Spammers Targeting Microsoft's Revised CAPTCHA

toomuchtoomuchspam writes "According to Websense, Microsoft's CAPTCHA has been busted again. CAPTCHA was surely a logical move for different service providers to fight against spammers, but it seems to be melting down. 'Realizing the potential for massive abuse from spammers with anti-CAPTCHA capabilities, who could use the clean IP reputation to carry out various attacks over Email and Web space, Microsoft attempted to increase the complexity of their CAPTCHA system. The CAPTCHA system was revised in an attempt to both prevent automatic registrations from computer programs or automated bots, and preserve CAPTCHA's usability and reliability. As this attack shows, those efforts have failed,' says Websense security researcher Prasad. Could there be any better CAPTCHA? A better solution?"

Comments

Key exchange.

[suck_burners_rice]

I suppose it would make sense if you had to make an exchange of keys with someone before initiating communication. Thus, when you give out your email to people, you could give them a key that they would need in order to send you an email, and similar methods would apply to other communication mechanisms. Now the spammers will need to waste inordinate amounts of computer time computing all kinds of keys, and the practice of spamming will (hopefully) disappear. Now this being /., someone will tell me why such a scheme is impossible. :-)

Re:Key exchange.

[TheSpoom]

Your post advocates a

(X) technical ( ) legislative ( ) market-based ( ) vigilante

approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

( ) Spammers can easily use it to harvest email addresses
(X) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
(X) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
(X) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business

Specifically, your plan fails to account for

( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
( ) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
(X) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
(X) Armies of worm riddled broadband-connected Windows boxes
(X) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
(X) Outlook

and the following philosophical objections may also apply:

( ) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
(X) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough

Furthermore, this is what I think about you:

(X) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your house down!

Re:Key exchange.

[collinstocks]

The scheme is not impossible, just impractical. Most (non-nerd) people cannot be bothered installing software to compute keys. Also, the amount of computing time necessary becomes negligible once you have enormous botnets, like the Russian mafia.

Re:Key exchange.

[AaronLawrence]

That form is amusing and enlightening for first-time proposals at solving spam. But as far as I can tell, it also rules out all solutions because it assumes there is a solution that doesn't have any cost or compromise.

The likely reality is that someone will have to pay or be inconvenienced to solve spam.

Re:Key exchange.

[TheSpoom]

The form doesn't assume there is a solution without cost or compromise.

It just assumes it's really, really easy to make fun of other ones. ;^)

Re:Key exchange.

[MrNaz]

Personally I think the form would be fine if you just took off the vigilante box. Spam can be solved by a few guys with a list of names, free air travel for a month and a box of bullets.

Re:Key exchange.

[denmarkw00t]

The likely reality is that someone will have to pay or be inconvenienced to solve spam.

Oh I know this one: The Spammers!

Re:Key exchange.

[MrNaz]

Cut it out with the finger pointing at China and Russia. The vast majority of spam comes from the US, initiated by US citizens. It's not "the Russians" at fault. Anyway, what is this? The 80s? The Mozlems are the new enemy, or didn't you get the memo?

http://www.spamhaus.org/rokso/index.lasso

Re:Key exchange.

[WK2]

I suppose it would make sense if you had to make an exchange of keys with someone before initiating communication. Thus, when you give out your email to people, you could give them a key that they would need in order to send you an email

What you described is called, "only giving your email to people you trust." Except we call it an e-mail address, not a key. It is already available, and does not require any sort of special software other than an e-mail client. It is a good practice for most people. Unfortunately, it does not solve the problem for people who need to receive email from strangers, such as contractors.

Re:Key exchange.

[TheSpoom]

But as far as I can tell, it also rules out all solutions because it assumes there isn't a solution that doesn't have any cost or compromise.

There, fixed that for ya.

There, fixed that for ya.

Re:Key exchange.

[negRo_slim]

DEAREST ONE,
If by box of bullets you mean a fist and a roll of quarters, then sign-me-up.

Re:Key exchange.

[Anonymous Coward]

SpammerAssassin.org? What do we need to get this project off the ground?

Re:Key exchange.

[RiotingPacifist]

But as far as I can tell, it also rules out all solutions because it assumes there isn't a solution that doesn't have any cost or compromise.

There, fixed that for you.

There, fixed that for you.

There, fixed that for you both.

Re:Key exchange.

[supernova_hq]

Wow, that has to be the first link ever posted on slashdot that was inactive BEFORE being posted!

Re:Key exchange.

[humphrm]

I'm convinced that today's SPAM prevention methods used together (including end user*) is about as good as it's ever going to get.

* The most effective SPAM filter is a human, sitting in front of their e-mail client, deleting mail that they know is SPAM from the subject line.

I know it's annoying. But I think we're stuck with it.

Re:Key exchange.

[tubapro12]

Or just tell everyone to send you messages encrypted with X PGP key. Then when you get mail, if you can't read it after one decrypt, trash it.

Re:Key exchange.

[gnick]

Cut it out with the finger pointing at China and Russia. The vast majority of spam comes from the US, initiated by US citizens. It's not "the Russians" at fault. Anyway, what is this? The 80s?

I don't buy that. Accuse me of over-indulging on Kool-Aid if you must. Most spam streams out of America - That's no surprise. We've got a helluva lot of computers with broad-band access and clueless users who basically bend over and hand lube to zombie-lords.

I've seen cyber-intelligence numbers (disclaimer - collected by US intelligence) and they indicate pretty clearly that the bots are being controlled by people in Russia and China (Poland, Switzerland, and Holland house a surprising number too). Those people may be Russians, Chinese, Americans, whatever, but they're running their armies from overseas (relative to the US). I'm actually surprised fewer are operating out of Africa - It seems to be a relative safe-house.

It's not paranoia once you've got data supporting it. (Let me be the first to criticize myself for not supplying a link...)

Re:Key exchange.

[Iamthecheese]

There, I have fixed that for both of you.

Re:Key exchange.

[Iamthecheese]

There, I have fixed that for all of us.

Re:Key exchange.

[TheSpoom]

I fixed your mom last night.

Re:Key exchange.

[collinstocks]

Mod parent up funny!

You do know, of course, that the majority of spamming computers in the US are part of the botnets controlled by the Russian mafia, right [citation needed]?

Re:Key exchange.

[fuzzyfuzzyfungus]

While TheSpoom's criticism is largely correct, the nice thing about your key exchange notion is that, in combination with existing email signing and encryption techniques, it is essentially a minor extension to whitelisting. By whitelisting people's public keys you are, in effect(thanks to the magic of asymmetric key encryption), making it so that their private keys are the unforgeable and easy to revoke if stolen passwords to be able to send you email.

On the minus side, encryption and signing are far less common than they ought to be, and everybody's infatuation with webmail isn't helping, and all the usual whitelisting pitfalls apply; but it would otherwise work quite easily with changes only on your end.

Re:Key exchange.

[hairyfeet]

Well,the problem as I see it with the whole CAPTCHA thing is this: even if they manage to find a version of it that is so good that no bot can ever be built that can break it(considering how good some of these bots writers are that is doubtful) then the spammer can either use social engineering or good old cheap labor in countries where you can pay them pennies.

Of course they wouldn't even have to hire anyone with social engineering,just fill an old server with a bunch of porntube style clips(and get extra cash from link sharing) and have them prove they aren't a bot with a little cross side scripting. Then you have plenty of guys happy to do the work for you in exchange for a chance at getting some free pr0n. For extra efficiency you could have their answer "fail" the first couple of times so each user has to give you the answer to three or four CAPTCHAS for each entrance. If they don't want to go to thr trouble then they simply hire day laborers in third world countries and pay them a few pennies per CAPTCHA. I am sure there are still quite a few countries were the cost/benefit ratio of doing so would come out in the spammers favor.

So as long as the spammers can make money off of hErb@l V!@gra and other crappy spam schemes then they WILL find a way around it. Because as long as there are fools willing to part with their money there will be someone with no scruples who will be more than happy to take it from them. So I think in the long run it will be better if the effort was concentrated more on fighting botnets and getting rid of crappy domain registrars than making more and more difficult CAPTCHAS. Because it is getting to the point that some of them are so horribly screwed up that I as a human can't figure the damned things out.

Re:Key exchange.

[Anonymous Coward]

Where the fuck do you guys get these forms from?!

Re:Key exchange.

[SanityInAnarchy]

First of all, stop calling it SPAM. It's not an acronym -- it's just named after the actual meat, used in a certain context.

But more importantly...

The most effective SPAM filter is a human, sitting in front of their e-mail client, deleting mail that they know is SPAM from the subject line.

Incorrect.

Firstly, I don't know about the rest of you, but I get far too much spam to read every subject line. It's already impractical, and getting to where it would be physically impossible without hiring people to read my email for me.

But also, a human is not necessarily the most accurate filter:

http://www.paulgraham.com/wsy.html

Granted, if you actually read every single email, rather than skimming through subject lines, you'd have a shot. But it's impractical, at this point, for me to even read subject lines. It's impossible for me to actually read the text of every single email.

In fact, that's why I use Bogofilter -- it's somewhat of a hybrid, that way. It uses reasonably sophisticated techniques to categorize spam, but it has an additional classification of "unsure". Last I checked, on any given day, I was getting maybe ten "unsure" messages to a hundred actual spams. There are quite often some false positives in unsure, and some that I'm not sure about myself. Most of it is spam, and I retrain it as such.

Net result: Roughly one or two messages per day make it through, and those come through Ruby Talk. Maybe once or twice a month, something will actually hit my inbox directly. And as far as I know, I've never had a false positive.

Re:Key exchange.

[SanityInAnarchy]

ctrl+c. ctrl+v.

Or you can find the definitive version here.

Re:Key exchange.

[Anonymous Coward]

I believe the link I posted, in the comment to which you are actually replying, suggests otherwise. The number one spammer on the Spamhaus lists is a US citizen who uses Chinese servers to control his botnet.

I assumed that people would read the link I posed before replying. How silly of me.

Re:Key exchange.

[SanityInAnarchy]

Yeah, I used to think that was a good idea...

Your post advocates a

(X) technical ( ) legislative ( ) market-based ( ) vigilante

approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

( ) Spammers can easily use it to harvest email addresses
(X) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
(X) Users of email will not put up with it
( ) Microsoft will not put up with it
(X) The police will not put up with it
( ) Requires too much cooperation from spammers
(X) Requires immediate total cooperation from everybody at once
(X) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business

Specifically, your plan fails to account for

( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
(X) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
(X) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
(X) Bandwidth costs that are unaffected by client filtering
(X) Outlook

and the following philosophical objections may also apply:

(X) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
(X) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough

Furthermore, this is what I think about you:

(X) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!

Re:Key exchange.

[MacDork]

I suppose it would make sense if you had to make an exchange of keys with someone before initiating communication. Thus, when you give out your email to people, you could give them a key that they would need in order to send you an email, and similar methods would apply to other communication mechanisms. Now the spammers will need to waste inordinate amounts of computer time computing all kinds of keys, and the practice of spamming will (hopefully) disappear. Now this being /., someone will tell me why such a scheme is impossible. :-)

It already exists. It's called S/Mime. You can learn how to use it here and here. It not only provides you with a way for receivers to know your mail is authentic, but it also allows you to send secure email if you have an S/Mime key for the receiver. (And you'll get their key the first time they sign their message to provide authenticity to you) It's like SSL for email. The major problem is that it is not pre-installed by default and most of the under-30 crowd uses web mail, therefore no one can be bothered to use it.

Re:Key exchange.

[gnick]

I believe the link I posted, in the comment to which you are actually replying, suggests otherwise. The number one spammer on the Spamhaus lists is a US citizen who uses Chinese servers to control his botnet.

I assumed that people would read the link I posed before replying. How silly of me.

You're correct. In the (alphabetically sorted) list you linked to, the #1 spammer is an American.

[But, using the same system, Americans only rank 2nd between Africans, Americans, Chinese, and Russians.]

