and postings, or slugging away at an inbox of accounts to approve where 1000 are spam and 25 are legit.

CPATCHAs have gotten so difficult that I fail most on the first attempt. I'm sure the bots have no problem though. Or, they scrape and farm the CAPTCHAs out to porn sites to get real people (horny men) to solve them. If you're mad- be mad at the spammers! They've done this to us.

Re:Blind people?

[cbreaker]

There's hardly any prospects for them now.

Spamming nets almost zero income. Unfortunately, they use illegal methods of spamming - spyware, viruses, open relays, etc - and it costs them nothing to blast out 500,000 e-mails or post 10,000 messages on forums. If they make $3 for a 500 thousand e-mail run, they'll just run 40 of those a day and make themselves $120 a day. It costs them nothing, so why not?

They're already doing illegal things, so more laws wouldn't help any. They'd just break those too.

So even though - under normal rational - there's no prospects, even $3 is enough for someone to flood the Internet with bullshit. And because of that, there's no possible way to approach the problem by educating users to NOT click spam links.

Re:Blind people?

[ultranova]

Of course, virtually all CAPTHCAs currently in use are image-based, so this is more of an academic distinction right now.

True, but it is still an important one to make, for how else can the situation be amended ? If all you've ever seen are image-based CAPTHCAs, then when you are tasked with designing a CAPTHCA, you will automatically start thinking of image-based ones; in your mind, CAPTHCA is a distorted image computers (and humans too, nowadays) have trouble interpreting. It takes a leap of abstraction to realize that it doesn't need to be; with any luck, stating it in a popular online forum makes some people start thinking such schemes.

Re:Blind people?

[netsharc]

I modified one phpBB installation to load an image in the registration page. The IMG SRC is a PHP script that sets a cookie. When the user clicks "Next", the next page expects a cookie. No cookie? No registration!

0 spammers after that..

Re:Blind people?

[Maestro4k]

1. Strip links from messages. The spammers are trying to game Google's (and other search engine's) page ranking, and they can't do this if you don't allow them to post links. The incentive to spam your site has now gone.

This is exceedingly wishful thinking on your part. We already see sites that strictly add the nofollow to all links in comments so that any URLs in said comments are completely useless for building page rank and yet the spambots still deluge the sites with spam on a constant basis. (Or at least attempt to.) I've seen the same thing happen on sites that do exactly what you suggest. You see spambots trying to use BBCode to link URLs in places that obviously don't use it, and so on. Spambots are automated, their owners don't give a damn if they spew lots of worthless stuff. All that matters is that some exceedingly small fraction of them DO work. And the way they achieve that is by spamming their crap everywhere and anywhere they can find a submit button.

Once a human spammer realises you've added captcha he'll come and have a look to see how easy it is to circumvent (very easy in my case). However after running a test personally he'll see there's no point and (hopefully) remove you from his list of sites to spam.

See above, they don't care and the vast majority of it's all automated. You may stop the bots that aren't prepared for your special CAPTCHA, but you'll still have to waste resources fighting them off.

Spammers are ruining the Internet I'm afraid.

Re:Blind people?

[PhiberOptix]

itÂs not good for people outside of the us because megaupload has a extremely low limit of concurrent connections per country. Brazil has 300. For the whole country. Out of the about 5 times i tried to use megaupload i couldnÂt download the file in all of them, so I gave up on them.

Re:Blind people?

[Athaulf]

That's almost an order of magnitude more than the percent of linux market share in 2004.

"According to Market Share, Linux's market penetration stagnated at .29 percent in 2004." source.

Re:Blind people?

[iangoldby]

Perhaps you should find out what Web Standards are really about.

http://www.webstandards.org/about/mission/

Clearly it is not what you think.

Re:Blind people?

[bwy]

Thats a pretty sweet idea. I suppose it is unlikely that bots would start downloading all the referenced content from a given HTML page. Someone else put it well- it is all about low hanging fruit. If you implement your own unique scheme, it is doubtful that anybody will mess with you.

Even still, it is annoying to have to resort to these tactics.

Re:Blind people?

[cheater512]

Since when is the net visual?

Re:Blind people?

[tick-tock-atona]

I'm deaf you insensitive clod!

Re:Blind people?

[ekhben]

Most of the automated bots are looking for reasonably well deployed forum and blog software. The owner, or another script, googles for keywords that match such sites and the bots just start hammering away. The owners of the bots are not paying for computer time or traffic, since the bots are running on zombie PCs elsewhere in the world, so they really don't care if their bots are filling your site with non-links, or nofollow links, or gibberish. You can defeat them by asking a trivial question, preferably one based on the context of the system you're running; should the spam bot owner even bother to look at your site and answer the question, they are most likely to also see that links don't work, and not bother updating their bots. If they do, just change the question to something else. Bot owners aren't out to destroy the intarwebs, that's just a side effect of what they're really trying to do, which is to make money without being productive. There's only so many times they'll look at your specific site to work out what the answer should be before they just give up and move on to one of the millions of easier targets out there, probably one of the ones using a CAPTCHA that's been long since broken.

Re:Blind people?

[tepples]

First, creating content is not negligible in cost. But the cost is the same whether you are making it accessible or not. If adding proper title and alt tags take more time and add more work, then the cost is not the same, now is it? The cost of an alt attribute is still negligible compared to the cost of a high-quality image. And in some jurisdictions, it might qualify your company for a tax break.

Re:Blind people?

[PhireN]

What is it with banks and using CAPTCHA's?
You can detect multiple attempts form the same ips and block them to prevent brute forcing.

If a hacker already has a valid user/password nothing is going to prevent them from hireing people to decode the CAPTCHA, As they can potentially get 1000's of dollars from each account.

Re:Blind people?

[CyborgWarrior]

You are confusing accessibility with standardization. Have you looked through the WCAG standards (http://www.w3.org/TR/WAI-WEBCONTENT/)? Valid markup doesn't even count toward accessibility by these standards. What you have to do instead is design very specific types of interfaces that limit how things can be done, require a much higher familiarity with the languages and tools used, and therefore cost more, both from a time perspective, and in the fact that you have to pay for a higher skilled developer.

Re:Blind people?

[zippthorne]

We should up the penalties.

1 minute of jail time per offense. Where an "offense" is defined as one email sent from another's computer without their knowledge or permission. (and some legalese to iron out all the edge cases.) Also, the sentence cannot be served concurrently.

If $120 worth of crime nets four years in a maximum security "pound-you-in-the-asz" prison, people might think twice about it.

Re:Blind people?

[DigitalWallaby]

Yep. I run a small gaming blog and I'm currently getting about 75 spam comments, some of them over a hundred lines long, every 8 hours or so. I use the Akismet service and that blocks nearly all of them, so I don't need to use Captcha. Every now and then a few get past Akismet and I have to moderate them, but it's not really a big deal.

The annoying this is that I have to look through the caught spams in order to weed out false positives. Admittedly, I don't have to many of those, but I still have to check.

I do have Captcha on the forums though. Gotta wonder if that's why noone has signed up!

Re:Blind people?

[DigitalWallaby]

Consider that both China and India, the worlds two most populous nations, have reasonably widespread internet access -- though perhaps not in all areas -- then you have a big chunk of the worlds population with access. Factor in large portions of the Middle East, Pakistan, Lebanon, Israel, to name a few and you have most of the World's population with access.

We Westerners need to get over the concept that we are so advanced and the rest of the world lives in caves and reads via stone tablets.

Blindness in the third world is often easily preventable. A diet with enough vitamin A will stop a child going blind. Cleaner water and food, and better living conditions could help too.

Unfortunately, once blindness has occurred in these cases, it's often irreversible.

If you'd like to help, check out the Fred Hollows Foundation http://www.hollows.org/ -- they've been doing great work in this area for a lot of years now.

Re:Blind people?

[glittalogik]

Most deserved +5 I've seen this week. Good work!

Re:Blind people?

[colmore]

The internet has historically been accessible to the blind and deaf. Braille readers, large text output, and screen readers have been around since the 80s.

It will be a shame if in going multimedia the internet loses functionality that it has had for decades.

Frankly, your argument "Well they can't drive cars, who cares if they can or can't do anything." marks you as a pretty enormous asshole. What do you propose the disabled do in the modern world?

I'm going to go out on a limb here and guess that you're against cutting them checks once we've made it impossible for them to work or live self-sufficiently.

If basic accessibility standards are followed, non-multimedia content is easily made available for the disabled. It's callous to refuse to be bothered to take basic steps to help others.

Re:Blind people?

[traveller.ct]

The cost of being all-inclusive can be too high for some budgets. The same could be said for supporting minor browsers, such as Safari. Ideally developers would code to the standard and could say with reasonable confidence that the website would work with any standards-compliant browser. It is, however, a sad case that individual browsers had to be tested and supported due to poor or insufficient compliance. I believe most browsers are very good in that regards and getting better.

Re:Blind people?

[syousef]

I have an excellent idea for you. Why don't we make captchas so difficult and cryptic that you need a 180 IQ to solve them. You shouldn't have any objection to that since:

a) You already know how to fix the world's problems, so must have a 180 IQ.
b) You're unconcerned with leaving people behind, so you should be unconcerned when people leave you behind.
c) Bemoan the cost of providing a service to meet the needs of the lowest common denominator.

Let me guess, 180 IQ is too high a requirement and will cut out a much larger number of people than not catering for the blind. Well guess what pal, as long as it cuts out arrogant self-centered prats like you, I'm happy with that. Every asshole that thinks that catering for the disabled is too big an ask in this supposedly civilized society should be made to fend for themselves. No access to education, law enforcement, medical care, or public facilities such as roads unless you pay the true cost of using them in full and in advance. After all why should others collectively pay for your needs? (Hint: That's the advantage of living in a society - we band together to get things done and the less people left behind the better)

Re:Blind people?

[iangoldby]

Good link. This is exactly the kind of thing I was thinking of. You are quite right that accessibility and standards-adherence are not the same thing, but there is no doubt that standards-adherence (in terms of overall approach, not just markup validation) goes a long way towards accessibility.

