Slashdot Mirror
Understanding How CAPTCHA Is Broken
An anonymous reader writes "Websense Security Labs explains the spammer Anti-CAPTCHA operations and mass-mailing strategies. Apparently spammers are using combination of different tactics — proper email accounts, visual social engineering, and fast-flux — representing a strategy, explains their resident CAPTCHA expert. It is evident that spammers are working towards defeating anti-spam filters with their tactics."
Whose bright idea was it to use light grey text on a white background?
This article links to what is basically an infomercial. What it links to is filled with pictures and seeming explanations, but it's written in scare-mongering language and not written with an eye towards the reader understanding it. It as an advertisement telling you that Websense is a fantastic company because they understand all this terribly scary stuff and already have the technology to defeat it for you.
Need a Python, C++, Unix, Linux develop
Because people like me would never, ever use their service under those conditions?
Either the spam-fighters will keep spam down to an acceptable level or they won't.
Mail services that don't provide good spam protection will fail.
If it becomes too hard to fight spam, mail as we know it will end and be replaced by something else, much like USENET was for most purposes replaced by other, less-spam-prone media.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
It ought to be obvious to everyone that spam is a property violation crime. Putting unrequested email in my account is the same as dumping used tires on my front lawn. Sure I have an address, but that doesn't mean I want just anyone to deliver anything to it without my permission. Why aren't we making this explicitly illegal, just like dumping and vandalism already are? Why are we putting up with these people?
May contain traces of nut.
Made from the freshest electrons.
As far as I know, the US is the only country where the SMS receiver pays up, which seems absurd to anybody else. Anyone cares to enlighten me as to the reason for that ?!?
Non-Linux Penguins ?
No, I'm worried about a world in which I have to divulge my social security number to private corporations online to partake in services that should never require such information.
Would I give a bank my SS#? Sure.
Would I give my SS# to Yahoo? Not as long as there are other places where I can get free email and play fantasy sports.
Yeah, right, with the spammer putting your own phone number on the form and registering for the account at 3am... I don't think so.
Non-Linux Penguins ?
The only thing really protecting you is that your solution is not standard, so bot writers have to treat your website differently, so they won't be as easily able to post there. The instant your solution becomes more commonplace, bot writers will be able to parse your SWF files, read the images, or do whatever else it takes to solve it.
It's a classic case of Security through Obscurity, and this time it works.
However, SWF files have accessibility issues, and there are always people who love to block them.
Enjoy paying for all those peak rate calls to russia...
It would be so easy to bankcrupt a site that tried this (phone number generator, script) that no sane site owner would try it.
Maybe that's the point. s/he doesn't want to have to hide his e-mail address from the world.
>The most likely captcha technologies to win, I think, are the ones that require some amount of contextual knowledge about our world.
:)
The only problem is you could never automatically generate CAPTHAs like that because you need a human knowledge database. Which, again, can be learned by the bot; so the system is defeated. Logic implies that any test a computer could generate could always be solved by a computer, so no CAPTCHA technology will ever "win". Sorry
Comment removed based on user account deletion