But, with such credible and specific identifiers as "Alex Blood", "Bubba Catts", "Canadian Pharmacy", "emailspidereasy.com", "fairgamemail.us", "HerbalKing", "JingJing Wang", "MailTrain", "pur", "Stilbox Marketing", "Taiwan Media Ltd", "Trey Armstrong, the Flag Spammer", "Uncaged Marketing", "Yambo Financials", and "zombies", how could I possibly question the actual countries of origin of your link's sources?

Re:Key exchange.

[Anonymous Coward]

A Microsoft application that doesn't work as advertised, even after applying multiple updates that seemingly do nothing but patch one security hole by opening up two others.

This doesn't even sound possible.

I say BS. Nothing but pure anti-MS propaganda.

Re:Key exchange.

[Tubal-Cain]

The Form has already accounted for this:

(X) No one will be able to find the guy or collect the money
(X) The police will not put up with it
(X) Anyone could anonymously destroy anyone else's career or business
(X) Laws expressly prohibiting it
(X) Jurisdictional problems
(X) Feel-good measures do nothing to solve the problem
(X) Killing them that way is not slow and painful enough

Re:Key exchange.

[Tubal-Cain]

I googled "spam form letter" and got this

Re:Key exchange.

[Antique Geekmeister]

No, it can't. Those people with 'a box of bullets' will hit innocent people with hijacked machines, and do you think your average 'vigilante' is prepared to take on the Russian mob, or Nigerian mail fraud practicioners with hooks into local corrupt police and use ill-gotten money to trade in credit cards and passports stolen from suckers who go there to collect their 'inherited money'? All of the spammers are crooks, but some of them are dangerous crooks making a bit of trade on the side just because it's there.

Re:Key exchange.

[Antique Geekmeister]

No, the most effective spam filter is CRM114, at http://crm114.sourceforge.net/. By training it to individual tastes, it's better than an average user detecting spam. It's just computationally a bit expensive, and awkward to set up.

The results are quite impressive, though.

Re:Key exchange.

[plasmacutter]

*dunce cap*

let me know when theyre telling me how to make my penis bigger in cyrillic or mandarin calligraphy

Re:Key exchange.

[johannesg]

Stop that or I will "fix" all of you... With a blunt knife.

Re:Key exchange.

[johannesg]

Why not cut it down to this:

"Your post advocates

[x] a solution

to the problem of spam. It won't work, because

[x] I am a spammer myself and I want to instill a sense of hopelessness in people
[x] I only care about problems, not solutions
[x] any solution that covers less than 100% of all cases is unacceptable to me
[x] I like spam"

Your post surely applies to the antispam measures taken by my provider, but between them they keep my mailbox pretty much free of unwanted messages. And by posting this every time any kind of potential solution is discussed, you are ruling out the possibility of a solution altogether.

Re:Key exchange.

[kesuki]

"What do we need to get this project off the ground?"

first, you need to weed out the pansies who say 'killing people, for trying to make a living sending commercial e-mail, that's horrible'

secondly, you need a large budget and specialized training in invading hostile territory and killing possibly armed men in ambushes and guerrilla tactics. remember not all spam originates from the united states.

since you'll never get both of the above, you're left with technical and legal counter measures... which ultimately just doesn't work.

how many times have you gotten a call from a telemarketer? during dinner? there are (or were) laws against machine dialing apparatus here in the USA, but then some wiener designed a computer modem, and the downfall was quick, it was now quick and easy to use stock parts to auto dial and even give people pre-recorded messages over telephone.

spam ultimately is suffering the problem that much to the technology involved has substantial other uses besides spamming, so spammers get free reign. captchas did make a difference in the arms race. for a while. but now captchas are obsolete. they don't work they can't be fixed, and you're never going to get a really good test for determining a human from a bot..

simple distorted words aren't good enough, what you need to do, is switch to something humans are insanely good at that machines can't even be coded for. puns and homonyms. so basically what you wind up with is say a paragraph of text, with a single sentence response from the end user.

but even this will wind up getting cracked, unless you come up with a way of distorting the paragraphs slightly without changing the response from users, so they can't just match the paragraph to the answer... but this is a lot of work, to get a sophisticated captcha system based on a database of giving one paragraph of text and expecting a one line response that is obvious to a human but not to bot and reuse them but always with something different done to the paragraph. and even with such a hard test, the free porn sites give free access to a porn site for answering 5 captchas, teenagers have a lot of hormones and loads of free time...

i know microsoft and yahoo and google don't like the fact that spam originates from their networks, because spammers broke their captchas... but the problem isn't going away. there is no way to make it better. compuserve tried to curtail spam by having 'electronic postage' on sending e-mail, compuserve eventually went under. but electronic postage is realistically the only way spam will ever be controllable without killing all the spammers, because if it costs $0.15 cents per e-mail recipient they're going to suddenly get very good at figuring out who responds to spam. just like bulk mail comes to people based on information companies can find out about them.

and there are countless people who would be angry at paying to e-mail people. so it's not going to happen.

Re:Key exchange.

[Anonymous Coward]

Well, if spams still exists, it is because nobody has ever found a solution; perhaps that is why that form rules out all previous solutions...

Re:Key exchange.

[Squeeonline]

Wow, that has to be the first link ever posted on slashdot that was inactive BEFORE being posted!

maybe not all that inactive. I get a 403 error (You don't have permission to access / on this server) So does something have to be there or is that something else?

Re:Key exchange.

[supernova_hq]

Huh, now I get a 403, but when I posted my first comment it was a DNS error. I guess someone on slashdot just bought themselves a domain name. ;)

Re:Key exchange.

[Anonymous Coward]

That's not what she said.

Re:Key exchange.

[Anonymous Coward]

There is a far simpler solution, Simply put on it a equation part, so you have a simple type the caracters, followed by a sum, e.g. round(((36^2) - 4)/2). It would take a good programmer to get around taking all the permutations possible and producing a sum. Get the sum wrong and you have to enter a new text symbol, which will randomly change the text box postion dependant on the answer from the sum, so you have 10 postions to put the text, and you use the sum to locate the postion of the entry. if someone is good enough to figure the logic to take all the permutions of maths symbols then they deserve all the free email accounts they want. Its a good thing I don't run the security on these sites!

Re:Key exchange.

[Jedi Alec]

If we can't do it for real, can we at least grab the source for jagged alliance 2 and use that to create a spammer assassin game? Would be soooooo much fun :P

Re:Key exchange.

[Anonymous Coward]

The likely reality is that someone will have to pay or be inconvenienced to solve spam.

Indeed. And given that, it's absolutely fair to ask whether the price and/or inconvenience caused by the solution is worse than the price and/or inconvenience caused by spam.

(Of course, you're not entirely correct: arguments like "it won't work because it requires immediate total cooperation from everyone" are certainly sound per se. They may or may not be applicable to any given proposal, but when they are, it's hard to just brush them aside like you did; you're essentially appealing to fairness, but sometimes, life itself is unfair. What are you going to do about it?)

Re:Key exchange.

[EdIII]

There IS an EXTREMELY simple technical solution to this very problem.

First let's define the problem:

1) Spammers desire the ability to send their messages through Microsoft's systems since the IP addresses are so clean and therefore usually possess a higher level of trust with remote MTA's.
2) Microsoft, like others, has its head up its ass on how to solve it.
3) Microsoft has determined the best method to stop it is to determine if it is a person, or a machine at the other end.

The solution is simple:

1) Limit the amount of new accounts that can be opened up at any single IP address within a 24 hour period. This need not be implemented blindly either. You can decide which IP blocks are the most problematic based on experience, and which of those generate the least amount of SPAM associated with a signup IP address. If the limit is reached, simply inform the user that new signups cannot be processed at this time, from that location.

2) Once an email account has been newly created, limit the number of email messages that can be sent within certain time periods. Slowly ramp up the number of messages. Most normal people do not need to send more than 100 emails per hour. If you think about it, that number itself is incredibly impressive. That is nearly 2 emails being constructed per minute. Now it might be important for this person to inform a large number of people that they have a new email address. Fine. Create a special email message that contains text that the USER CANNOT MODIFY that can be sent up to 50 contacts at a time. It MUST be a contact added to the address book as well.

2.B) To further the goal of #2, limit the number of CC and BCC destination addresses. Of course, you could simplify this further by a global limit on all parseable addresses present within the message. Slowly ramp up that number as well.

2.C) To also further the goal of #2, limit the rate at which new messages can be sent. Set a minimum of 120 seconds before new message creation windows can be spawned and to which also respond to the SENT button. This number can be slowly decreased as well.

3) INVESTIGATE reports of SPAM and agressively analyze which accounts are responsible, what IP address space is the most responsible for the signups, what IP address space is the most responsible for the message creation, and then UTILIZE that information accordingly.

You see it really is not all that hard to implement some of these simple policies right now. To do so would put serious speed bumps in place for the spammers right now. I dare say it could reduce the amount of spam by 90% in the first 48 hours. Probably more, since the real problem is THOUSANDS of SPAM messages being sent from these bogus accounts within the first few hours, or days of their creation.

That activity DOES NOT FIT THE PROFILE OF A NORMAL HUMAN BEING. You don't need a CAPTCHA to figure that out. So it is not nearly as bleak or impossible as you make out to be. At least not in the IT department. However, where the marketing execs and other useless suits get together they just plain don't give a fuck.

Re:Key exchange.

[Anonymous Coward]

And by posting this every time any kind of potential solution is discussed, you are ruling out the possibility of a solution altogether.

Wow. Who knew that Slashdot comments had such power!

Re:Key exchange.

[RegularFry]

Unfortunately, this plan falls down at 1 purely through the existence of botnets. They are geographically diverse, across exactly the sort of IP spaces that MS want to have access to their service - home Windows installs.

Without 1, the rest of the plan falls apart. There's no point limiting the number of email addresses per time period if you've got the ability to sign up 20,000 accounts at once, so 2 falls. The number of spams per account can be small, so 3 falls.

This is a hard problem. Fortunately, there are ways of turning it to general advantage, like using CAPTCHA results to tune OCR for scanning old texts.

Re:Key exchange.

[EdIII]

Actually you are wrong. What you are saying has a certain logic to it, that is true, but you just don't have the numbers right.

1) Botnets are irrelevant. It is just an issue of IP addresses, pure and simple. Whether or not the signup is a zombie or a real person, the number is limited. The REAL issue is if the policy would prevent the signups of legitimate people. That is doubtful since most people tend not to have more than 10 different email accounts at one provider. I would say the *average* is far less than that. Legitimate signups just don't occur that frequently from an IP address that is being used in a normal way.

2) Remember what I said about linking abused accounts with their signup IP address and then analyzing that information? You could apply that to "throttle" the number of accounts that are created from an IP address period. The behavior of a zombie would stand out over a relatively short period of time.

3) Let's assume that they can still create 20,000 accounts per day from a single botnet. We can assume further, even with initial throttling present, that 100,000 messages are sent out the first hour. Believe it or not, that is far less than CURRENT numbers. A significant improvement considering that current estimates are in the double digit BILLIONS per day (with estimates as high as 150 billion). Now Microsoft cannot be responsible for all of that of course, but once again limiting their contribution to 2.4 million SPAM messages per day would seem to be an improvement considering the actual numbers here.

4) The effectiveness of analyzing the behavior of the IP address spaces would be quite high. Over time, you would could determine with a high degree of accuracy which IP addresses are currently participating in a Botnet, and which are not. Forward that information to other security research firms which are currently attempting to penetrate and analyze botnets.

5) Behavior analysis can let you determine which IP addresses need to be throttled more than others. Let's assume that you identified 100 million *confirmed* SPAM messages from those 20,000 accounts within the period of just a week. Of those accounts which do you think would have 99% SPAM in the outbox? More information to act on. Now you can remove those accounts, and then start to add weights to those IP addresses. Now they can only create new accounts at 1/5th the normal rate. Then 1/10th the normal rate, and so on and so forth.