I think you rather overstate the case though that designing for accessibility over-restricts the kind of interface that you use, or even that it requires a greater familiarity with the tools and languages. Simply by respecting the semantic nature of the design medium you are using goes a very long way towards accessibility.

Re:Blind people?

[nickos]

This is exceedingly wishful thinking on your part.

Wishful thinking or not, it did solve the problem on my site and only took a couple of hours to implement. YMMV.

Re:Blind people?

[Anonymous Coward]

Brilliant!

Re:Blind people?

[Lincolnshire Poacher]

> Something simple like runing a small phpBB system is now
> a full time job because of all the bots infesting it.

I would normally suggest an up-front charge of, say, $10 per
account through an online payment service that is credited
back after a random period. Perhaps that is too cumbersome
for an enthusiast board, though.

If your board is focused on a single hobby ( say, for example,
WW2 warbirds ) then why not use a contextual question as part of
the sign-up. Such as ``How many Fw 190s are in this image?''
or ``Who was the highest-scoring RAF NCO airman?''. Questions
that no bot could answer and which also set the bar for membership.

Re:Blind people?

[phoenixwade]

Let me guess, 180 IQ is too high a requirement and will cut out a much larger number of people than not catering for the blind. Well guess what pal, as long as it cuts out arrogant self-centered prats like you, I'm happy with that. Every asshole that thinks that catering for the disabled is too big an ask in this supposedly civilized society should be made to fend for themselves. No access to education, law enforcement, medical care, or public facilities such as roads unless you pay the true cost of using them in full and in advance. After all why should others collectively pay for your needs? (Hint: That's the advantage of living in a society - we band together to get things done and the less people left behind the better) What an amazing rant..... Too bad it's so far off base. I never once said accessibility was a bad idea, that I didn't support it, or even that I don't implement it whenever possible.

What I said was that the OP was stupid because the costs to add accessibility were and are NOT negligible. Never once did I say or imply that those costs shouldn't be spent.

As a point of fact I think they should be spent for a number of moral and economic reasons.

I found your sig particularly ironic, considering.

Re:Blind people?

[Doggabone]

csnydermvpsoft wrote, "The Internet is becoming much too important to leave a significant amount of the population (pardon the pun) in the dark. We have the technology to help the blind navigate web sites independently. Unfortunately, CAPTCHAs are hindering much of that progress." No, spammers are. The root problem of this "solution" is the spammers, who do not care our personal feelings of privacy. They don't care that their messages cause everyone else's costs to rise.

You're absolutely right that spammers are the root of the problem. But CAPTCHAs are the hinderance - they're designed to be a hindrance to spambots! Unfortunately, in a "baby with the bath water" way, some CAPTCHAs also hinder legitimate users who would otherwise be able to use the website (colour blind), as well as making it harder to enable a site for a special needs user (blind).

One of the great things about web technology is that it includes people who are already at a disadvantage to integrate with the rest of society, people who otherwise have valuable contributions they can make. It's important to not blame CAPTCHA for the problem, but it's also important to take precautions that CAPTCHA technologies be adopted that avoid contributing to a greater problem. How much effort should be given to that would be balanced by site content of course - image based CAPTCHAs for a photography site seems perfectly reasonable (but some great photographs have been taken by colour blind people).

It's not necessarily simple, but I think it's important that solutions move us forward and not merely transplant our current issues into new contexts. It's inappropriate that the blind don't drive, but that doesn't mean they shouldn't be able to access information if the means exist or can be devised. And since the access and means already do exist, I think it significant to remember that CAPTCHA, while a useful solution to a genuine problem, can have negative repercussions .

For this reason, I think the penalties for convicted spammers should be far higher than what they are now. Their actions are subverting the ease of use for a very large group of people.

I agree with tremendous enthusiasm.

Re:Blind people?

[cbreaker]

Strict punishments usually don't deter people, because nobody thinks they'll ever get caught. The California "3 strikes for life in prison" hasn't really stopped major crime there, and that's a pretty damned serious law.

Besides, what is a US law going to do to deter a guy in China or Nigeria or somewhere else out of jurisdiction?

Plus, I don't feel as though spammers deserve to be sodomized in prison for sending spam e-mail. (Well, you probably won't go to a maximum security federal prison for it anyways, but still.) I think monetary fines and community service is more appropriate. I mean, it's not like they killed someone..

I mean, by your standard, if I ask someone for your e-mail address and send you an e-mail to further this discussion, I'd face jail time.

I hate spam as much as the next guy; well, maybe even more since I have to run a bunch of mail servers. I just refuse to fall into the mindset that the more annoying (but otherwise non-violent) offenses should be punishable by death.

Re:Blind people?

[syousef]

I never once said accessibility was a bad idea, that I didn't support it, or even that I don't implement it whenever possible.


By emphasising the cost, and your "need" to use captcha despite it breaking readability, you certainly imply that you're against dropping more complex human validation mechanisms that would preclude the blind.

What an amazing rant..... Too bad it's so far off base

Too bad you phrase things so poorly, or are so self deceptive that you actually think you're in support of providing a useable web for the blind, while simultaneously supporting technology that would render it useless to them.

What I said was that the OP was stupid because the costs to add accessibility were and are NOT negligible.

Actually since you're being pedantic the OP said it was the cost of providing a reader that would allow the blind to read text that was neglible. What OP was saying is if you stick to HTML/Text to convey the message it's easy to include the blind and that the web being primarily text based, it should be easy to do this.

As a point of fact I think they should be spent for a number of moral and economic reasons.

You go on and on about extra costs and then shoot down arguments against technology that exclude the blind. If you're genuinely against it you're remarkably poor at making an argument, even for /.

I found your sig particularly ironic, considering.

Oh where did I mod you down, or try to censor you? My signuature doesn't say that people shouldn't disagree, even passionately. It just says people shouldn't be modded based on your agreement with the author's position. Another misunderstanding. Perhaps consider requesting a refund for your education.

Re:Blind people?

[phoenixwade]

I never once said accessibility was a bad idea, that I didn't support it, or even that I don't implement it whenever possible.


By emphasising the cost, and your "need" to use captcha despite it breaking readability, you certainly imply that you're against dropping more complex human validation mechanisms that would preclude the blind. Like I said, off - base, I never emphasized anything about captcha. In fact I didn't mention captcha at all, excepting that I mentioned security technology to separate humans from bots, which, admittedly, captcha is one method of doing that, and a new form of Captcha is what the article is all about, but in either case, there was no particular emphasis on my part.

Although I did spend a lot of time talking about cost, that is because the OP's remarks were that cost of accessibility were negligible. Covering some other issue when I was responding on that specific subject would have been trolling (a definition that is quite clear, and that you fail, it seems, to understand). What I did, and still do refute is that accessibility is not negligible in cost. The average user wants graphical and multimedia content, particularly video and animations. Creating a text equivalent is not negligible in cost, no amount of HTML wizardry is ging to change that.

To add accessibility for the blind, you are going to have to add a non-visual equivalent, which will always add to the cost, and that added cost is never going to be negligible, which is exactly what I said to start with, but you are apparently too stupid to understand without having your hand held every step of the way.

My phrasing wasn't at issue, but I submit your trolling is, which is why I find your sig so ironic. I understood fully what you intended, what you missed was that the nature of your comments, by definition qualify as flaimebait and trolling (i.e personal attacks instead of topical commentary) Our exchange has not been a discussion with disagreement, it's been one of a troll trying to bait me with straw man arguments and flame baiting commentary. Finally, I suggest you check your own spelling and grammer prior to attacking anothers education.

Re:Blind people?

[syousef]

What a complete busload of bullshit. Have you even convinced yourself of what you're saying?

I never emphasized anything about captcha

You emphasized the cost of catering to the blind when building a web page. Go back and read what you wrote.

Although I did spend a lot of time talking about cost, that is because the OP's remarks were that cost of accessibility were negligible.

Ah so you agree that you did do so.

but in either case, there was no particular emphasis on my part.

Oh but now you don't. Do you understand the meaning of a logically consistent argument?

Covering some other issue when I was responding on that specific subject would have been trolling

No, that's called broadening the discussion. I don't think you understand the definition of trolling either. Trolling is about attacking someone verbally online with the intention of trying to get a reaction out of them rather than actually contributing to the discussion. Trolling isn't about broadening the discussion or disagreeing. It's about trying to piss someone off for the sake of the entertainment value.


To add accessibility for the blind, you are going to have to add a non-visual equivalent, which will always add to the cost, and that added cost is never going to be negligible, which is exactly what I said to start with, but you are apparently too stupid to understand without having your hand held every step of the way.

I completely disagree with you. Costs for basic compliance with standards that do give at least some access to the blind are negligible. Especially if you want quality code (meaning that you should be compliant with those standards anyway).

The delicious irony of you accusing me of trolling then calling me "too stupid to understand" without having my hand held is remarkable.

My phrasing wasn't at issue, but I submit your trolling is

Basically you're an idiot. You don't know the meaning of the word troll. You don't know how to make an argument, but instead accuse someone who disagrees strongly with some of the logically inconsistent garbage you spew a troll. No matter how you look at it, the post which I originally replied to emphasises the cost of granting blind people access to your web pages, and therefore implies that in a lot of circumstances this exaggerated cost isn't warranted. You can twist and turn your words all you like but all you're doing is making yourself sound stupider.

Can't RTFA. Already /.'ed after just ONE comment

[Anonymous Coward]

Is this a new record or something?

Anyway since I can't try this out, does anyone know how it impacts users of thin clients or handheld devices that are forced to use a lower color scheme? CGA monitors? Monochrome? How about the color-blind? How abour color-blind people using CGA monitors?

Lyrical Response Mechanism

[FurtiveGlancer]

Why don't we take a note from TV and have the user sing the missing lyrics of a classic hit. Even if they don't pass, it will make for much more fun around the computer, especially at the office.

Re:Lyrical Response Mechanism

[CSMatt]

Until the user gets subpoenaed by copyright holders.