The real problem here is not whether or not these policies will work, it is the management at Microsoft. They will never spend the resources to implement this.

Why should they? They KNOW they are so big that mail administrators such as myself just CANNOT AFFORD to blacklist their domains and IP addresses. To do so would be suicide in our business. Considering the amount of SPAM coming from Microsoft, Google, and Yahoo you don't find it suspicious that SpamHaus does not blacklist them?

There is your problem. We HAVE to accept email from the 3 biggest players PERIOD. The only thing we can do is apply filtering to the message content itself and hope that we are good enough to get the majority of it into your junk mail folder.

You want something more nefarious? More devious? Think about whether or not Microsoft relies on the number of email accounts it has, and how many signups occur per month, when dealing with it's advertising clients? The bottom line at Microsoft, is in part, affected by the current and projected number of email accounts it has. SPAM can actually be helping their bottom line and stock price here, not hurting it.

Re:Key exchange.

[tacocat]

I think most people who really live with these problems have the same general approach to the solution. Change the cost structure of email.

Today I can emit email ad infinitum and it is all delivered to someone else and therefore becomes someone elses problem. So the fix is to keep the ownership of the problem at the source. Something like RSS.

Essentially the problem becomes one wherein if I want to deliver email to someone I have to queue up delivery of that email on my system and send them a notification that there is email for them. This notification key is used to pull email messages from my server to your client/server environment.

Now I have to arrange for storing all my spam and images and malware and you have to store... essentially nothing. The amount of content retained versus delivered has a ratio of 100:1 so a million emails is more my problem then yours. And if I don't want to collect that email -- you still have to retain it on your system until you want to expire it as undeliverable.

But how long is a spammer going to actually store their own content? They can't do it on p0wned machines. Wherever they store it, they leave a signature.

The only down side to this is that this will make privacy a joke. Marketing should love this idea as every email becomes embedded with web bugs to let the Marketing department know exactly who and when email is received by the customer.

This has been mentioned by quite a number of people out there. I'm not sure how they would solve the problem of initial delivery. My only thought is to continue using email as a deliver mechanism, but to only deliver the URL indicating the message location on the internet for you to receive. Once received, you can store it on your local mail server as if it was really email.

At least that's a cut-over. Long term something new needs to be designed. And I hope the answer isn't MySpace.

Re:Key exchange.

[MrAngryForNoReason]

* The most effective SPAM filter is a human, sitting in front of their e-mail client, deleting mail that they know is SPAM from the subject line.

I pretty much never see any SPAM because the host I use has Mail Foundry SPAM filtering appliances in front of the email server. It does occasionally block legitimate email marketing such as Amazon special offer emails and the like. But as it send you an email with a list of anything it isn't sure about it is easy to have them sent on through.

According to their website they analyse SPAM in real time so if someone sends 10 million almost identical messages about Viagra they will notice and tell all of the Mail Foundry appliances to block anything that matches that email exactly.

The idea is that instead of trying to train your filters to recognize any SPAM you tell them to block the SPAM that is actually being sent that day.

It seems to work very well but I would imagine that the wider the adoption of the system becomes the more likely it is that someone will come up with a way to beat it.

(I am not in any way affiliated with Mail Foundry, just seems to work for us.)

Re:Key exchange.

[houghi]

Hello,

I am a veteran mercenary of the civil war in Nigeria and heard of your problems with spammers. I have worked out a way to solve this. I will just shoot them dead in the head. I will see to it that any financial loss ddone to you is payed in full in your bank account.

Please just give me your bank details, social security number and details and I will see that you get your money and I will see that you will not recieve any spam from that person again.

Re:Key exchange.

[Anonymous Coward]

Well, there are other points of interest where checks and balances can be inserted into the system.

For instance, who said that a server has to grab a message and not make sure that it's not spam before being sent?

If Microsoft/google/established-company-who-doesn't-want-to-host-the-spam want to stop people from using their servers for spam, then the SMTP server must check the messages being sent and stop/block/kick spammers before they forward it onwards.

Probably something simple to start with, as in if someone tries to send to more than 20 people, or more than 10 messages per hour.

Wish there was a way to guarantee that the person isn't a spammer, but unless the person videoconferences into the site to verify name/face/identity, you can't really make sure, and you'd need a face-recognition software and human oversight to make sure that the same person isn't checking in with fake glasses and different mustaches.

Also, even if you do have a real user, his account might be stolen and used for spam.

So, only way to stop it is to put pre-emptive spam checks between the sender and the server before the server sends it out.

Re:Key exchange.

[FictionPimp]

My solution is simple. Start sending spam yourself. The only way to fix it is to make email so unusable that it is abandoned, then replaced with a more secure, if more annoying to use, system.

Re:Key exchange.

[Anonymous Coward]

So i should store anough information on my computer to satisfy the ID requirements for a micropayment system. /facepalm

Though i am sure a the local goverment might enjoy yet another online revenue source to tax.

Re:Key exchange.

[Anonymous Coward]

But as far as I can tell, it also rules out all solutions because it assumes there isn't a solution that doesn't have any cost or compromise.

There, fixed that for you.

There, fixed that for you.

Their, foxed vat four ewe.

Re:Key exchange.

[meyekul]

Yeah that would work for postal mail too, if only there was a fee per letter I wouldn't get so many credit card offers and sales papers in my mailbox every day... It MIGHT serve to at least increase the quality of spam above the random gibberish about penis enhancers or cheap prescription drugs that I get now. Besides, what you're talking about is impossible to do. If I set up my own e-mail server and use it to send encrypted messages to your own e-mail server, who's in the middle to keep track of the bill?

Re:Key exchange.

[pacinpm]

the free porn sites give free access to a porn site for answering 5 captchas

Really? Can you prove it with a link?

Re:Key exchange.

[MrNaz]

(X) No one will be able to find the guy or collect the money

Hire good enough PIs, we'll find the guy. And collect all his money too.

(X) The police will not put up with it

Get geeky cops to explain it to the rest of them.

(X) Anyone could anonymously destroy anyone else's career or business

No, they'd be dead, so their business would be left in tact for their next of kin who would now be less inclined to spam.

(X) Laws expressly prohibiting it

Just get George Bush to declare a War on Spam.

(X) Jurisdictional problems

A *global* War on Spam.

(X) Feel-good measures do nothing to solve the problem

Eh? How is a dead spammer not a solution to the problem?

(X) Killing them that way is not slow and painful enough

Hire the members of the Russian mafia who *don't* spam to help on that one.

Re:Key exchange.

[mapsjanhere]

The fun part is, I have a hotmail account which I use for "risky sign-ups". Despite of years of use as "catch-all" address it only gets one kind of spam - cyrillic. I wish I could reply and tell them I can't read that, please send in English so I can do something about my inequities.

Re:Key exchange.

[Fjan11]

There is also a perfectly legal way to get the spammers. First of all it's relatively easy to find spammers, since almost all there services entail a money transfer of some kind. Then just sue the bastards.

The main reason this does not work at the moment is that the crime/offense crosses so many different jurisdictions. However, we managed to solve that problem for a lot of other crimes through the UN, so there is no reason why we could not set up an "international internet criminal" court like the one in The Hague.

Re:Key exchange.

[Anonymous Coward]

Spam as in the meat is all capitals...
http://images.google.com/images?q=spam%20meat&ie=UTF-8&oe=utf-8&um=1&sa=N&tab=wi

Re:Key exchange.

[ianare]

The official SPAM site has it all caps as well.

Re:Key exchange.

[hesaigo999ca]

I still don't understand why we haven't come out with a password when you give out your business card.
The person sends me an email, my email client would get the email but before inserting into the server, would read the password which is in the subject or body, no password, no entry on the exchange server. I imagine any emails that don't contain the proper password could still be kept in a separate folder which gets deleted at the end of the day or something, but I do agree it would take everybody all at once to implement this to make it work.

Re:Key exchange.

[jebrew]

Stop that or I will "fix" all of you... With a spoon.

FTFY

Re:Key exchange.

[Lincolnshire Poacher]

> * The most effective SPAM filter is a human, sitting in front of their e-mail client, deleting mail that they know is SPAM from the subject line.

I would contend that the most effective spam solution is BEING CAREFUL with your e-mail ``intellectual property''.

Never, ever give-out your primary e-mail account address. Instead treat it as a private root node. Anchored from this node, create an alias for each context that requires an address. Once the lifetime of that context has expired, delete the alias.

I have never received a single piece of spam in my personal account. No spam filters or grey-listing or scoring; just caution.

Re:Key exchange.

[I'm not really here]

You, sir, scare me. Please never go to the dark side!

Re:Key exchange.

[I'm not really here]

SPAM is the meat. Spam is the email problem (there have actually been lawsuits about this). SPAM either stands for Spiced Ham (the original name of the product was Hormel Spiced Ham), or, if we believe the recorded Hormel official's statement, it could be an acronym for: "Shoulder of Pork And haM"

Re:Key exchange.

[I'm not really here]

I was getting 3000+ spam messages a month for a personal email address that I had never signed up for anything (they obviously used a dictionary attack, as the address was simply my last name @ my email provider). I gave up and started using it online for convenience. I get about the same amount of spam now as I did before (actually, a little less now), so... meh.

Your mileage may vary.

Re:Key exchange.

[I'm not really here]

Google Translate?

Re:Key exchange.

[I'm not really here]

Except that a key cannot be dictionary attacked. An email address often can. --Sheesh! I had to go to lunch and come back to be able to post this one!

Re:Key exchange.

[Tanktalus]

There is your problem. We HAVE to accept email from the 3 biggest players PERIOD.

What if ... you didn't have to? I know, I know, you said you "CANNOT AFFORD to blacklist" them. But that's just because too many people have email accounts with them.

I'm thinking of someone *ahem* taking the bulk of your post as evidence why MS is *about* to be blacklisted by most ISPs in the world (omitting the part where you say why you can't do this), and emailing it to all their friends with a subject of "WARNING! Hotmail to be blacklisted!" (maybe a few more exclamation points), and encouraging everyone to get another email account before it's too late, and PLEASE forward to all their friends who may know anyone on hotmail to be sure everyone gets the message before their emails get blocked!

Once you see the incoming traffic from hotmail slow to a trickle other than spam, you should have no trouble blacklisting them. :-)

Re:Key exchange.

[Nethead]

...but then some wiener designed a computer modem, and the downfall was quick, it was now quick and easy to use stock parts to auto dial and even give people pre-recorded messages over telephone.

Actually we used a Commodore 64 and a Code-a-Phone where we added two 6522 on the expansion port to replace the outputs of the 8048 MCU in the answering machine. (wygant.com)

Re:Key exchange.

[Anonymous Coward]

Vigilante works for me. Another charity to give $ to. Is $100 enough to start? http://spammerassassin.org/ is not working, do you have a good address?

Re:Key exchange.

[jonbryce]

The problem with puns and homonyms is that they don't translate well

Re:Key exchange.

[jonbryce]

There's two problems here. Firstly, botnets, which give spammers control of a lot of IP addresses, and secondly ISPs that give you a NAT based connection - like AOL and most cellphone connections. They will have lots of customers signing up for hotmail accounts through the same NAT router.

I think you will probably find that they already limit the number of emails people can sent. That's why they need to sign up for new accounts. And if they trace the spam back to a botnet, or someone who claims to be infected with botnet software, there isn't much they can do.

Re:Key exchange.

[Anonymous Coward]

"The REAL issue is if the policy would prevent the signups of legitimate people. That is doubtful since most people tend not to have more than 10 different email accounts at one provider. I would say the *average* is far less than that. Legitimate signups just don't occur that frequently from an IP address that is being used in a normal way."

just to example one real world example, i was signing up for 5 or 6 new e-mails a day to create new slashdot accounts to post replys to a discussion of a foe of mine who was censoring me on the basis of simply not liking me or the fact that i can think outside accepted norms of society. in other words the person thought i was a sociopath and didn't want me posting in her journals, but i was in the middle of a few discussions with people about philosophy etc, and in her journals. and it's really hard to reply to a post when you've been blocked by being foed. i only did it for a week, by then all my replies had been answered or my positions defended...

but i did sign up with yahoo for about 20-30 accounts in the span of one week. that having been said, it's ridiculous that a person or a bot can sign up for dozens even hundreds of accounts a day.

Re:Key exchange.

[Tubal-Cain]

(X) Anyone could anonymously destroy anyone else's career or business

No, they'd be dead, so their business would be left in tact for their next of kin who would now be less inclined to spam.

Being dead certainly hurts one's career, though.

Re:Key exchange.

[MrNaz]

Not for Elvis or Tupac.

Re:Key exchange.

[TheSpoom]

I see you've played knifey spooney before!

Re:Key exchange.

[Anonymous Coward]

I would use snail mail and an enclosed flash drive to provide the key. And therefore, the key would not be distributed as you envisaged.

Sadly, I find that small minds have small vocabularies (No need to use assh0le, or other anatomical phrases).

Akismet

[TheSpoom]

Akismet is great for comments and such. Basically, it's a neural net using user submissions to determine whether or not a submission (sent automatically from your site for checking) is spam or not.

Re:Akismet

[Anonymous Coward]

Akismet is useful but it has its limitations.
* works only for public or non-sensitive stuff, because it involves sending entire messages (including sender's IP and email address) to a central server
* it doesn't pick up on new spammers fast enough. I've had a wave of my.mashable.com comment spam recently, they all looked very much the same but Akismet didn't complain. Yes, I submitted them as spam. After two days I was tired of waiting for Akismet and added an extra filter.

Basically, it's a neural net

I don't think so. Just some Bayesian filtering. Actually it's as closed as can be. They won't tell how it works except that they use "hundreds of tests", "dozens of factors", "weighing and clustering" and some "secret sauce". The boss seems to have some ego issues that make him use that sauce for personal vendetta as well.

Re:Akismet

[Anonymous Coward]

[X] It kills "In Soviet Russia" jokes and most of Slashdot posts.

Re:Akismet

[spinkham]

This is also why gmail, Cloudmark, and other hosted spam filtering works so well. Spam filtering works better as the number of inputs grows, and it is the ideal candidate for outsourcing.
On the other hand, email tends to have sensitive information in it, and outsourcing is a little scary.
It's always a trade off..

Re:Akismet

[Anonymous Coward]

Akismet is yet another failure in a long, long list, because last time I checked they didn't *report* spam.

Captchas are no longer good enough

[AaronLawrence]

It seems that the time when Captchas were an effective way to protect valuable resources is over. Where valuable means "anything of more than a tiny value that is available in large numbers". One email account isn't of value, but a million mail accounts is worth a lot to a spammer, and it's just as easy to get a million automatically as it is to get one.

Frankly, modern captchas are often past the point where I can read them; and the image recognition programs are good enough to get a useful correct recognition rate. This tells us that captcha is a dead end, AI in the form of image processing is now about the same "intelligence" as a human, so there is nowhere for captchas to go.

What to do instead? Well, looking at that report, the bot signup surely looks recognisable - the same IP constantly trying to sign up? But maybe big NAT networks mean that "same IP" isn't a safe bet to block?

If you can't recognise the bot, and it can answer simple questions as well as a human, then the only thing left is to provide another form of identification - like a real-life physical ID.

Re:Captchas are no longer good enough

[zobier]

Real-life physical ID is not accessible. If you have to show up somewhere in person this is infeasible. If you have a hotline to call for access codes you're going to have to provide a TTY alternative -- easy enough to create a TTY bot. It ceases to be Completely Automated at this point anyway.

Foolproof CAPTCHA is an impossibility, you would need true AI at which point it would be self-defeating.

Not to mention the pr0n hole (people solving CAPTCHA for you, for free, by proxy).

Re:Captchas are no longer good enough

[AaronLawrence]

I agree all these things are difficult. So what solution do you suggest?

Re:Captchas are no longer good enough

[Miamicanes]

> I agree all these things are difficult. So what solution do you suggest?

I personally applied a multi-pronged approach, and my spam problem has been negligible for YEARS.

1) Everyone I give my email address to is given a different alias, in the form 'myname-alias.validation@mydomain.com'. 'validation' is basically the hash of the salted alias, with different salting recipes for different pattern-matches just to make life difficult for spammers. In theory I could generate the aliases by hand, but I wrote a program that runs on my HTC Touch to generate them for me as necessary. Anything sent to 'myname@mydomain.com' automatically bounces with message to go to my website and obtain an alias to use for contacting me. Ditto, for the first message addressed to a given 'alias' whose 'validation' is invalid (thereafter they're unceremoniously sent to /dev/null).

2) I wrote an app to generate time-limited aliases in the form 'myname-yyyymmdd.validation@mydomain.com', but for now it ended up being gross overkill since nobody has ever tried reverse-engineering it so I just automatically accept all incoming mail sent to 'myname-yyyymmdd@mydomain.net' (where 'yyyymmdd' is today's date, or at least a date within the past week or so). But if spammers ever caught on, the generator app goes back up, and the rules get tightened.

Aside from the fact that some people and businesses get seriously weirded out when they're told to email you at 'myusername-theircompanyname.longhexstring@mydomain.org', it works BRILLIANTLY. How brilliantly? On a typical day, procmail chucks, bounces, or otherwise blackholes about 18,000 to 25,000 spam emails addressed to an outright nonexistent address, roughly 8,000-12,000 spams addressed to an alias that fell into spammer hands, and maybe a half-dozen that are in the right form, but have an invalid hashcode (they get sent to another account on the server that I check occasionally). Every few days, I have to spend a couple of minutes adding another blackhole rule to .procmailrc, but I've never really had enough to make it worth my time to actually write an administration program to manage it for me.

Would this work for Joe Sixpack or Sally Soccermom? Of course not. They have a hard enough time keeping one email address at aol.com straight, let alone generating salty-checksum-validated adhoc aliases unique to everyone who emails them (and every website that extorts their email address, etc). But for the world's Slashdot Elite, it's a nice, elegant solution (as long as you've got your own domain name or ten and have either a dedicated server or a hosting account somewhere with shell and script access so you can run Procmail. My email has gone from "worthless due to the avalanche of spam" to "for all intents and purposes, spam-free", and has stayed that way for almost six years now.

Re:Captchas are no longer good enough

[Miamicanes]

Oh, I forgot to mention... the fundamental reason why everyone who emails me is given a unique generated alias is to protect myself against trojans/worms/malware that might harvest the contents of a trusted friend's addressbook. If it happens (like to my dad 3 times already. Sigh. He's actually the reason I came up with this scheme... he kept getting my addresses harvested and ruining them forever), all I have to do is nuke that one specific alias, and tell that one person to use a different address to reach me at going forward. It's a lot easier to nuke an incoming address used by ONE person, and notify that ONE person if something changes, than it is to notify everyone (including banks, websites, etc) that they need to use a new address to reach you.

Re:Captchas are no longer good enough

[lysergic.acid]

requiring a physical ID for internet accounts is a bad idea.

i like the reCAPTCHA approach. if spammers want to abuse a reCAPTCHA system, at least they'll be making a positive contribution to society by helping to digitize printed literature. maybe Project Gutenberg or the Google Books Library Project can launch a reCAPTCHA service to put those botnets to good use. if you can't stop them, at least this helps to recover some utility from the problem.

there's also the issue of CAPTCHA porn and the related phenomena of outsourcing CAPTCHA solutions. as long as there are people willing to solve CAPTCHAs for porn, or money to feed their families, then no reverse turing test will ever be foolproof. so the best thing to do is to exploit this CAPTCHA-solving machinery.

why not make CAPTCHAs educational? instead of random words or random excerpts from books, make them arithmetic word problems, geometry proofs, SAT analogy questions, stoichiometry equations, spelling quizzes, etc. this way, the CAPTCHA solvers gain an education from their labors instead of just some cheap porn or a couple of bucks a day. and after solving CAPTCHAs for a few years, they'll be educated enough to land a real job and/or afford to pay for better porn.

this way you turn the spam problem into a way of educating horny teenagers and underprivileged poor in 3rd world countries.

Re:Captchas are no longer good enough

[a whoabot]

Don't spammer AIs for solving captchas usually have a high error rate? They are only useful for the spammers because they repeat after failure. Wouldn't that sort of make them useless for helping out recaptcha?

In fact, if those AIs were any good at identifying the text without error, then why wouldn't whoever is digitizing the texts just use them for the job?

Re:Captchas are no longer good enough

[vux984]

1) Everyone I give my email address to is given a different alias, in the form 'myname-alias.validation@mydomain.com'. 'validation' is basically the hash of the salted alias, with different salting recipes for different pattern-matches just to make life difficult for spammers.

Ok. So you effectively made the most complicated whitelist imaginable. Except instead of whitelisting your contacts, you've added a layer of indirection and whitelist a code your contacts must send you instead.

I've seen the same thing implemented many times before by giving each contact a passcode and requiring them to include it in the subject line of all correspondence. I do give you props for embedding it into the address instead of the subject line, as that will let you use it for automated systems, like websites that 'extort' an address, etc.

Aside from the fact that some people and businesses get seriously weirded out when they're told to email you at 'myusername-theircompanyname.longhexstring@mydomain.org', it works BRILLIANTLY.

Yes, if torpedoing usability was your goal. What happens when you send something to someone and they reply? Do they have to use your unique address to reply? What do you do when you need write an email address out or give it over the phone? goofball-yourdomain-a23fbf32a4e544303... good times. Or if someone forwards your message to a 3rd person to reply to you...

My email has gone from "worthless due to the avalanche of spam" to "for all intents and purposes, spam-free", and has stayed that way for almost six years now.

I manage the same with spamassassin, amavisd etc and a couple custom rules. And my mail server processes some 30,000 messages a day as well, for a business with half a dozen employees. We get maybe 8 or so spam through a day, and less than half a dozen false positives a month. (Most of which are due to other people sending from domains that publish SPA records and then don't follow what they've published...ie their own damned fault.)

But for the world's Slashdot Elite, it's a nice, elegant solution (as long as you've got your own domain name or ten and have either a dedicated server or a hosting account somewhere with shell and script access so you can run Procmail.

I wouldn't call it elegant. Clever yes, but not elegant.

Anything sent to 'myname@mydomain.com' automatically bounces with message to go to my website and obtain an alias to use for contacting me. Ditto, for the first message addressed to a given 'alias' whose 'validation' is invalid (thereafter they're unceremoniously sent to /dev/null).

Do you even score it for spam at all or do you just generate a lot of needless backscatter?

At the end of the day, I'm not really seeing the advantage of your solution over a moderately sophisticated white-listing + grey-listing solution.

Re:Captchas are no longer good enough

[RareButSeriousSideEf]

That's a good start, but I'm not convinced that simple automation is dead here. This doesn't seem that difficult to me. I've put up live forms that have invalidated 100% of bot submissions, even without CAPTCHA. Granted, impressions are only in the tens of thousands, but still, *combined* with CAPTCHA, a few simple principles ought to suffice, even against concerted, distributed attacks:

0) Obviously, limit submission attempts per session to a humanly achievable rate. Sticky session IDs can be packed into hidden form fields, query strings, cookies, etc.

1) Anything that's worth guarding with a CAPTCHA should require a modern browser (CSS, cookies, javascript, DHTML). In my experience, over half of attempts can be weeded out by using a segregated approach with cookies: user submits -> set some server-encrypted cookie value -> modify value in client-side js -> repost in client-side js -> inspect during next http post.

2) You can still provide accessibility accommodations; just make sure *all* form submissions have frequency limitations that increase in severity with every failed attempt in a single session. What you can't do in cookies or js can still be done in hidden form fields and query string params. For a surprising majority of submissions (i.e. modern browsers or bots trying to imitate them), the simple requirement of a compliant js VM to modify form/cookie/querystring variables before submitting rules out bots right away.