Then it will be hilarious.

Re:Lyrical Response Mechanism

[Daimanta]

I'll start. Finish this:

"Never gonna give you up"...

Re:Lyrical Response Mechanism

[jimicus]

"Never gonna give you up"... Never wanna make you cry
Never gonna give you up
Never gonna say goodbye

Start Talking Love, Magnum

Re:Lyrical Response Mechanism

[19thNervousBreakdown]

I'm never, ever gonna stop
Not the way I feel about you
Girl, I just can't live without you

Re:Lyrical Response Mechanism

[19thNervousBreakdown]

Ain't never gonna let you down babe
Ain't never gonna give you up
Hey hey hey hey
Yea yea yea
Ain't never gonna give you up
Yea yea yea
Ain't never gonna let you down

Re:Lyrical Response Mechanism

[FurtiveGlancer]

Serously though, if Google is willing to share our surfing demographics, the system can always pick a tune we will know.

*Note to self - no more Manilow searches*

Re:Lyrical Response Mechanism

[esocid]

I can name that tune in three notes!

Re:Lyrical Response Mechanism

[naer_dinsul]

I know this was meant as a funny comment, but if you'll notice, of the replies to your comment there are as many different responses as there are posts!

The more we "exploit the semantic gap" the more problems like this are likely to arise.

Re:Lyrical Response Mechanism

[Anonymous Coward]

Ok Cartman here's your captcha:

"I'm sailing away..."

Re:Lyrical Response Mechanism

[Matt Perry]

I didn't know you were a Barry White fan.

Never, never gonna give you up
I'm never, ever gonna stop
Not the way I feel about you
Girl, I just can't live without you

I'm never, ever gonna quit
`Cause quittin' just ain't my stick
I'm gonna stay right here with you
Do all the things you want me to

Whatever you want
Girl, you got
And whatever you need
I don't want to see you without it

You've given me much more
Than words could ever say
And oh, my dear, I'll be right here
Until my dyin' day

Re:Lyrical Response Mechanism

[mdm42]

Yet another craptcha system that I fial. What sort of rubbish do you listen to?

What lenghts will we go?

[desmondhaynes]

While the tech is superb, was wondering what lengths we will go to avoid the spammers. Come on, you also need spammers to keep the world entertained! I still remember the first time I got the Nigerian money mail, and the breast enhancement ideas. So too for the blogs. When I login into my blog admin dashboard, the second thing I check is the spams. :-) Come on, you don't want to kill an industry! :D -TW Techwatch: Technology News that matter http://techwatch.reviewk.com/

Re:What lenghts will we go?

[desmondhaynes]

oh, the first thing is the actual comments, ones not flagged as spam.

Re:What lenghts will we go?

[lottameez]

Right on! I used my nigerian money to buy boobs and a new, larger, p3n1s. Of course, then I need healthy doses of V1agr@ and other M3ds! to make it all work.

Re:What lenghts will we go?

[techpawn]

I could do without Spam thank you! Every third email I get is "would you like bigger breasts" and after 3 years of that I'm thinking about it...
And when it's not that one it's an email that says "If you want a big dick, click here!" and no matter how much I click it doesn't get any bigger.

It's still trivially crackable.

[Jason1729]

All they need to do is offer free porn to people who solve the captchas and embed the captcha in their site. It doesn't matter how sophisticated the test is or hard it is for a machine to do it, they all have that fatal flaw.

Then there's also the option of paying Warcraft gold farmers to solve captchas and take a break from the game.

Re:It's still trivially crackable.

[Anonymous Coward]

Exactly. As long as there are people willing to help crack those captchas and there are enough people willing to buy vigria or some nice reel estate in Nigeria, spammers will be able to "automatically" setup spam accounts.

Why can't we just sue the pants off every spammer so it is no longer profitable for them? Last time I sent an email to someone who didn't know me yet, I was immediately blacklisted just because the email came from a webmail service (Yahoo) that has been cracked for a while now. This has got to stop, or legitimate email will grind to a halt. Already people have to spend quite a lot of effort to clear out their inbox, it won't be too long before people will have to be hired specifically for that job. If they haven't been already.

If it doesn't work to create better captchas, then maybe the email services should be quicker to shut down adresses used for spamming (would it be legally possible to filter out massive amounts of identical emails, especially if using a term similar to Viagra?) and hunting down the people actually behind the spam, because they are the ones profiting from it.

Re:It's still trivially crackable.

[Arancaytar]

Trivia questions. Most internet communities are dedicated to some kind of specific topic. Even someone who is unfamiliar with the trivia can use Google, which the machine cannot.

(Also, said trivia questions will be applicable only to one specific site, so it would never pay for the spammers to build a database of them.)

Re:It's still trivially crackable.

[Jason1729]

If it's easy enough to google for, anyone can find it as easily as a noob who would be a valid forum user. It would also be a major impediment for legitimate users, they would suffer much more than cheap labour with access to google.

Re:It's still trivially crackable.

[wertigon]

except it relies on lazy web-admin Joe123 to create said trivia questions. Anything which takes more than five minutes to set up will fail for most people. Such is the way of the world today.

Re:It's still trivially crackable.

[Pollardito]

Trivia questions. Most internet communities are dedicated to some kind of specific topic. Even someone who is unfamiliar with the trivia can use Google, which the machine cannot. machines can't use Google? isn't that what Google search APIs are for?

(Also, said trivia questions will be applicable only to one specific site, so it would never pay for the spammers to build a database of them.) the spammer can probably search that specific site for the answer, since CAPTCHAs usually are not used to prevent reading a site just posting to it

Re:It's still trivially crackable.

[RiotingPacifist]

Even someone who is unfamiliar with the trivia can use Google, which the machine cannot. anything simple enough to answere after a google search, is also findable by a computer using google
google questions:
get top 30 answers sites
removed all common words & words in the questions & previously wrong answers
*remove topic words (this may require some programming, but nothing as hard as OCR)
use most used word as answer
feed this back into a database of right/wrong answerers

*as long as there arnt too many questions this step isnt needed

every step apart from removing topic words can go into a fairly simple bash script, its not terribly efficient but it uses alot less CPU than OCR, so if you send it out to a bot net its going to get noticed less.

Plus this does nothing to stop quiz for porn, infact its easier to trick somebody into doing a quiz for porn than it is a capatcha for porn

Re:It's still trivially crackable.

[Have Blue]

Doesn't solve the problem. If the captcha can be solved by a legitimate human visitor to the site it can also be solved by a human tricked into believing he is solving it for a different reason. There is no defense against this sort of middleman attack without controlling the client (and since this is the web, that's not going to happen).

Re:It's still trivially crackable.

[Henry Pate]

That's a pretty good idea, but people are lazy and will use default question lists and even if they were to write their own lists they'd probably contain less than 20 questions, so then they just need to sit through X number of tries before they know all the questions, then it's spammin' time. It does have the benefit of being accessible to the blind.

Here's a system I thought of that while more difficult to crack is still accessible to those using screen readers. Rather than generating images you generate sentences with simple riddles, for example: "John has four apples plus one, he takes three from Suzie then gives two to Tom, how many does he have left?"

You could generate tons of variations on just that one riddle.

___ has ____ items (plus/minus/take away/divided by)(randint), ___ (gives/takes/steals/swipes/borrows/eats) (randint) from ____ then (gives/takes/eats...) (randint) from ___, (how many did he start with/does Tom have/Suzie have/are left/were traded/were eaten).

I'm sure you could make the puzzles more cryptic to computers are simpler for humans that was just an example off the top of my head. When it's beaten at least we'll have some nifty new NLP tools.

Re:It's still trivially crackable.

[apoc.famine]

That was our solution to spambots on our small (12 active people or so) forum. We used very forum-specific questions to allow registration, and only registered users can post. If someone can't answer the questions, they aren't into the subject enough that we would want them there discussing it. Or they're a spammer, and don't know that the proper answer to the "what would you like to do to a spammer" question is the answer which is exceptionally painful.

But really, as long as you have an authentication method which is significantly hard/unique, you'll be safe. Spamming is a "low hanging fruit" operation. Quantity over qualify, 90% of the time. In fact, the answer to killing off spambots might very well be everyone designing their own authentication. Right now, there are a half-dozen major ones. Crack one, and you have access to millions of places. If instead there were thousands, the time required to break one would not necessarily be worth the money you could get from doing it.

Our forums are not worth programming the automated bots to crack, so we're 100% spam free now, for the first time in a few years. It's not a hard authentication - just different from 99.9% of the rest of them. Hell, most people could answer "what color is this page", even if they had to look at the raw html and google the color hex. But for one page, it's not worth programming a bot to do. Unique authentication methods will kill spambots.

Re:It's still trivially crackable.

[Anonymous Coward]

-Unique authentication methods will kill spambots.
-on our forum, the bot has to fill out userfields on a profile page. It reduced the spammers from about 50-100 in a day (peak) to about 6 a day currently. (And their method is to fill in the same info in all fields, so a little bit of coding could probably fix that up easily.)

Re:It's still trivially crackable.

[Arancaytar]

Try cracking this:

(Mystcommunity forum captcha)

Change the sentence in the following textfield to correct the relation:

"Yeesha is Catherine's cousin."

Re:It's still trivially crackable.

[Anonymous Coward]

Links to free porn videos. No captchas.

Re:It's still trivially crackable.

[RiotingPacifist]

That would be a binary question, why even bother trying, recognise it as yes/no and try one, ever get that question again and its cracked.

Re:It's still trivially crackable.

[Arancaytar]

"Yes/no"? Sorry, but ur rong. Or you failed at reading.

You are welcome to try writing a parser that replaces "cousin" with "daughter" in this particular sentence, but if you're a spammer, it's not really worth your time.

Re:It's still trivially crackable.

[bill_mcgonigle]

We used very forum-specific questions to allow registration, and only registered users can post. If someone can't answer the questions, they aren't into the subject enough that we would want them there discussing it.