3) For the modern browser version of the form, add numerous honeypot fields; use modern browser techniques to hide them by overlaying them. Making the overlaying element distant from the real one in the DOM tree, and/or add the real element (or all of them, or half of them, or a random assortment) using DHTML.

4) Randomize the IDs & DOM location of both real and honeypot inputs (store a distinguishing hash code or the like in a hidden form field, cookie, or on the query string).

5) Include hidden honeypot CAPTCHA images as well. Observe step 4 here. Also, use large images containing multiple CAPTCHA phrases, and use CSS to crop the image.

6) Vary the obfuscation techniques used in CAPTCHAs, e.g., sometimes fuzzy match on "name the object in the picture" (duck, DUCK, Duck, goose, swan, bird ok, everything else fails), or sometimes use animated gifs and display the challenge progressively instead of in a single frame, or sometimes ask the question in the image and put the answer right there with it! (Cheesy, but that one alone takes most current bots out of the running.)

7) Values in hidden honeypot fields are almost certainly from bots. Ditto for correctly decoded honeypot CAPTCHAs. Log this fact, and record it in a required cookie or hidden form field.

Yes, this is security by obscurity, and it's technically far from foolproof. Still, I would venture that a combination of techniques like this would bring the vast majority of bots' success rates well below the usability threshold. It's not hard to add complexity to a system like this, either. Nor is it hard to accumulate increasingly useful clues as to whether a submission is likely to be human or not.

I need to shut up now; this simple rant is more than enough for a software patent nowadays. Speaking of which, if anyone wants to codify this "method and system of Turing challenge obfuscation," I hereby release the above description under the licensee's choice of either the BSD license, or the "do what the fuck you want" license. Cheers.

Re:Captchas are no longer good enough

[lysergic.acid]

they do use OCR for digitizing most books, but it costs processing cycles. there's only so much text that any given data center can process at a time.

but yea, i guess they usually pick the lower-quality or more distorted scans for reCAPTCHA. however, they don't just use a single challenge response to determine the correct text. i'm sure they go on the assumption that there will be lots of incorrect responses (either by poor bots or human error) and simply use statistical analysis to determine the correct text.

and if a particular client submits several incorrect responses in a row, the server can determine that it's a bot and ban the client's IP address. this way, the only bots that get through will be the ones with high accuracy rates.

Re:Captchas are no longer good enough

[kylemonger]

I'm not sure the "solve CAPTCHAs for free porn" idea would really work. There's so much free porn on the net already (available as gateway drugs for pay services) why would anyone jump through mental hoops for it?

Re:Captchas are no longer good enough

[SanityInAnarchy]

To which problem?

To spambots filling out HTML forms? For now, a few solutions:

WPoison (just because it actually wastes their resources if it works), probably disallowed by robots.txt, and probably setup to ban people who hit it too often.

Another interesting possibility is requiring Javascript, thus forcing the user to not only have an HTML engine (or a regex), but also a fully functional Javascript interpreter. Sure, they could target any one Javascript countermeasure, but they couldn't catch 'em all.

And to actual email spam in my inbox?

Probably both a tarpit (combined with banning people from the website) to cut down on bandwidth when I do catch one, and a statistical filter of some kind to help identify that.

Re:Captchas are no longer good enough

[Anonymous Coward]

maybe Project Gutenberg or the Google Books Library Project can launch a reCAPTCHA service to put those botnets to good use. if you can't stop them, at least this helps to recover some utility from the problem.

If you don't know the answer, then it does not work in the function of a protective captcha. The reCAPTCHA thing works because being wrong is an acceptable solution (within reason). Also, a million humans will see the same captcha a million different ways even if 90% get the same, correct answer. A million bots can see the same captcha the same way and be wrong 100% of the time. I'm sure AI is great for the project, but the AI being used to acquire free but costly to provide resources may not easily be exploited. Perhaps if you had a database of useful personal information and every good reCAPTCHA guess gave another piece of data...

Re:Captchas are no longer good enough

[Miamicanes]

>What happens when you send something to someone and they reply? Do they have to use your unique address to reply?

Yep. There's even a nice extension for Thunderbird ("Virtual Identity") that lets me send outgoing email with arbitrary return addressess (so if I'M the one initiating contact, I just generate the alias I want them to use to reply to me and use it as the return address so they can just hit 'reply'). Even better, Virtual Identity keeps track of what alias goes with what sender/recipient, so the NEXT time I go to send email to that person, Virtual Identity recognizes their email address and automatically changes the "reply-to" address to the adhoc alias I used the first time I sent email to them.

> What do you do when you need write an email address out or give it over the phone?
> goofball-yourdomain-a23fbf32a4e544303... good times.

Compared to the fun I have getting them to spell the domain name (Americanized spelling of Ukranian-Slovak-ish last name), it's really not a problem. I DO, however, have occasional problems with stupid websites that try to be too clever and filter out what THEY think are invalid characters for an email address. Nine times out of 10, it's a javascript validation script with braindamaged regex, and all I have to do to get past it is use Firebug to comment-out their wolf-calling sanity-checker and let it through to the server. Back when I ran my own mail server using Mercury for Win32, ITS primitive adhoc-alias support gave me lots of website grief, because IT used "+" instead of "-" to indicate the division between username and alias, and lots of stupid form-handling code treated "+" as if it were a HTML-encoded space character at the server end.

> Or if someone forwards your message to a 3rd person to reply to you...

In which case I now have two people using the alias to reach me, not one. It's still a vast improvement over having one address you have to guard with your life, and still accept the fact that SOMEONE is eventually going to get their addressbook harvested and compromise it anyway.

The nice thing about my strategy, vs SpamAssasin and Bayesian strategies is that as long as the sender gets the alias right, there's ZERO risk of a legit message getting spam-trapped. A tiny bit of extra work to set up that first email contact, but reliable communication every single time thereafter.

Re:Captchas are no longer good enough

[Miamicanes]

> I do give you props for embedding it into the address instead of the subject line, as that will let you use it for automated systems, like websites that 'extort' an address, etc.

Actually, I even came up with a "Plan B" solution to use someday if necessary... incorporating the alias into the domain name itself by wildcarding the DNS. For example, "myusername@hexcode.alias.mail.mydomain.org". I'd need a slightly-hacked copy of bind that resolved everything that's allegedly a subdomain of "mail.mydomain.net" to the same IP address and MX, but the general idea's the same.

Re:Captchas are no longer good enough

[Creepy Crawler]

And I'll just farm the captcha breaking to 3'rd worlders for .003$ per correct. Captcha takes the human element. I'll make an industry out of breaking it.

Re:Captchas are no longer good enough

[Miamicanes]

> Do you even score it for spam at all or do you just generate a lot of needless backscatter?
I don't bother scoring, just logging the alias to MySQL so another app called by Procmail will reply to the first incoming email addressed to the specific alias, and silently blackhole incoming mail sent to that alias thereafter regardless of where it comes from or from whom it's allegedly coming. The last time I checked, I had about 300 blacklisted aliases in the database. Compared to the ~20k spams per day that get unceremoniously blackholed, I'm really not worried about the 300 backscattered replies that were sent out the first time something was received at that alias. At roughly one or two per average week, there just aren't enough of them to bother caring about.

Re:Captchas are no longer good enough

[RareButSeriousSideEf]

True 'nuff; the approach would simply cut the probability of a bot/botnet passing through the CAPTCHA at a usable rate. No sophistimacated algae-rhythm that I know of yet will effectively distinguish between malicious and benign humans.

Oh, and nice sig by the way.

Re:Captchas are no longer good enough

[ralphdaugherty]

Good work in TFA documenting an attack. A critical piece is that the CAPTCHA image is sent off and an encrypted answer of eight letters returns in an average of six seconds.

      Most replies in all of these CAPTCHA /. threads assume the image is being decoded by computer (i.e., OCR), therefore suggest supposedly harder tests for a computer to solve as a solution (although most suggestions are actually easier).

      There is a possibility of that going on, but more likely the images are being transmitted to humans to decode. I don't know for sure, but I've never seen one post ever that gave any good indication it was OCR being used, and plenty of known situations where humans are decoding it.

      So for the case where OCR is actually being used, some of the characters in each image need to physically overlap to break OCR. But if humans are decoding, then obviously they can do what we can do, so just overlap the CAPTCHA characters to make OCR impossible and forget about all the other exotic suggestions.

      In the case of phpBB (forum software I use), the CAPTCHA's don't overlap but the image is displayed embedded in the web page via CSS (as far as I can tell) so the whole page would have to be transmitted back for decoding versus an image file as from Hotmail's process. Not that that solves anything, but at least make it that much harder to transmit and decode the CAPTCHA.

      If there is a service that anyone can abuse based on nothing more than ability to read some letters from an image, then everyone else needs to protect themselves from that abusive service. One possibility is blacklisting the domain and only allowing whitelisted addresses from it. But I use Postini and it traps most spam without anything special going on with hotmail. If it's spam it gets trapped and if it's good it comes through to me.

      But hotmail could do a few things to keep from being blacklisted. One would be to require a confirmation from another email address, a different one for each hotmail account, to enable the hotmail registration with info such as a code provided with the registration required to be typed into the body of the reply email. Three failures or a timeout would delete the registration.

      I also would suggest a controversial but effective strategy. I would allow for a whitelist of worldwide ISP domains that have identifiable customers. Other services similar to hotmail such as gmail wouldn't be on that list. I would allow email only from registrants who confirmed from a whitelisted domain to be sent from hotmail to any address. Others would only be allowed to send email to addresses for domains within their own regional internet registries.

      This of course does not address spam overall as a problem, just spam emanating from hotmail accounts.

      Speaking of which, I see the usual about most spam coming from the US. Yes, it may, but if it does it's because US PC's were owned by Euroasian botmasters and the spam is controlled by them.

      In my experience with my small phpBB forum, by a huge amount most attacks come from Euroasia. It's those attacks that take over PC's, and it's taken over PC's that send out spam. Looking at the source of the spam from an IP address perspective isn't the answer. You would need to look at where the botmasters are to say where spam comes from.

  rd

Re:Captchas are no longer good enough

[AaronLawrence]

I do the same thing, but it's not an answer to the general case, of how to prevent spammers from signing up for seemingly legitimate email addresses.

Re:Captchas are no longer good enough

[mjwx]

why not make CAPTCHAs educational? instead of random words or random excerpts from books, make them arithmetic word problems, geometry proofs, SAT analogy questions, stoichiometry equations, spelling quizzes, etc.

Because this will alienate all the dumb people. Those who cannot (read: will not) think for themselves will be up in arms claiming discrimination. It's a good idea but once again falls victim to the stupidity of the masses.

Re:Captchas are no longer good enough

[Dan541]

Do you ever get email from humans?
Email should be kept simple!

Personally if I get an email telling me to jump through hoops I don't bother, it simply is notlonger worth my time.

If you want to use a boxtrapper system to verify my email and all I have to do is click a link then it will annoy me, but I'll still do it. What I will not do is jump through hoops using specially crafted keys and other crap just to get an email through.

My email address is dan@danscomp.net, I am able to display it here because I use a good setup to eliminate any spam targeting my address (SpamAssassin) . I don't worry about creating aliases or special keys, I deal with the spam that does get through but with most email being legit I would only create my own problems if I had it any other way.

My point is that email doesn't have to be complicated, once it becomes an inconvenience... well that's the opposite of what it's intended to be.

Re:Captchas are no longer good enough

[Dan541]

I just want to register to post a comment, not take my PhD exams.

Re:Captchas are no longer good enough

[kieran]

These are nice ideas in theory, but in practice as the benefit is gained by someone other than the company implementing the Captchas, they're not going to be satisfactory to the decision-makers.

Personally I think that short of requiring some form of ID verification (credit card, social security number, whatever) to create an account, the best way to deal with this is to streamline the process of identifying and removing bad accounts.