That's a good strategy. I recently joined a forum like that and they asked a question everybody really interested in the community would know but others would have to go research (too time expensive).

Re:It's still trivially crackable.

[Walter Carver]

Yes. However, by having a (yet) uncrackable captcha you can slow them down. Feeding the captchas to humans is doing it much harder for the spammers.

/.'d @ 7:14:09 CDT

[Anonymous Coward]

Hard to try out with 5M other /.r's trying to hit it at the same time.

Slashdotted

[Icarus1919]

Slashdotted already.

Re:Slashdotted

[Anonymous Coward]

http://techwatch.reviewk.com/2008/04/the-imagination-project-picture-based-captchas/ Alternate URL

Re:Slashdotted

[Anonymous Coward]

http://techwatch.reviewk.com/2008/04/the-imagination-project-picture-based-captchas/ Alternate site

Re:Slashdotted

[PRMan]

That's because you're not using your...imagination.

Re:Slashdotted

[JasterBobaMereel]

The politest Slashdotted notice ....

SERVICE DOWN TEMPORARILY

Because of the exposure on slashdot today, we experienced an unexpected number of users. The service is temporarily down. We will be back online later. For more information about the project, go to the project Website or contact Prof. James Wang at jwang at ist.psu.edu .

-- Thanks, the IMAGINATION team.
April 23, 2008

speach synthasis.

[oliverthered]

It should be fairly easy to write an audio CAPTCHA you just have to get someone to read some text. Computers are very poor at speech synthesis at the moment.

Re:speach synthasis.

[Anonymous Coward]

I have hearing difficulties, you insensitive clod!

Re:speach synthasis.

[oliverthered]

actually I was thinking of the opposite, do you have speaking difficulties (I realise that hearing and speaking difficulties can often go together)

Re:speach synthasis.

[Anonymous Coward]

What about people without microphones? Or that are on dialup? Or people that are deaf (and not oral)?

That's just the tip of the iceberg of problems with a spoken test.

Re:speach synthasis.

[pipatron]

What about a reversed turing-test. You have to chat with a bot, convincing the bot that you're a human, not a computer.

Re:speach synthasis.

[HeroreV]

That would be great, but how is a bot supposed to know whether it's chatting with a human or another bot?

Alternative...

[martin_henry]

Alternative URL: http://wang.ist.psu.edu/docs/projects/imagination.html

Re:Alternative...

[justleavealonemmmkay]

Imaginaaaaaaaaaaaaaaation

Re:Alternative...

[Anonymous Coward]

That alternative page just links to the original page. Not much help, but thanks for trying.

Stupid Captcha

[Big Smirk]

Any captcha with multiple choice answers is not a good one. 20 choices? So the computer gets by 1/20 of the time. Hmmm, how many attempts does it take to get 1000 e-mail accounts? As for "geometric center" note that all the images are rectangular. I haven't tried it, but writing a program to pull out all possible rectanges and then sort them on size, and pick the center of the one of the larger rectangles should do it. Why not a captcha that works with google. "Describe in one or two words what is in this picture", then use a google like search to match up the actual description with what the person typed. Person types "Dog" picture is a "Labrador Retriever" match.

Re:Stupid Captcha

[IronicToo]

The problem with most CAPTCHAs I see proposed on blogs and by Slashdot users (such as the kitten CAPTCHA) is that it isn't possible for the computer to randomly generate new images, which means they are vulnerable to lookup tables. If you want someone to identify or label pictures of dogs (or kittens) the computer must be able to create a new picture of a dog or kitten. If this is not possible (and I don't see how it would be) all images that are used must be labeled by the human owner of the CAPTCHA, as by the very definition of the problem it should be impossible for a computer to label the image. Once the attackers have identified all images you have labeled as dogs (or kittens) they can simply use a look up table to correctly tag or identify the image every time.

It then becomes a contest to who can label more images, the owners or the attackers, and that isn't a contest the owners can win.

Re:Stupid Captcha

[immcintosh]

The kitten one shouldn't be too hard to generate new pictures with. What makes that one hard for computers isn't the fact that it's a picture of a kitten, but the fact that it's SEVERELY distorted and overlaid on top of other images. While "drawing a kitten" might be hard to program, "randomly distorting a kitten picture" isn't too bad. Enough distortion and lookup tables are essentially useless, while highly sophisticated pattern recognition systems (read: humans) still should have little problem.

Re:Stupid Captcha

[Puff_Of_Hot_Air]

The point of the "geometric centre" test, is that the "rectangles" that you see, are difficult for the computer to work out. Notice how the colour distortion creates many other rectangles which we, as humans, dismiss as noise. Still I suspect that the researcher is only trying to get the free ride of others doing his image recognition research while attempting to "crack the captcha".

Re:Stupid Captcha

[oracle128]

I solved this problem just the other day. http://tech.slashdot.org/comments.pl?sid=523628&cid=23085674

Re:Stupid Captcha

[Anonymous Coward]

You could even have it click randomly. Again, the percentage of the time it would work would be high enough to make the captcha worthless.

20 minutes, test not yet passed..

[PIBM]

They might have a good captcha but it's already broken: they are unable to serve it as fast as required, which prevents legitimate users from accessing a real server content... No user on any site would wait so long just to pass a captcha test.

Test site slashdotted...

[thrill12]

...but some more info here as well as a (ugh) [a href="http://wang.ist.psu.edu/imagination/imagination.ppt">powerpoint and a user study with some samples.

Slashdotted

[Rik Sweeney]

The system is called IMAGINATION and you can try it out

That's what you think...

Re:Twofo Ghey Niggers

[CSMatt]

This just reaffirms the article's conviction that the CAPTCHA is broken.

Halp!

[Bartab]

My imagination is broken!

Don't forget users of lynx

[Nursie]

It annoyed me mightily the day slashdot introduced captchas for comments when you weren't already logged in. And somehow broke the login process from lynx.

Lynx is the geek slacker's greatest tool, when run in an ssh session from your home server, not only is the traffic unloggable (except for "he's calling home a bit") but it even looks like work to the uninitiated.

Re:Don't forget users of lynx

[Nursie]

Well of course that's an option, but it doesn't look much like work, does it? One can only spend so long browsing the web openly during work time...

Re:Don't forget users of lynx

[Anonymous Coward]

Fair enough :-)

My monitor isn't overlooked by anyone, so I just need to work around the web traffic logging. If that wasn't the case I'd probably do the same as you for subtle browsing.

Re:Don't forget users of lynx

[Nursie]

To be completely fair, it's become a non issue of late because something truly weird has happened - I'm atually motivated and not spending so much time trying to get away with doing other things. So I've given up on Lynx too.

My point kinda still stands, I'm sure there are people in the world who still use it. It's good for cutting bandwidth usage down to almost zero too.

Re:Don't forget users of lynx

[michaelg1987]

It annoyed me mightily the day slashdot introduced captchas for comments when you weren't already logged in. And somehow broke the login process from lynx. Lynx is the geek slacker's greatest tool, when run in an ssh session from your home server, not only is the traffic unloggable (except for "he's calling home a bit") but it even looks like work to the uninitiated. So you're whining because Slashdot isn't conducive to unethical actions that degrade the reputations of programmers and IT guys alike? Let me get you a box of Kleenex, and an employment application for the Geek Squad.

Re:Don't forget users of lynx

[Anonymous Coward]

Lynx is the geek slacker's greatest tool, when run in an ssh session from your home server, not only is the traffic unloggable (except for "he's calling home a bit") but it even looks like work to the uninitiated. Offtopic, but you'd have a better time setting up an HTTP proxy (squid) at home and SSH-forward it.

Thus you can use your graphical browser of choice while surfing anonymously, as I am now!

Re:Don't forget users of lynx

[Anonymous Coward]

This will show up on the web monitoring and tracking suite. They may not be able to show what you are looking at but they will still know how much you are looking at.

With the ssh and lynx/links they don't even know you are browsing the web.

Re:Don't forget users of lynx

[Nursie]

Great plan if your only concern is evading tracking.

Lynx, however, even looks vaguely like work, graphical browsers generally do not!

Re:Don't forget users of lynx

[mpeg4codec]

FWIW you don't need a dedicated HTTP proxy, as SSH has a built-in SOCKS proxy. Try it out some time: ssh -D 1080 remote.tld and configure your browser of choice to use SOCKS on localhost port 1080. For other apps that don't have native support for proxying, check out proxychains (on Unix). Not only great for browsing at work, but also a godsend for unsecured wireless nets.

Re:Don't forget users of lynx

[Nursie]

"So you're whining because Slashdot isn't conducive to unethical actions that degrade the reputations of programmers and IT guys alike?"

Umm, yeah. I though that was what slashdot was for?

Re:Don't forget users of lynx

[zippthorne]

Lynx not only looks like work. It is work. just to understand most pages. Especially crappy 3-column pages like slashdot and everything else seems to be these days.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Fake colors are BS

[Anonymous Coward]

The part with the fake colors is IMO complete bullshit.
You could simply smooth the image (because of the dithering) and convert it to black and white. The luminosity should be enough for recognition.

Of course, you still have to solve the other parts.

The real solution to captcha is OpenID.

[Anonymous Coward]

The real solution to captcha is OpenID.

Re:The real solution to captcha is OpenID.

[garaged]

how so ?

Re:The real solution to captcha is OpenID.

[giafly]

How do you protect the sign-up page to get an OpenID? With a captcha?

Re:The real solution to captcha is OpenID.

[The Jonas]

I always liked the idea of animated captchas, but for some reason have not really seen much implementation.

Re:The real solution to captcha is OpenID.

[tknd]

how so ?

While the actual solution may not be exactly OpenID what the AC means is that this is an identification problem, not an AI problem.

CAPTCHAs are an AI problem: you are asking a computer to determine if what is on the other end is a human or not.

While you have an email account (or ten), a social network account here and there, and a forum account here and there, nothing is tied together. Each account is independent and each can be assigned a different persona and different background information--and by today's internet standards that is all acceptable.

What has allowed this to occur is the result of an anonymous internet. What we are trying to do is maintain an anonymous environment while asking computers to determine whether a particular account is owned/operated by a human or not. That's like going to a liquor store and asking the person a number of different questions OTHER than proof of their age to discern that they are in fact older than the required drinking age. For example rather than asking for ID, the store clerk would ask the person about some historical event that only people older than a certain age would be aware of. And of course this is flawed, once people younger than the required drinking age attain information on how to answer the question, the system breaks. This is what is and always will happen with CAPTCHAs.

The true solution is to provide a trusted credential that services can use to authenticate a user. OpenID is one piece of that because it hopes to allow you to use one id across all services. I think the next step would be to tie the OpenID to something tangible and hard to get without a real-world presence. Something like a bank account or a credit card number, or a government agency like a passport or drivers license would probably be the start.

Re:The real solution to captcha is OpenID.

[Anonymous Coward]

Yes, with a captcha. OpenID should open for bots too.

Re:The real solution to captcha is OpenID.

[HeroreV]

I've never seen anything like this before. They are pretty easy to read, so if they can't be solved easily by computers, they do look quite promising.

Wally

[Anonymous Coward]

Ok, the next step on the CAPTCHA technology is to find where Wally is.

Illogical

[SpinyNorman]

If a computer could recognize the difference between human and computer generated speech, then it would know how to generate human sounding speech.

Re:Illogical

[Matje]

If a computer could recognize the difference between human and computer generated speech, then it would know how to generate human sounding speech. Bullocks. Why is this modded informative? You don't provide any backup for your claim.

It is imaginable to create a model that describes speech characteristics in general and computer speech characteristics in particular. Any sound sample could compared with the two models. If it fits the wider speech model but not the computer speech model, then you would call it human speech. QED.

The ability to distinquish between two things does not imply that you'll be able to generate them effectively (unless the search space is very narrow). Imagine it this way: you can probably distinguish Chinese from Spanish. That does not imply you speak either language.

Re:Illogical

[SpinyNorman]

Computer generated speech and human speech arn't as far apart as you seem to think, and the differences are more in areas like natural sounding intonation and emphasis that would be present in spontaneous speech but not so much in someone emotionlessly reading "the cat sat on the mat" from a captcha prompt.

The computer vs human differentiation approach that would seem to provide **least** insight (that could lead to the computer improvement) would be a trained (neural net, SVM or whatever) classifier, but if such an automated classifier was indeed achievable then one could at worst use it as basis of a genetic algorithm to tweak a speech synthesis engine into the classified-as-human realm by varying those factors that affect the classifier inputs.

Re:Illogical

[evansomd.com]

Your analogy is simplistic and inaccurate. If you can distinguish Chinese from Spanish, then you have a good chance of imitating Chinese and Spanish enough that a fellow English-speaker could identify your imitations correctly. Same thing with the computer. If the computer has a model of computer speech, then it probably has the ability to imitate human speech, maybe not to sound like human speech, but enough to pass its own test of whether speech is human or computer.

Re:Illogical

[Garse Janacek]

Err... what you're saying isn't what was originally claimed. What was originally claimed is that if a computer can effectively distinguish between computer and human generated speech, the computer can also generate human-sounding speech. You interpret "human sounding" to mean "human sounding to that particular distinguishing algorithm", which is certainly a possibility depending on the structure of the algorithm, but the original claim -- that the speech would sound human (as far as a human is concerned) -- is far from clear and, as GP says, probably false. In your analogy, this would be the claim that by distinguishing Chinese (that's a language now? :-P) from Spanish, you would be able to imitate them well enoughto fool a native speaker. There it becomes trivially false. In human vs. machine speech, I think it is less trivial, but still unlikely.

More blind people coming.

[iamsamed]

...more blind and hard-of-sight people will be using the Internet...

And don't forget all the sighted people who will become blind from "looking" at all that porn!

Alternate URL

[desmondhaynes]

http://techwatch.reviewk.com/2008/04/the-imagination-project-picture-based-captchas/

Re:Alternate URL

[Ecuador]

Can someone mod this clown down (if banning is not possible)? He keeps posting this site of his that redirects you to all sorts of advertisments...

Re:Alternate URL

[Ecuador]

Hmm I see he automatically redirects only IE, with Firefox I stay on the article page... I guess that's why no other slashdotter noticed the problem!

Re:Alternate URL

[Anonymous Coward]

YOU still USE IE!!! Shame on you!

Re:Alternate URL

[Anonymous Coward]

It didn't redirect me anywhere on IE or Firefox.

Re:Alternate URL

[Anonymous Coward]

It redirects my IE7.

mechanical turk

[192939495969798999]

Just hire out cracking it to a mechanical turk service, and log their results to a database. Before long, you'll have a system capable of monte-carlo guessing at a high rate of accuracy. The computer doesn't need to know much about the image to make an educated guess with a large enough data pool of previous solutions.

Re:mechanical turk

[ouder]

Computers can make random guesses thousands of times an hour. Some will eventually work by pure luck. Methods like this, or just knowing the general algorithm allow you to shave the odds even further in the hacker's favor.

Re:mechanical turk

[FurtiveGlancer]

Image file size and/or checksum might become a key index for a cheaters database.

embed in a childrens game Re:worthless

[Anonymous Coward]

and when they start demanding more money one could build this puzzle into a childrens game and they will pay for solving CAPTCHA.

Death/Alternative test

[Anonymous Coward]

Why can't we put a black box of pain? That will demonstrate who is human and who is not

Not just entertaining, also educational!.

[way2trivial]

Let me get my old fart hat on.
I first ever was in contact with a 419 via postal mail.

yes, 419 scams used to be pulled via the postal service.... international stamps the whole bit.

I admit- I was intrigued (and naive) and did nothing.. sounds too good to be true etc,, but I thought about it a whole lot.
Since then, and before the prevalance of 419 emails,
I've seen more than a few news stories about people getting into hot water for believing

now that 419 email is so widespread, and the topic so widely known, I acknowledge that it's funny on me..
but the subject matter is also very well known to many many people....

not just entertainning, but educational!

CAPTCHA = The terrorists have won.

[v(*_*)vvvv]

Like airport security, CAPTCHA puts a tremendous burden on the innocent people just because they cannot detect the terrorists.

How is CAPTCHA broken and how is it "technology"?

It is not broken because it works as it is suppose to. I would think the correct term would be "solved" or "been overcome".

Technology-wise, CAPTCHA is a workaround, not a solution. The real problem is automated bots manipulating forms where the webmaster only wants humans. Detecting whether or not the visitor is an automaton would be the solution, but because people have apparently given up on this, they have resorted to trying to detect whether or not the visitor is human.

Re:CAPTCHA = The terrorists have won.

[eean]

So you want the bots to take a test that a human would fail?

Re:CAPTCHA = The terrorists have won.

[gtall]

Hey, you are right. If they would only solve the problem then it would indeed be solved. Maybe you could give them a call and explain it to them.

Gerry

Re:CAPTCHA = The terrorists have won.

[Archangel Michael]

This gives me an idea about how to catch automated bots filling in forms.

I suspect that they actually fill in the forms much much faster than humans can type. Therefore the solution to detecting bots filling in forms is to time the process using some sort of Java Script against the form being filled out.

Most people also have a rhythmic pattern to actually typing that I would think would be much harder to duplicate in a bot.

As the bots integrated this type of patterns, it would necessarily slow them down. Anyone want to create a Javascript form that tests the typing speed of the person filling in the form?

Another possible solution is instead of having forms that use text based labels (Name, Nickname, Password) in predictable locations and orders, use CAPTCHA style labels, in random locations, requiring bots to increase their intelligence.

The solution is to slow the bots down basing the forms on things humans can do, but bots have a hard time doing. Timing keystrokes, and using Images instead of Text for Labels would definitely slow the bots down.

Re:CAPTCHA = The terrorists have won.

[bamwham]

Or how many mistakes they make. Personally I can't fill in a webform without using backspace a couple of times. Checking for typos might be good as well, I'm sure I make far more than your standard computer-bot.

Re:CAPTCHA = The terrorists have won.

[Anonymous Coward]

anything client-side (javascript) is easily faked and won't work

Re:CAPTCHA = The terrorists have won.

[Anonymous Coward]

If your computer can discern that it's a human typing, their computer can use a variation on that algorithm to mimic the human.

I think RapidShare has a good one

[JorDan Clock]

Last time I used RapidShare, they had a CAPTCHA that not only had distorted letters, but dogs and cats behind them. They were very simple, but enough to distinguish between the two. These dogs and cats are blended into the letters and to pass the CAPTCHA, you have to put in the characters with cats.

Re:I think RapidShare has a good one

[psy]

Only problem was it took me 5-6 goes to understand how to do it.

It says select 4 letters (when there are numbers and letters)..

Then took me a while to realise there were cats and dogs.. i thought it was just random.

Other bad part about it was that there was a 30 second delay inbetween each attempt!

I suppose I ought to RTFA

[Nursie]

But what the hell is a "fake color"?

Re:I suppose I ought to RTFA

[Alzheimers]

You'll have to ask Apple

Re:I suppose I ought to RTFA

[RoboRay]

Chartrouse?

i think its too big

[PJ1216]

the image is huge. plus its two steps. also, the annotation part... i wasn't actually *sure* i was answering correctly. it looked like they were near water... boat was an option... didn't look like a boat... but nothing else really made sense... well, 'cept there was a guy in the picture and "man" was a choice as well... but i went with boat cause the guy didn't seem to be the focus. nonetheless, it required effort to reason it out. i don't want my captcha taking up more than 2 seconds, let alone like 30 seconds.

Re:i think its too big

[Archangel Michael]

"i don't want my captcha taking up more than 2 seconds, let alone like 30 seconds."

Okay, I recently suggested that the problem with bots is that they can do things more efficiently than humans, and the actual solution is to base the whole registration process on human responses that are impossible or take too much time from automated bots.

My question to you is, is 30 seconds to figure something out every once in a while worth it to keep bots from taking over the world?