Re:Captchas are no longer good enough

[caluml]

I wrote an app to generate time-limited aliases in the form 'myname-yyyymmdd.validation@mydomain.com

I started doing this too. user@y2008m10.domain.tld. The advantage of doing it in the FQDN part is that you can set that address to 127.0.0.1 when you're finished with it, and you don't even see the spam.
It's a pain for the people emailing though, as their address-books won't be of any use to them.

Re:Captchas are no longer good enough

[dkf]

why not make CAPTCHAs educational?

Because this will alienate all the dumb people.

You say this like it's a bad thing. Your priorities are wrong.

Re:Captchas are no longer good enough

[Anonymous Coward]

requiring a physical ID for internet accounts is a bad idea.

i like the reCAPTCHA approach. if spammers want to abuse a reCAPTCHA system, at least they'll be making a positive contribution to society by helping to digitize printed literature. maybe Project Gutenberg or the Google Books Library Project can launch a reCAPTCHA service to put those botnets to good use. if you can't stop them, at least this helps to recover some utility from the problem.

there's also the issue of CAPTCHA porn and the related phenomena of outsourcing CAPTCHA solutions. as long as there are people willing to solve CAPTCHAs for porn, or money to feed their families, then no reverse turing test will ever be foolproof. so the best thing to do is to exploit this CAPTCHA-solving machinery.

why not make CAPTCHAs educational? instead of random words or random excerpts from books, make them arithmetic word problems, geometry proofs, SAT analogy questions, stoichiometry equations, spelling quizzes, etc. this way, the CAPTCHA solvers gain an education from their labors instead of just some cheap porn or a couple of bucks a day. and after solving CAPTCHAs for a few years, they'll be educated enough to land a real job and/or afford to pay for better porn.

this way you turn the spam problem into a way of educating horny teenagers and underprivileged poor in 3rd world countries.

Would you happen to have a link to one of these sites?

Re:Captchas are no longer good enough

[FictionPimp]

What about a system that takes photos of everyday objects and dynamically layers them into a new picture. The user is then asked to name a random amount of the objects in the photo (for example, name the closest and furthest objects in the photo). This would be random each time like current methods.

Re:Captchas are no longer good enough

[Anonymous Coward]

    A postive and compassionate view not requiring firearms or covert operatives. On the semi anonymous internet no less. A lot less fun than imagining Armed delta teams breaking down the doors of spammers. Your idea is more satisfying. - good job.

Re:Captchas are no longer good enough

[Anonymous Coward]

This is a great solution. It is ssl handshaking with the encryption being the funky hash.
It is kind of like an anonymous remailer.

How many emails do you send a day to people you have never communicated with ( which would be the number of times you would have to retrieve a new hash-acct address from their server) ?
There may be weeks where I don't talk to "new" people.

Re:Captchas are no longer good enough

[Asic Eng]

Just use sneakemail for an easier way to implement the approach the GP suggests: http://sneakemail.com/

Yeah you are right, it isn't convenient in all cases, but it works brilliantly on websites which require you to provide an address, and for people who are ... not so computer savy... Also works great for banks, paypal etc - the emails I get from them need to use the address I gave them - that's a nice way to quickly identify most phishing attempts.

Re:Captchas are no longer good enough

[Anonymous Coward]

Social networking websites

Re:Captchas are no longer good enough

[strong_epoxy]

Dude, use the above form to critique anti-spam ideas.

Re:Captchas are no longer good enough

[Miamicanes]

> Dude, use the above form to critique anti-spam ideas.

The above form would fail it, because it's based on the false premise that a solution can't be useful unless it's universally-applicable so that even the most naive, clueless newbie could personally take advantage of it. I could care less about Joe Sixpack's spam problem. I solved my own, and I occasionally share my solution with my comparably-savvy peers on Slashdot :)

Re:Captchas are no longer good enough

[Miamicanes]

> How many emails do you send a day to people you have never communicated with
> ( which would be the number of times you would have to retrieve a new hash-acct address from their server) ?

I'd say I might average 3-5 in a typical week. As others have noted, it's a one-time hassle that "just works" for effortless future communication going forward with that individual. Remembering the aliases is no big deal, because I have a few rules I always follow for generating them that inevitably narrows down the list of possibilities to a single obvious one, or maybe 2 or 3 plausible ones. For websites, I generate them in the form 'myaccount-hostnamewithoutdotcomnetetc.validationcode@mydomain.org'. So for something like Amazon, it would be something like 'foo-amazon.d2m@mydomain.org'. For rare occasions where there are two or more sites with domain names that differ only by TLD, I just suffix the alias with the TLD (50% ambiguity since I might have registered with one site sans suffix, then later discovered the second and used the suffix, but I think I've actually encountered this twice in 5 years).

Also, even though I have the app on my Touch to generate valid aliases, the algorithm itself really isn't that complicated, and might take 40 seconds max to generate "by hand". I COULD make it more complicated if I had to (by parsing through my years of email to build a whitelist of every valid alias ever used to reach me, then requiring NEW aliases to satisfy the more complicated algorithm), but I'll cross THAT bridge when I come to it.

The main point for everyone to take away from this is that you DON'T have to come up with an algorithm that's terribly complex. Even if you did something as trivial as counting the number of characters 'N' in the unique portion of the alias, then use just the Nth letter of the alphabet as the entire authcode, you'd successfully thwart pretty much every spammer in existence, because you just aren't valuable enough as a single individual to any one spammer to be worth the effort. More importantly, any halfwit spammer can safely assume that trying to spam someone who goes to that much trouble to avoid it (and has the technical expertise to pull it off) is a very, VERY dangerous person to screw with. ;-)

Re:Captchas are no longer good enough

[ZerdZerd]

And you can just generate a new string when your dad (or someone else) messes up. Sounds good. (Gmail works good enough for me though at the moment)

Re:Captchas are no longer good enough

[SanityInAnarchy]

First, this does nothing to clean out my inbox. If I were to paste The Form, the first thing I'd check is "Armies of worm-ridden Windows boxen".

And what do you do about blind users?

Pointless, though -- it's still vulnerable to the Mechanical Turk / free porn site attack.

Re:Captchas are no longer good enough

[FictionPimp]

Anything is vulnerable to the free porn attack. So your solution is to just abandon the idea of doing anything?

Re:Captchas are no longer good enough

[SanityInAnarchy]

No, not everything is vulnerable to the free porn attack. My own statistical filter isn't, for example.

My point is that if we want a real solution, we have to approach it from a different angle.

I don't have a solution, but neither do you. I'm not sure any one person is going to figure this out -- but we've got no chance unless we've correctly identified the problem.

And the problem actually is not directly related to robots. The problem is how to stop people from abusing your system, especially your free system -- or at least to make it not worthwhile to do so.

Re:Captchas are no longer good enough

[Uzuri]

Yup, so that I can't fill out web forms without turning javascript on. Sounds like a great way to get even a locked down computer owned. I just managed to teach my family to use NoScript, but it won't protect people if all the "good" sites out there train them to turn javascript on for everything.

Dupe

[Dan East]

This was from back in April, and was already discussed on Slashdot (the "tuning / exploitation" link).

Just out of curiosity, why doesn't the Slashdot software simply check to see if a submitted story contains the same url as an existing story? Wouldn't that stop a lot of dupes?

Re:Dupe

[explosivejared]

Well the submission system already does this for url's submitted outside of the main body of the article summary. In short, it would be cumbersome to sort of blacklist url's as you suggest, because a previously used url could be relevant again. If you are thinking that why don't the editors actually check the url's... well then my friend... you must be new here.

Re:Dupe

[denmarkw00t]

Wouldn't that stop a lot of dupes?

Yes, but the editors would work out a system to get around this - actually, I read a story on /. about CAPTCHAS thats along the same lines as what you're talking about.

Re:Dupe

[RiotingPacifist]

A reused url could Warn the editors (preferably using the blink tag)

That's what chu git fo tryin' to be NUMBA ONE,

[davidsyes]

ALL the time, motha-humpas.... SOMEbody's gonna captcha yo flag...

reCAPTCHA

[yincrash]

from the dude who coined CAPTCHA, comes reCAPTCHA. using words in old library books that existing OCR tech can't figure out, humans can help digitize books and stop spam at the same time!

http://recaptcha.net/

Re:reCAPTCHA

[yincrash]

If you want to know how it works...

But if a computer can't read such a CAPTCHA, how does the system know the correct answer to the puzzle? Here's how: Each new word that cannot be read correctly by OCR is given to a user in conjunction with another word for which the answer is already known. The user is then asked to read both words. If they solve the one for which the answer is known, the system assumes their answer is correct for the new one. The system then gives the new image to a number of other people to determine, with higher confidence, whether the original answer was correct.

http://recaptcha.net/learnmore.html

Re:reCAPTCHA

[TheSpoom]

ReCAPTCHA has the same issues as a CAPTCHA because it gives you one to which it knows the answer, so if you get that one right, it assumes you got the other one right. So you still only have to get one of the words right, which, in the end, is the same as a normal CAPTCHA.

Re:reCAPTCHA

[Anonymous Coward]

but at least recaptcha helps translating those books into digital form. which is good =)
also its not a too bad captcha.

then again, captcha are all broken by design and only work for so long.

http://www.insecure.ws/2007/06/15/captcha-wiib-2

Re:reCAPTCHA

[Anonymous Coward]

Thats not exactly true. The CAPTCHAs reCAPTCHA provides have been solved by HUMANS, not computers. Once enough people guess the same second word, it teaches itself what that word is and provides it as the verification word, even though the computer still cannot read it. The other CAPTCHA systems are created by computers.

Re:reCAPTCHA

[yincrash]

The words it knows the answer to are still words that OCR tech has not solved. They are words that have been solved by humans in previous attempts using reCAPTCHA.

All the researchers have to do is prime the pump by solving a few words and everyone else does the rest. :)

Re:reCAPTCHA

[SanityInAnarchy]

Aside from the inherent problems others are presenting, it seems trivially vulnerable to the porn site vulnerability.

That is: Setup a free porn site -- or a free site of any kind, with content people want to access, but it shouldn't be too hard to get enough porn together (original or pirated) to build a free porn site.

Then, require your users to solve the CAPTCHA (or reCAPTCHA) in order to get to the content. Unless your users are very observant, they probably won't realize that the CAPTCHA they're looking at isn't from you (or from your own reCAPTCHA account).

Even if this was no longer feasible, the fundamental problem is, people are cheap enough. CAPTCHA is therefore flawed in its very mission statement: Telling Computers and Humans Apart isn't enough anymore, unless you're going to do it on every single request, which would drive your users away.

I don't have a real solution for this. I know of a few hacks which would at least make it more difficult -- probably much more difficult than a CAPTCHA. But it's a much deeper problem than that. You'd have to design the system such that it's actually unattractive to spammers, even if they could game it -- and that is incredibly tricky to do, while still making it accessible to humans.

Re:reCAPTCHA

[Anonymous Coward]

no. It only knows the correct one is right because HUMANS identified it. It's still something their OCR software couldn't get. Once you get the system started, you don't run out of things that the OCR software missed, but humans solved.

Re:reCAPTCHA

[Anonymous Coward]

Not really - first of all, it's harder to OCR them, since reCAPTCHA words are chosen from a set that already failed OCR'ing once. Second, if reCAPTCHA starts seeing way too many guessing attempts from the same IP address (or block of them), it eventually will start handing out entire sentences to OCR. :-)

Their recent article in Science about reCAPTCHA is pretty cool.

Re:reCAPTCHA

[TheSpoom]

The problem with this is that it puts reCAPTCHA and spammers into an... hold on, lemme get the checklist...

(X) Eternal arms race involved in all filtering approaches

What if the spammers have better OCR than the reCAPTCHA people?

Re:reCAPTCHA

[Anonymous Coward]

Only its given you words that have already been trouble for OCR solutions. Which is a good start.