Personally, I don't have a problem taking 30 seconds if it keeps a bot out. None at all.

Re:i think its too big

[billcopc]

Well I do, because I usually do a dozen of these each day on various sites. The web is my workplace, and I've got better things to do than pander to underachieving security weenies.

The CAPTCHA was a great idea back in the day, but now it is obsolete, like everything else in the tech world. Let it die with some dignity.

Even this uber-annoying system can be defeated using today's tech: forward the image to another user, and copy their answer. That's what a lot of scripts actually do... they post the image somewhere and wait for a human to fill it out.

What ? Why'd ya think there were so many similar-looking CAPTCHAs in the first place ? It's a big money business.

Re:i think its too big

[Archangel Michael]

I know, I need to come up with a form similar to the email SPAM form that has a list of all the proposed solutions to form spam, and have you fill out which check boxes you think whatever solution to the problem is, and why it fails.

[x] Takes too much time out of my day (anthing more than 30 seconds is a waste of time)

Re:Can't RTFA. Already /.'ed after just ONE commen

[Kippesoep]

CGA itself is colour-blind. The picture is a dithered mess, but I doubt it wouldn't work in greyscale as well. Since it is composited of several images, if you have trouble finding the boundaries (and therefore the centre) of one, just pick another.

Sweatshops

[Anonymous Coward]

Spammers will still just pay sweatshop workers to solve these, won't they? What does this solve?

Re:Sweatshops

[justinlee37]

If they're forced to actually hire people to review all these images, then that is a victory. It makes it that much harder for anyone to get into the spamming business, since they would have to have the money to hire all of those people. It represents another barrier to entry, and the more barriers there are, the less spammers we will have overall.

This is where it falls apart...

[Joce640k]

Pretty soon they'll just set up a "free porn" site - free access so long as you solve a captcha to get in.

It's been threatened and talked about before, all it needs is something "unbreakable" like this to actually make it happen.

Re:This is where it falls apart...

[xaxa]

Pretty soon they'll just set up a "free porn" site - free access so long as you solve a captcha to get in.

It's been threatened and talked about before, all it needs is something "unbreakable" like this to actually make it happen. It's already happening: http://news.bbc.co.uk/1/hi/technology/7067962.stm

Re:This is where it falls apart...

[EMeta]

Wait, I'm confused. Is this a good or a bad thing?

Anyone else notice the link on the PSU Website??

[Anonymous Coward]

http://wang.ist.psu.edu/docs/projects/imagination.html talks about the new CAPTHCA's and has a link to two places that talk about the ability of breaking CAPTCHA's... such as http://sam.zoy.org/pwntcha/ which lists Slashdot's CAPTCHA as 89% bypassible by their software because of "Weaknesses: constant font, no deformation, constant colours, weak perturbation."
But scroll about 3/4 of the way down that page and find the "Other captchas and hard captchas" section and check out "Cwazymail"'s CAPTCHA's... who woulda though there's a legit use for that picture?!?! LOL

And what if I have no imagination!?

[Anonymous Coward]

And what if I have no imagination you insensitive clod. Accountants/Buerocrats can't pass such a test!
(think HG to the galaxy for image). Are we creating turring tests for computers or reverse turing tests for people.

At least a part is Ineffective

[Dracolytch]

Ok, so I was able to do the image analysis one, where they take an image, muck with the color, draw a bunch of black lines over it, and then ask you to annotate it with a word from a list.

This is no better, and may be worse, than what we have now, for two reasons.

1) If you fill in the gaps programmatically, and then make the image grayscale, you probably have something you can use for image matching.

2) Much more severely: The interface reduces the number of possible answers by multiple orders of magnitude. For the one I saw I think there were 10 or 15 answers. Even if you kick image recognition to the curb and randomly choose an answer, you'll be right 1/15 times. It'd be trivial to write a program to harvest hundreds of accounts in a day by just picking random answers. Hand that off to a botnet or similar, and this becomes a minor speedbump.

~D

Re:At least a part is Ineffective

[Walter Carver]

It'd be trivial to write a program to harvest hundreds of accounts in a day by just picking random answers. Trivial eh? Well write it and send them the program. Help them make it better.

Will it even work?

[SeePage87]

I haven't been able to try it, but multiple choice doesn't seem like a good authentication system. If a captcha breaker can succeed even 20% of the time, that's usually considered good enough for mass exploitation. Maybe the geometric center aspect will help, but there has to be a margin for human error which the machine can capitalize on.

Re:Can't RTFA. Already /.'ed after just ONE commen

[Yvan256]

How abour color-blind people using CGA monitors?

They became blind after using CGA! I mean, have you ever seen the aweful colors of CGA? Whoever decided on those colors was on crack or something!

Email is broken and we need to dump it ASAP

[Yvan256]

Why are we fighting the results instead of trying to fix the cause?

Why do we need CAPTCHA? Because people sign for email accounts to spam people with their crap.

Why is spam possible in the first place? Because the email system wasn't designed with abusers in mind. Email is broken and we need to dump it ASAP and replace it with something else.

Unfortunately I don't have the answer, but that doesn't mean my point is invalid. Surely there has to be a solution, someone somewhere will think of something.

Re:Email is broken and we need to dump it ASAP

[PRMan]

Unfortunately I don't have the answer, but that doesn't mean my point is invalid. Surely there has to be a solution, someone somewhere will think of something.

Large bounties for the severed head of a spammer?

Re:Email is broken and we need to dump it ASAP

[Culture20]

To paraphrase Family Guy:
Adam West (holding a smoking gun): "Is anyone else here a spammer?"
Random guy (points to woman next to him): "My wife is"

Vigilante justice breeds injustice. Too easy to frame someone.

I for one

[mapkinase]

I for one welcome this development. The more complex are CAPTCHA to solve, the less is the number of idiots in the tubes.

Re:Fake Color

[Anonymous Coward]

But what the hell is a "fake color"? "The colours red, blue and green are real. The colour yellow is a mystical experience shared by everybody"
-Tom Stoppard

Solution: unproven users = limited access

[davidwr]

Wikipedia does this by restricting what new accounts and non-logged-in accounts can do.

If free mail servers put restrictions on what new accounts could do, with an override to anyone who is willing to go to a lot of trouble to prove they are human, it would short-circuit the spammer problem.

If Yahoo, Gmail, etc. all limited you to 10 outgoing mail recipients a day until you had both 1) had the service for 1 day and replied to 10 messages, AND limited you to 100 outgoing mail recipients a day until you signed up to be a "high volume sender," it would cut most spammers off at the knees. Depending on the service, being a "high volume sender" may involve turning over a credit card number and may not be free. Some services may give "loyalty awards" to long-term customers by removing this restriction for people who have had their accounts for 6 months and show a heavy non-spammy ad-revenue-generating usage pattern.

Re:Solution: unproven users = limited access

[Culture20]

bot1 sends email to bot2 which replies, and forwards the email to bot3, replying to both bot1 and bot2...

The interaction quota is met, the bots sign up for mass service, and spam is sent. The end result is that more internal email was generated on the email providers' system, then they lost bandwidth anyway. The reason Gmail's getting hit now is that they're not doing the invites any more. When they could tie ten spammy email accounts to invites from person X, they could ban person X.

Re:Solution: unproven users = limited access

[porneL]

This could work like PageRank, except incoming link => incoming e-mail.
Incoming mails from accounts that aren't trusted wouldn't make you any more trusted.
Anyway, it looks like a fantastic waste of bots' resources. Every mail that lands in bot's inbox is a mail that didn't land in user's inbox.

Captcha solution

[foniksonik]

I know this will make a lot of you groan.... but this is a perfect scenario for the use of Flash. It could easily be implemented using one of the open source SWF libraries as well...

What's nice it that there are a few good libraries for speaking flash text as well, so an audio option is possible as well.

http://www.dracon.biz/captcha.php

Spam problem can be solved easily

[uuxququex]

Email is fine, people are broken.

There are a couple of simple steps to eliminate spam:

• - ISP disconnects zombified/botnetted clients, stating the reason to the customer;
• - Other ISP's blacklist ISP's that don't do this;
• - Owners of companies that advertise by spam are rounded up and shot (or fined heavily, if you prefer);
• - Countries that don't play nice get blacklisted and/or totally shut off from the internet.

Result: no more spam.

Re:Spam problem can be solved easily

[Yvan256]

You can't fix people nor can you expect all the ISPs in the world to comply with your solution.

As soon as there is people involved, you have to assume that a lot of them are idiots and a lot of them will abuse your system. Build in consequence.

Email doesn't work (abused), spam is wasting bandwidth world-wide, we need to put a stop to it.

And please, whoever comes up with the solution... choose a better name than "Email 2.0"...

Re:Spam problem can be solved easily

[uuxququex]

In my Grand Plan stupid people and stupid ISP's are not a problem for long as they are disconnected. That way either they will get their act together or they can enjoy their own little network. Want to play with the rest of the world? Then learn to behave responsible.

Re:Spam problem can be solved easily

[Yvan256]

In your grand plan, no ISP would comply because companies still have to communicate between them.

Hey, how would you like to lose your connection to the rest of the world because your ISP (which could be your only choice as perhaps there is no alternative in your area) is too dumb to "get their act together"?

Your plan requires too many people from different levels and way too many ISPs collaborating all at once, it just can't work.

Fake Colors!?

[Anonymous Coward]

I would love to see these fake colors and expose them for the fraud hues they are.

Regarding your sig

[spun]

I can already see how this is going to go.

"You stole my sig!"
"No I didn't."
"Yes you did, it's exactly the same as mine!"
"No it isn't."
"Yes it is!"
"No it isn't. Look, mine is in two lines."
"That hardly makes a difference."
"Yes it does!"
"No it doesn't."

Re:Regarding your sig

[phoenixwade]

I can already see how this is going to go. Why? we both lifted it from the same source material

"You stole my sig!"
"No I didn't."
"Yes you did, it's exactly the same as mine!"
"No it isn't."
"Yes it is!"
"No it isn't. Look, mine is in two lines."
"That hardly makes a difference."
"Yes it does!"
"No it doesn't." I actually prefer Norwegian Blues.........

Here's a reference implementation

[gr8dude]

Which of the following would you most prefer?

• A: a puppy,
• B: a pretty flower from your sweety, or
• C: a large properly formatted data file?

Re:Here's a reference implementation

[tepples]

Which of the following would you most prefer?

• A: a puppy,
• B: a pretty flower from your sweety, or
• C: a large properly formatted data file?

That's not a test to distinguish humans from computers. It's a test to distinguish data integration programmers with allergies from non-programmers without allergies.

Re:Here's a reference implementation

[dodobh]

Where's the Cowboy Neal option?

Does this count

[evilninjax]

as being Rick Rolled?

Re:Does this count

[Artuir]

Yeah. At least for me. Once the song started playing in my head, it was game over for me.

It will be cracked...

[DrLex]

... just like every other standard CAPTCHA system. The key to a good anti-bot protection is to make a question that requires actual intelligence. Most current CAPTCHA systems don't require intelligence, they're just a kind of 'expert system'. There's always some kind of algorithm behind them and this means that any sufficiently motivated programmer can implement this algorithm. The incentive of being able to send massive amounts of spam through something like GMail is very motivating for spammers.

A real Turing test relies on the ability of humans to cope with unknown situations. The amount of 'unknown' in all current CAPTCHA systems is way too small. Any site that is a major potential target for bots should hire a team of dedicated CAPTCHA makers. Their only job is to continuously come up with sufficiently different CAPTCHAs, every few weeks. Each new CAPTCHA is added to a pool or 'battery'. When a new user signs up, a random CAPTCHA is picked from the pool. As soon as one appears to have been cracked, it's withdrawn. Yes, this costs effort, but there's no future in one single CAPTCHA system. It's better to have a whole battery of relatively simple CAPTCHAs than a single complicated one.

Conscious AI

[nanostuff]

The first conscious AI will without a doubt be created by a spammer. Forget cures for diseases, there are cats behind letters to be found.

Can also be substituted for your SAT/GRE scores?

[evilninjax]

Serves a dual purpose then. It also automatically filters out people. If you are too stupid to figure out this CAPTCHA then you are too stupid to have a GMail acct.

Solution is to pay?

[evilninjax]

It may soon come to the point where we have to pay for some of the free services we enjoy now. Although, maybe that's not so bad, esp. if the fees are low. For instance, if gmail were to cost $1 for a lifetime use, it might not be so bad...

I know alot of people don't want to pay and many others can't really pay (teens, people without cc's, etc) and it would perhaps get prohibitive depending on how many services/sites you are registered in.

Re:Solution is to pay?

[Anonymous Coward]

I agree.

As long as there is some potential to make >$0 for ~$0 investment on the part of spammers, spam will be a problem. CAPTCHA technology does little to increase the ~$0 investment.

Why not charge people to send email or create an address? The charge can be nominal; it would still have an effect. Technical challenges to this approach could certainly be overcome with the funds generated.

Can we create even bigger annoyances for users?

[dbmasters]

Are there not back-end ways to filter out spam that doesn't totally inconvenience the user? Yes, there are, I have done it on numerous web sites with great success by scanning the content being submitted for signs of spam and garbage input. Granted, every application has different input available to scan, so the methods I have used likely won't work for everybody, but it's done a great job for the applications it does fit in, such as contact forms, site registrations and such things...CAPTCHA is only a greater annoyance for the user...just like long registration processes for software, dongles and similar systems, they serve only to annoy the legitimate users.

Mega slashdotted...

[Cap'n.Brownbeard]

There you have it...

SERVICE DOWN TEMPORARILY

Because of the exposure on slashdot today, we experienced an unexpected number of users. The service is temporarily down. We will be back online later. For more information about the project, go to the project Website or contact Prof. James Wang at jwang at ist.psu.edu .

-- Thanks, the IMAGINATION team.
April 23, 2008

SERVICE DOWN TEMPORARILY

[Zwergin]

Another one Bites the SlashDot Exposure dust. :-) SERVICE DOWN TEMPORARILY Because of the exposure on slashdot today, we experienced an unexpected number of users. The service is temporarily down. We will be back online later. For more information about the project, go to the project Website or contact Prof. James Wang at jwang at ist.psu.edu . -- Thanks, the IMAGINATION team. April 23, 2008 ~Zwergin

Couldn't figure it out

[noidentity]

SERVICE DOWN TEMPORARILY

Because of the

The answer is "Slashdotting", but where do I type it? I can't figure this CAPTCHA out...

Re:Couldn't figure it out

[Anonymous Coward]

http://techwatch.reviewk.com/2008/04/the-imagination-project-picture-based-captchas/

IMAGINATION works until

[Anonymous Coward]

somebody develops an algorithm for solving Zen riddles.

the voigt kampf test

[Anonymous Coward]

We should get back to captchas based on emotional responses.. show images in the captcha clockwork orange style - the humans will react differently than the computers, thats for sure

I'd be PISSED if a page asked me to do this

[GanjaManja]

Did anyone else go "What the F***?!" when they read the instructions? That was the crappiest most pain-in-the-ass 'captcha' I've ever seen. Geometric Center of any image you can figure out? Annotate the image? not exactly simple or unobtrusive, is it? I got it right away, maybe it'd be ok if someone can write layman-legible instructions. I just guessed at when the heck they were asking for...but it wasn't immediately obvious. Anyone care to enlightned me as to what's so wrong with the current (10 or 20 different types) of Captchas? I don't see them being broken/spammed all over the place, so it's boviously not too bad...

its been slammed by slashdot

[misterjava66]

Take the link down please. It claims that slashdot slammed it.

-----------
SERVER TOO BUSY

Because of the [snip]exposure on slashdot today, we experienced an unexpected number of users. The service can be temporarily down from time to time. We will be back online when the load is lower. For more information about the project, go to the project Website, read an earlier publication on this project, or contact Prof. James Wang by email at jwang at ist.psu.edu .

-- Thanks, the IMAGINATION team.
April 23, 2008
-------------

The problem is that it's also xenophobic

[Moraelin]

Heh... while generally I might even join in that chorus, what everyone seems to forget is: there's a whole freakin' PLANET out there, not just the USA. That's a problem which captcha makers seem to blissfully ignore. You don't need to be a moron to have problems with certain words, you just need to be a foreigner.

E.g., let's even say that we're generous and provide a .WAV or .MP3 for our captchas. Cool, so pretty much anyone accessing your site from work, probably has those blocked by the corporate proxy, due to scared about RIAA lawsuits and lost productivity.

But ok, let's say that the user is at home. Today's word sounds like "booblz". Now write it in that text box. Of course, if you're a native English speaker or really good at English, you're typing "baubles" there. If not, you may be left wondering wth you just heard there. Or how you write it, since English is a very funky language when it comes to how you write a word versus how it's pronounced.

Note that I'm not talking about people who are completely unable to use English, so please don't give me a wisecrack like "then they shouldn't be on an English site". One can be reasonably proficient in a language by knowing just a few hundred words. Or to use some free email site, you just need to understand the menus and buttons, basically, and send-receive emails in your own mother tongue otherwise. Asking them to guess at some word they never needed before, isn't exactly going to prove anything about their IQ.

And I'm now getting back to why I said "not just the USA": because even in UK's Commonwealth, words can be pronounced very differently than you'd assume. If you want to see what I'm talking about, try listening to anything spoken in a Glasgow accent if you're not from there. Youtube has a few clips in that accent, for example. You're damn good if you can understand half the words.

"Semantic" stuff has the same problem. E.g., ok, to prove you're a human, pick the goatee from the image list and add it to Mr Potato Head. Or bisect the acute angle in that triangle, if we're talking geometry. If you're not a native English speaker, you may be left wondering wtf is a goatee or an acute angle. It's not like they're words you'd need every day or which would be essential to use the site otherwise.

Again, you haven't just discriminated against the retarded, you've _also_ discriminated against reasonably intelligent people who just happen to speak a different language.

So basically even if you were ok with discriminating against the stupid, it _also_ ends up being xenophobic. Whether you're ok with that too, well, that's up to you to decide.

advancing AI

[Thuktun]

Aha, the next AI micro-X-Prize has been announced!

hotcaptcha

[SCHecklerX]

I like this better:

http://www.hotcaptcha.com/

Re:hotcaptcha

[Anonymous Coward]

I tried this one, and failed to pass more than I succeeded. More with the men; with the women it seems easier to guess what beauty standards most people are judging. funny idea though.

No one has mentioned

[Anonymous Coward]

The Captcha Mashup at http://www.hotcaptcha.com/ I do believe this should be implemented everywhere.

THINGS TO REDUCE CAPTCHA NOW

[v(*_*)vvvv]

Here are some easy things that can be implemented immediately that would help eliminate the need for CAPTCHA.

1) Create limits for submission. Free Email? How about 1 account per day or 1 per client IP/OS signature. NO CAPTCHA.

2) Place cookies upon HUMAN detection. This is for sites like ticketmaster. If someone has ordered already, SCREW CAPTCHA. Don't keep asking if they're human!

3) Remove CAPTCHA for authenticated users. CAPTCHA should be for non-registered users only. If they're registered, 1 test is required at most.

4) Make a FLASH submit button. Most robots can't click.

5) Use email authentication and other verification methods. Phone, SMS, credit cards are all viable. Depends on the service.

6) Detect atomaton behavior and trigger hurdles. For example, any activity where pages are being requested systematically and rapidly; any forms submitting the same information multiple times. Upon detection, display the CAPTCHA or whatever the hell you want to do about it.

I admit 6 may require some skills to implement, but if you can afford a CAPTCHA system then maybe you can invest in something better.

Something tells me though, that Hotmail and Ebay could remove CAPTCHAs if they tried. They just don't think its that important.

Re:THINGS TO REDUCE CAPTCHA NOW

[Anonymous Coward]

Proxies mean that thousands of people share an IP address.