Re:reCAPTCHA

[Jerrry]

The real cure for spam is to get granny to stop clicking on those "you've received an e-card" and Joe Sixpack from buying dick enlargement pills. Until this happens, the spammers will always find ways around anything security experts can think up.

I'm not holding my breath...

Sales or support

[tepples]

Thus, when you give out your email to people, you could give them a key that they would need in order to send you an email, and similar methods would apply to other communication mechanisms.

Under your system, when one opens a means of contact for sales or support of his products or services, I'd assume he would give out the key for that. So how would he prevent that name:key@host from getting spammed?

Re:Sales or support

[lysergic.acid]

easy, you just need to encrypt the first key with a second key. surely, there's no way for a spammer to get a hold of all 3 pieces of vital info now needed to send an e-mail.

but if by some off chance that spammers manage to get a hold of all 3 pieces of info (because users have to give out these keys just as they would an e-mail address), we'll just add another key to the system, and another...

we'll all need to get bigger business cards.

Captchas that humans can read, perhaps?

[Behrooz]

Am I the only one getting really really annoyed by captchas that use mixed-case letters and numbers that aren't distinguishable even to an actual human?

In the cruddy sans-serif fonts most captchas use, 0lRnBC looks like O1Rnl3C looks like 0lRnBC.

It's powers of 2, people! For each O or 0 in your captcha, the odds of a real person being able to correctly identify it are halved, and that's not even counting the other possible charspace collisions.

Re:Captchas that humans can read, perhaps?

[feepness]

Not to mention the $%@#$@#$@#% that don't realize 10% of the male population is colorblind.

That's right! Your light green letters with the swath of dark red across them are completely unbreakable... to me. I've literally abandoned websites after failing the capcha repeatedly.

Re:Captchas that humans can read, perhaps?

[techno-vampire]

Am I the only one getting really really annoyed by captchas that use mixed-case letters and numbers that aren't distinguishable even to an actual human?

No, especially when I'm never sure if the reply is case sensitive or not. Sometimes I have to try three and four times, even when I'm sure I've gotten it right. However, the thought occurs to me that the site might simply require you to get three successive captchas right to make it harder on bots.

Re:Captchas that humans can read, perhaps?

[Ron_Fitzgerald]

However, the thought occurs to me that the site might simply require you to get three successive captchas right to make it harder on bots.

I would swear that MySpace did this when they first started using captchas for their video comment posts. It would never let me enter a correct captcha on the first try for about a week. I wasn't sure if it was a bug in the system or they were trying a new approach. It doesn't do that anymore, unless of course I do get it wrong.

Re:Captchas that humans can read, perhaps?

[zippthorne]

We're asking the wrong question. Captchas try to solve the turing test in reverse. Difficult enough for a human, let alone a machine.

But there's no need to ask that question. Instead, we should be asking, "is this message/post/whatever worth the senders' time." Which spam isn't, unless it takes very little time.

Frankly, I'm confused as to why there aren't scores of message digest type techniques for making messages costly, but not too costly.

Re:Captchas that humans can read, perhaps?

[scientus]

My nVideo software will allow me to change the hue of the whole screen, its ugly and anoying but it works in such cases.

Re:Captchas that humans can read, perhaps?

[Anonymous Coward]

oh, please come to my website! i would love to discriminate you some more.

Security thu disgust.

[Anonymous Coward]

"Could there be any better CAPTCHA, a better solution?"

Base them all on Goatse.

fingerprint

[jrozzi]

We use a fingerprint jquery library to record the timestamps for every keystroke made by the submitter and inject them in to the form. You can then determine if the form submission is legitimate or not if the timestamp for key down and timestamp for key up events fall between a certain time. I guess the down sides to using this method is that the form submission won't work if javascript is disabled or if malicious people figure out your algorithm. Seems to work okay to help prevent spam bots for us though. http://narcvs.com/javascript/fingerprint/

Re:fingerprint

[zobier]

Does that not discriminate against people with physical impairment?

Re:fingerprint

[Asic Eng]

Discrimination against disabled people is a problem with captchas anyway. If you are blind and using a HTML->Braille browser, then captchas lock you out.

Re:fingerprint

[zobier]

Most of them have an audio alternative. And 'everyone else does it' isn't a good excuse for unfair discrimination.

Give them all the accounts they want, but ...

[PPH]

...charge them a penny per e-mail sent.

Re:Give them all the accounts they want, but ...

[creature124]

Your post advocates a

( ) technical ( ) legislative (X) market-based ( ) vigilante

approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

( ) Spammers can easily use it to harvest email addresses
(X) Mailing lists and other legitimate email uses would be affected
(X) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
(X) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business

Specifically, your plan fails to account for

( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
( ) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
(X) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook

and the following philosophical objections may also apply:

(X) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
(X) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough

Furthermore, this is what I think about you:

( ) Sorry dude, but I don't think it would work.
(X) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your house down!

Re:Give them all the accounts they want, but ...

[vandan]

Interesting. As a socialist, I despise market-based approaches. In particular for bigger-picture type problem, such as social planning, provision of services, protecting the environment, etc, I think the market is the LAST mechanism that I'd want to use.

But for spam the situation is a little different. Spam is all about 'the market', and in particular, spam exists because free email creates a potentially unlimited market, with zero marketing costs ( for all intents and purposes - there are some nominal costs ). The one sure-fire way to eradicate spam is to introduce just a tiny little per-email charge. See my post below ( search for me ) for more details ...

Re:Give them all the accounts they want, but ...

[Creepy Crawler]

Honest question.. Im not trying to bait you,

What makes you think that a big-above approach is better than a ground up approach? Because it IS an overview and big decision, many things fall through the cracks and are either ignored, or unplanned consequences.

Ground up approaches start with the small fry and grow up, considering the in-betweens. They HAVE to deal with the niche, the small.. the ignored.

I look at the combined approach of Linux. There's no real organization between all the pieces, though there is in each group. It's all just source floating around, and yet we have distributions that have 20 text editors, 5 spread sheet programs, oodles of graphics programs, and so much else. It's all free with no strings attached for the end user. Talk about communistic: those that can program well do so and share with those that cannot. However, one thing is here that traditional command economies did not have: freedom. It was a ground up effort with no ivory tower ideas.

And as we had an article about unit testing: Do you think that yourself and a bunch of other lawyer types could create and test laws so that they have no holes, and test for all side cases? Our current lawyers cant.

Re:Give them all the accounts they want, but ...

[Ash-Fox]

See this post.

Re:Give them all the accounts they want, but ...

[vandan]

My approach isn't necessarily a top-down approach. It's just a simple change in the way people think about email. It doesn't have to be IMPLEMENTED across the board for it to work. In fact I would suggest that all parties play a 'wait and see' approach, as long as you've got the legal framework in place for me to charge people who I receive email from IF I WANT. This means that all legitimate email will just keep happening, and there will be an initial flurry of people charging spammers for receiving their junk, followed by all spammers going broke. It wouldn't be a permanent situation - just a legal framework to charge people if need be.

Saw on ubuntu forums and other sites

[Taibhsear]

Why not have the captcha ask a question?
"2 + 2 = ?"
or
"What color is a firetruck?"
etc.

Re:Saw on ubuntu forums and other sites

[WK2]

The main problem with those is that there are only so many questions you can ask. The spammer just needs a database with all of them, or just a significant portion. As for the simple math, that can easily be parsed and calculated.

Re:Saw on ubuntu forums and other sites

[ozphx]

Good call. You can type in the first thousand questions, and anyone that agrees with you can add another thousand.

Re:Saw on ubuntu forums and other sites

[Vectronic]

Math doesnt work, cause even a basic script can interpret that.

Same with basic questions like that, it would deny some, but not enough, some database of objects = color/shape/etc would be pretty easy.

Mixing them may work though...

"If you have 2 trucks, and three ambulances, and 6 motorbikes, how many four wheeled vehicles do you have?"

or maybe

"If you have 3 firetrucks, eight ambulances, and 1 + 1 red Ferrari's, how many license plates do you have?"

etc...

Re:Saw on ubuntu forums and other sites

[Asmor]

Better yet, how about a combination of image recognition and random questions?

E.g. you're shown a randomly-generated picture with a duck, a chicken, a skunk, and a dog, and background noise. You're asked to click the duck. If you correctly click in the general area of the duck, you're verified.

Probably not the best example, since you'd have a reasonable success rate just for guessing, but it seems like a solid concept.

Re:Saw on ubuntu forums and other sites

[zobier]

Because of the pr0n hole (people solving CAPTCHA for you, for free, by proxy).

1. Set up a site with something people want.
2. When they come to the site your server goes to the target site*.
3. The target site gives your server a CAPTCHA.
4. Your server gives the punter the CAPTCHA.
5. Punter tries to solve CAPTCHA.
6. Server passes response to target.
7. Profit!

*via proxies or bot net to avoid IP blacklisting.

Re:Saw on ubuntu forums and other sites

[Jesus_666]

"What color is a firetruck?"

The answer to this one is: "Where?"

Remember, web apps are used internationally and not everyone knows what color the firetrucks in your country are.

Re:Saw on ubuntu forums and other sites

[RiotingPacifist]

rule based ai could crack pretty much any text only question without much trouble.

Re:Saw on ubuntu forums and other sites

[supernova_hq]

"What color is a firetruck?"

Not sure, you tell me!

Re:Saw on ubuntu forums and other sites

[arbitraryaardvark]

obligatory xkcd:
http://xkcd.com/233/

2+2=5, for sufficiently large values of 2.
firetrucks are yellow, for better visibility.

Re:Saw on ubuntu forums and other sites

[ckedge]

What if we sent the captcha to them by e-mail as a two megabyte image attachment?

Anyone trying to do things with bots would need an e-mail server that can handle tens of thousands of 2 MB e-mails, and ALL e-mail service providers would be able to insta-ban them based on bandwidth usage. Heck we can even make it easy for e-mail service providers to recognize our 2MB capcha e-mail images, by naming them capcha.jpg. Any account that gets more than 10 captcha e-mails in a single day is banned by gmail/yahoo/etc.

I swear, I'm a fucking genius. This only took me 30 seconds to think of.

Re:Saw on ubuntu forums and other sites

[QuoteMstr]

A cleaner version of the link of thing you suggest is hashcash. The idea is that you force anyone using your service to invest certain resources, with the idea being the investment would be acceptable for a single user, but unacceptable for a massive attack.

The problem with hashcash, though, is that computing power is dirt cheap, especially in this day of botnets. The Storm botnet, taken as a whole, peaked last year as one of the world' most powerful computers.

I think we'll be able to come up with a captcha system that works reasonable well for reasonable periods, making using word problems, cultural questions, or some kind of clever pattern recognition problem. (Of course, any captcha is going to discriminate against somebody: the blind, the deaf, the dumb, the ignorant, etc. Unfortunately, that's a fact of life.)

I think we're better off in the long run destroying the economics of spam than continuing this arms race. Unfortunately, destroying the economics of spam requires regulation and legislation.

The porn hole is still a big problem though, and there's really no way around that. You can think of various cryptographic schemes, sure, but fundamentally, a capcha still relies on something transmitted to our sense organs. And what we can transmit, we can easily record and replicate elsewhere.

Re:Saw on ubuntu forums and other sites

[jimdread]

Set up your captcha so that people can tell which site it's from. Put the correct site name in the captcha, like this:

SeCreT TeXt
from example.org

People might still answer the captcha, but at least they'll know they're helping spammers. And other people can tell by looking at the captcha that it's on the wrong site, therefore the site is probably bad in some way.

Re:Saw on ubuntu forums and other sites

[MacDork]

I think we're better off in the long run destroying the economics of spam than continuing this arms race. Unfortunately, destroying the economics of spam requires regulation and legislation.

Has anything ever stopped junk mail? Honestly, do you really think you're going to beat junk mail? Do you really think you can stop it at my mail box, you can stop it at my email box, you can stop the junk faxes, the door to door "Have you found Jesus" freaks, and the flyers under my windshield wiper... and you can do ANY of that without stepping on my first amendment rights?