Re:THINGS TO REDUCE CAPTCHA NOW

[v(*_*)vvvv]

client IP/OS signature, not IP. There are many ways of creating highly unique signatures from what you can obtain through the server.

This will not work! CAPTCHA is not OCR cracked

[John Sokol]

I have know a few off shore spammers first hand (I don't approve of there professions).
There is no way any of these guys could write any kind of an OCR app, maybe just off the shelf tools scripted together at best. Even that's pushing it.

So I started to look into this.
From much the the research a friend and I have been doing into spam and CAPTCHA cracking we have found that many are cracked not by machine but unwitting humans.

Basic idea. Put up free porn sites that allow access if you pass a CAPTCHA test.
But here is the trick, the CAPTCHA test is just a proxies off an account setup for some other service getting cracked.

So when the user desiring his free porn responds it is actually allowing the hacker entrance to a CAPTCHA protected site without having to pass some OCR/Turing test.

This eliminates the need to develop some complex piece of software. And is well withing in the skill levels of my spammer acquaintances.

So improving the complexity of CAPTCHA will have NO EFFECT!

Colorblindness?

[the JoshMeister]

A user is asked to ... annotate an image using a word selected from a list. These images shown to the users have fake colors, textures, and edges, based on a sequence of randomly-generated parameters. Computer vision and recognition algorithms, such as alipr, rely on original colors, textures, and shapes in order to interpret the semantic content of an image. Because of the endowed power of imagination ... humans can still pass the tests with ease. What about colorblind humans? Roughly 7 percent of all males are colorblind. One would hope that with such a high colorblind population that the "words selected from a list" wouldn't be color-related, and that color would not be an essential factor in humans being able to interpret the new CAPTCHA images.

Times to much time to complete - I'd bail.

[ChrisA90278]

I just tried the examples. I think many people would fail these. I didn't because I was carfull and took my time. But if this was on a real web site I'd have the REALLY want to to access it. Mostly I'd say "to hell with this" and find some other web site. It tkes a full minute to work through it, way to long for most of us.

Why not have the user read a short story then answer a multiple choise test. like "What do you think mary will do next? (a) develope a dislike ofdogs, (b) kiss john, (c) jump off a bridge. ---- That would work well. it asks to much of your users time.

Re:Times to much time to complete - I'd bail.

[Anonymous Coward]

I just tried to do one myself and the options to choose from didn't match the picture.
Image was the Sphinx in Egypt. Should I have selected "pyramid" from the list? or "cat"?

ZERO bots on my forum

[drew30319]

Using phpBB http://www.phpbb.com/ and a mod called "textual confirmation" http://www.phpbb.com/community/viewtopic.php?t=463860 no bots have successfully signed up for the forum for my non-profit organization although there are sometimes hundreds that attempt to daily. It's simple to use and very flexible.

Currently I pose a simple arithmetic question (eg. 3+8=_ _? or 15-3=_ _?). The questions are selected from a list so there's little risk of the bot "learning" the answer. Alternatively you could offer a question that has a deliberate cultural bias (Jack and Jill went up the _ _ _ _?) or really any question of your choosing (What is the fifth word from the second paragraph on the home page _ _ _ _ _?).

Please don't take my pronouncement of ZERO bots as a challenge but feel free to test this very easy-to-use tool by registering for my forum regarding Teen Dating Violence:
http://www.jenniferann.org/forum

Why 2 Tests

[Henneshoe]

Something seems inherently wrong in using 2 separate tests to determine if a poster is human. If a bot is able to fool one test but not the other, why wouldn't you throw away the test it can fool and only have 1 test. If some bots can fool the first test while others can fool the second, then it doesn't take much to combine them to get around the entire system.

Even smart users have problems.

[TechwoIf]

I had to google "annotate" in order to figure what to do on the next one. How many users understand "geometric" center? All they know is just the center and probably just clicked the center of image itself, failing the test. On the forums that I set up, I just use a simple question and answer. Each question is customized to each site so that only users that are interested in the site will understand and figure it out the correct answer. I create a few questions because not everyone knows everything.

How to do this automatically

[Animats]

This doesn't look too tough. Take the original image, the one where you're supposed to find the "center of the image", bring it into Photoshop and apply Gaussian blur with about 4 pixels. That gets rid of the noise. Then, as an experiment, try "find edges". This brings out some, but not all, of the edges, finding some that aren't horizontal or vertical. What's needed is an edge finder that recognizes only long vertical and horizontal edges. That will bring out rectangular areas, and a program can then find and report the center of rectangles. It won't be perfect, but it doesn't have to be.

The second stage test consists of a black grid superimposed on a noisy image. First, remove the black grid and interpolate the missing pixels. Then do a Gaussian blur at about 2-3 pixels to get rid of the noise. Now you have a blurry picture. The site probably has only a small library of original pictures, and relies on making them look different by distortion. After you've identified some number of them by hand, duplicates will start to emerge. Use a simple matcher to match pictures against your library of identified pictures, and expect a reasonable success rate.

Most of the necessary code can be obtained from OpenCV.

So this isn't likely to work for a major site worth attacking.

This isn't the problem which needs to be solved

[nevali]

It strikes me, though, that the problem isn't that computers are solving CAPTCHAs, but that they're being farmed out to be used as the CAPTCHAs on dodgy porn and cracks sites--i.e., they're still being solved by a human, just not a human visiting the site the CAPTCHA belongs to.

The solution to this, though, should be a CAPTCHA relating to some information about the site you're visiting (for example, the domain name, or the navigation bar, or somesuch). Computers don't understand the question, and transplanting the test fails because the answers will immediately be wrong.

Re:This isn't the problem which needs to be solved

[bytesex]

You could 'obfuscate' the captcha by cutting the picture in n parts and using divs to realign them. The actual alignment could be part of a javascript algorithm, which changes and uses complex-to-parse math to get to its numbers. The javascript could be eval-ed out of a string, which is decrypted using a user supplied password (anybody implemented AES in javascript yet ?). Now I'm running away with myself; the point is, when you start to force scammers to take actual screenshots of browsers, and use replay of mouse movements to capture what needs to be done to get past the CAPTCHA, then maybe you could be a bit ahead of them. For now.

how do i rolled rick?

[tepples]

I'll start. Finish this: "Never gonna give you up"...

I'm never, ever gonna stop
Not the way I feel about you
Girl, I just can't live without you

-- Barry White

Filter for Stupidity?

[msheekhah]

Remember Asimov's book...

Chapter I. Against Stupidity
Chapter II. The Gods Themselves
Chapter III. Contend In Vain

nevar forget

It's called defense in depth

[tepples]

It'd be trivial to write a program to harvest hundreds of accounts in a day by just picking random answers. Hand that off to a botnet or similar, and this becomes a minor speedbump. It's called defense in depth. If your app already throttles how many accounts a single IP address or a single /24 can attempt to create per day, and your app already throttles what a newly created account can do, then a multiple-choice CAPTCHA stops a significant percentage of bots even before they hit your existing measures.

Get yourself notarized

[tepples]

How do you protect the sign-up page to get an OpenID? With a captcha? Ideally, notaries would offer identity service for a nominal fee.

a better CAPTCHA

[Khashishi]

Base it around comprehension of a passage of text rather than some image which blind people can't see.

craptcha

[Anonymous Coward]

Nuff said.

I can brute force this right now

[Anonymous Coward]

This thing is not secure. You can brute force it with a grid.

Step 1) Notice that the edges of the random composite line up with the middle of various images, so an image recognition program need only start there. Edges are easy to spot. It can look at the size of each box, note which edge lines up with the center of one and click there. It doesn't even need to look at the pictures.

Step 2) Randomly choose one of the ten options.

Spammers don't need a high success rate. They can get by with 10% success rate, which is what this is a 1/10 chance.

If a grid hammers a public email sign up form, with multiple threads, from multiple IPs, say MS or Yahoo or Gmail, that's all they need.

Done.

Try again.

"humans can still pass the tests with ease"

[Anonymous Coward]

What the hell was that second image? Looked to me like a caterpillar on moss, but that was not an option.

I guess I'm not a human.

Figured out a way around it already

[Anonymous Coward]

I tried to find a way to leave these guys a note but I figured out a way around in it in like 4 minutes. All I have to say is that the photographic content needs to be randomized and not in order like it is now.

Voight-Kampff

[guerillaontologist]

"My mother...let me tell you about my mother..."

first looks worthless already

[smeaggie]

The first test doesn't seem too hard... I downloaded a few samples of the picture, applied a pixelize filter in The Gimp, and the borders of some of the subimages come out very clear. Since you only have to point to the center of a single subimage, a simple program could probably find a good point in no time!
Another flaw in the first test is that there are always subpictures in the corners touching 2 outer borders of the complete picture. This means you only have to detect 2 sides to determine the center of it.
Furthermore, some subimages have a significant different colorpattern than others in the background (ex: bright sky vs. plain black) and the program wich puts these images together doesnt really seem to keep track of this, wich makes the borders very simple to detect.

Leaves us with the second picture, but the first looks worthless already...

Needs More Work

[vacuum_tuber]

Even for what it purports to be it's so far badly done. It's not clear what they mean by 'subimage.' If there are two lions, are they a unit or is each of them a unit or is only one of them a unit? Where is the geometric center of a lion? Somewhere in the chest region, or, as is more intuitive, the center of the face or head? Why do several of the annotation tests show ruins that are NOT pyramids yet the correct annotation is "pyramid?"

This technology is useless against...

[Max Threshold]

...the armies of Indian and Chinese kids getting paid half a cent per captcha solved.

Sometimes the user knows more than the questioner

[Wizardess]

I was presented a picture of an ancient (65 million years of evolution ago) bird. So I selected bird, of course. That IS what a tyrannosaur is. It's protein makeup for its bone marrow is closest to chicken of all animals tested. Hence, it's a bird. Yeah, I am being obnoxious. Dinosaur was on the list. Bird probably should not have been on the list. {^_-}