You are an extremely optimistic person. I don't think you'll be able to legislate away bot nets. I don't think American legislation will affect spammers in other nations. I do think you will trample my rights trying it though. I do think you will look like the RIAA trying to legislate a new reality.

Re:Saw on ubuntu forums and other sites

[caluml]

Don't forget the Green Goddesses.

Re:Saw on ubuntu forums and other sites

[Anonymous Coward]

"You're in the desert, you see a tortoise lying on its back, struggling, and you're not helping... why is that?"

Re:Saw on ubuntu forums and other sites

[Anonymous Coward]

Sure, that's a hole that you can't fix. Rather than trading porn for solved CAPTCHAs, you could also outsource CAPTCHA-solving to low paid workers.

However, there's a cost. Getting humans to solve CAPTCHAs is in any case more expensive than using an automatic system. That's why they will still help diminish if not abolish spam.

Nice story about it here:

http://www.codinghorror.com/blog/archives/000712.html

Re:Saw on ubuntu forums and other sites

[emlyncorrin]

I'm surprised no one seems to have mentioned KittenAuth.
OK, it doesn't solve the pr0n hole, but otherwise it looks pretty hard to break.

Re:Saw on ubuntu forums and other sites

[Ash-Fox]

Better yet, how about a combination of image recognition and random questions?

E.g. you're shown a randomly-generated picture with a duck, a chicken, a skunk, and a dog, and background noise. You're asked to click the duck. If you correctly click in the general area of the duck, you're verified.

Probably not the best example, since you'd have a reasonable success rate just for guessing, but it seems like a solid concept.

To put it simply...

Okay, I refreshed enough times to get all your questions and wrote a predefined list for all questions.

Re:Saw on ubuntu forums and other sites

[Anonymous Coward]

Free porn and cocaine for eveyone would do the trick without trampeling on your rights.

I am obviously joking (everybody got that?). I'm just trying to make a point that:
a) Don't give up just yet.
b) Not every action will ruin your day.

Have a nice day!

Re:Saw on ubuntu forums and other sites

[I cant believe its n]

Before being rude, please make sure you know what you are talking about. Please also make sure you understand the person you are replying to, before replying.

There are a number of ways to strengthen CAPTCHA generation using Asmor's idea. I'm sure you could come up with a few if you tried.

(It still would not help against humans, but one problem at a time)

Re:Saw on ubuntu forums and other sites

[Ash-Fox]

please make sure you know what you are talking about.

I understand that prewritten questions are vulnerable. As I mentioned above. Additionally, even if you add some randomization into the mix, it would be very easy to compensate.

I don't consider my previous post to be rude by the way. Nor do I see anything rude about it.

There are a number of ways to strengthen CAPTCHA generation using Asmor's idea. I'm sure you could come up with a few if you tried.

Not anything that could be widely adopted which would be truly viable against computers breaking it.

At the end of the day. not a single idea, I or you can come up with, defeats the malicious human component in the mix.

There are services out there that charge $1 per one hundred, human assisted CAPTCHA responses (as in, a person will physically type in the CAPTCHA). There are porn sites that ask the user to enter CAPTCHA information, which was taken from yahoo, gmail to automatically sign up fake accounts on yahoo, gmail etc.

The only real way to win, is not to play the game.

Re:Saw on ubuntu forums and other sites

[Asic Eng]

Maybe just add a delay - wait 10 mins to send the capcha, that means it takes a while to get a lot of capchas to a single account.

The problem with the auto-baning for gmail/yahoo etc is that it becomes really easy to lock the email account of someone you don't like.

Re:Saw on ubuntu forums and other sites

[__NR_kill]

What if we sent the captcha to them by e-mail as a two megabyte image attachment?

Anyone trying to do things with bots would need an e-mail server that can handle tens of thousands of 2 MB e-mails, and ALL e-mail service providers would be able to insta-ban them based on bandwidth usage. Heck we can even make it easy for e-mail service providers to recognize our 2MB capcha e-mail images, by naming them capcha.jpg. Any account that gets more than 10 captcha e-mails in a single day is banned by gmail/yahoo/etc.

I swear, I'm a fucking genius. This only took me 30 seconds to think of.

please give me your email to send you several hundred emails every day. Your 7Gig at google will vanish quite quickly, besides you getting banned for being a spammer... oh wait..

The CAPTCHA isn't dead yet.

[Fantastic Lad]

When going through the step-by-step in the article, (which is pretty awesome, btw), it appears that there is no character recognition being employed, but rather the security is being defeated by a fairly hacky work-around.

Hacky work-arounds can be defeated simply by programming smarter, (less sloppily?). There's no graphic-reading AI involved, which means the basic fundamentals of the CAPTCHA system remain sound.

While I find CAPTCHAs a little annoying when signing up for stuff, I recognize their necessity and actually kind of grin while doing them, thinking, "Hh ha! Look at this monkey, all smarter than a dumb computer. This must be frustrating for spammers. Ho ho!"

-FL

Re:The CAPTCHA isn't dead yet.

[Anonymous Coward]

In my job, I have to use certain websites that constantly require you to enter a new captcha. (multiple searches on the same database)

Doing it once is fine, but see how you like it if you're entering them 200 times a day. These things are EVIL!

Re:The CAPTCHA isn't dead yet.

[White Flame]

There are companies out there (usually in 3rd world countries) that provide CAPTCHA-breaking services, simply by paying some worker a penny or two per CAPTCHA bypassed.

Anything any human can be expected to do, they can get through as well.

Re:The CAPTCHA isn't dead yet.

[Anonymous Coward]

CAPTCHAs are vulnerable to porn. By offering free porn for solving a CAPTCHA, organizations have successfully implemented a mechanical turk. Since it's people on the other end, CAPTCHAs can't resolve this problem.

Re-captcha is fun to screw with

[Anonymous Coward]

I can't help it but every time I use re-captcha I like to type things slightly incorrectly, just one or two letters for example:

It is obviously "to shouted" I will type "to chouted" and it still works fine...

Try it out if you like:
http://recaptcha.net/learnmore.html

Just Require Iris Scans

[BoRegardless]

Everyone who does anything gets scanned. Your scan matches or it doesn't.

Re:Just Require Iris Scans

[bunratty]

I don't have eyes, you insensitive clod!

Re:Just Require Iris Scans

[BoRegardless]

It does stop NON-HUMANS.

Then my computer, car, home and business can open for me without keys or captchas.

Yeah, there has to be smarts to eliminate photos. Not hard with a living person.

Re:Just Require Iris Scans

[White Flame]

If the client's eyeballs aren't physically present at the receiving server, how can you trust that the scan you're receiving over the wire is actually of the person on the other end?

Re:Just Require Iris Scans

[BoRegardless]

...along with Public-Private Key.

Yup, lots of work.

A revised CAPTCHA?

[Panaqqa]

I had played with this idea a bit a few months back and came up with an idea I think could work - but only ever got around to coding the most basic example of it. For those on /. who are interested, find it here. Each reload will produce the image of a new challenge.

In a closer to final version I had envisioned instructions in multiple fonts and colors involving shapes, letters, etc., and much more flexibility.

In the example I've shown above, pure random clicking will produce a correct response to the challenge 1 time in 30 approximately. So - make them solve three in a row and there you are - 1 chance in 27,000.

Re:A revised CAPTCHA?

[clickety6]

How about a randonmly generated grid of say 5 x 5 icons of different every day objects (also randomly selected to display in the grid from a database of 1000s of icons) and a question that says click the following sequence.... cat/kettle/cloud

To get it right, you'd need some good image recognition that can recognise a wide variety of objects, and to prevent random clicking attacks, make the list longer...

The article is almost 6 months old.

[asserted]

"04.10.2008 - 10:54 AM" - April 10th.

this is the article mentioned in the original "Hotmail CAPTCHA sucks" slashdot post.

Re:The article is almost 6 months old.

[Anonymous Coward]

That's a European date. The article will be written the day after tomorrow.

OpenID

[debrain]

Does OpenID help solve this (spamming) problem?

Re:OpenID

[68kmac]

No: Does accepting OpenID logins protect me from spam?

There have already been cases of "OpenID spam".

The main problem is.

[Anonymous Coward]

The main problem with Captchas is it's generated by a machine based on a set of algorithm. Therefore it's just a matter of time before another machine can understand it.

What we need is not a better algorithms. Instead..........

-AM

Capitalize on which computers are poor performers

[ToadMan8]

How about aesthetics? Put up several hot-or-not comparisons, asking the user to select amongst several different pictures, some hideously ugly, one beautiful. Yeah, yeah, some people think the fat lady with a hairy mole is more beautiful than the fake skinny girl with big boobs, so put text that says "select from the following pictures which image society at large would find most visually attractive".

With extremely varied composition (profile shots, portraits, etc.) you could mix things up to the point where computers couldn't figure it out. Microsoft and many other companies already have license-free picture repositories for use for this (flikr and the like). It would be faster than reading the weird image, as "who is prettier" is an extremely quick, intuitive decision for most. "Training" would be done by asking the user to do an additional comparison that didn't have an "answer" yet, only using it as a valid test when you have a statistically-significant margin.

Interactive?

[supernova_hq]

How about something interactive?

Use some javascript/css/etc to make a box where depending on the position of you mouse in the box, little images/icons/whatever move around in the box till they overlap and create a bigger picture, then send the mouse position (x,y) to an AJAX server and have it validated.

Re:Interactive?

[Anonymous Coward]

Have fun doing that on your mobile phone.

Re:Interactive?

[supernova_hq]

Hmm, never thought of that. Another idea would be to create a couple hundred photos and give them all tags (has fish, black and white, 2 things the same, etc) and have the server generate 6 images where 5 share a tag and you have to chose "the one that's unlike the others".

I believe someone is working on a similar idea (pick all pictures with a cat) for openid login.

Re:Interactive?

[Lincolnshire Poacher]

> How about something interactive?

Perhaps a little game - catch five falling stars in the bucket without catching any apples, or somesuch.

Or just charge the damn users for opening an account...

I wonder about a time delay for E-mail out

[mlts]

This won't be a be all and end all to spam, but maybe for new accounts that are freshly created, have an escalating delay for each message sent out? This would go away after some certain rules are matched (date of account creation.)

One can add and subtract modifiers. For example, multiple E-mails sent out to many recipients will have a longer delay than messages sent to the same person, a longer delay if the outgoing content is flagged spam through a heuristic filter, etc.

This in no means would stop spam, but a delay of 10-15 seconds won't affect users much, but will definitely put a crimp on spammers.

Lycos has the solution

[Ofenza]

They should use Lycos' CAPTCHA. It was pretty effective with me. http://img255.imageshack.us/img255/9947/picture3ga6.png

Re:Lycos has the solution

[Anonymous Coward]

Even I can read 'lycos.com' hidden in that mess :)

Re:Lycos has the solution

[Ofenza]

I'm not sure I know what you mean...

Really, really, really, really obvious

[QuoteMstr]

What makes you think a spammer won't just send fake keystroke times? Never trust the client.

pay-per-email // smtp service charge

[vandan]

Yes there's a better solution. All smtp servers should all have mandatory per-email charges for RECEIVING, all the way to the email account-holder ( ie I charge my ISP for each email I receive ). Then each account holder would be responsible for refunding this charge when they have read the email, if they are satisfied that it's not spam. If it is spam, then I would of course not refund this amount. My ISP would in turn not refund their amount to the upstream smtp server, and so on, right up to the original sender, who would not get his charge refunded. This would make all legitimate email free, and would make spam too expensive to be worthwhile.

Re:pay-per-email // smtp service charge

[QuoteMstr]

You want to charge to messages sent to your SMTP server? Okay, you go first. Unless you run aol.com, gmail.com, or yahoo.com, I don't think you're going to get much traction. Perhaps not even then.

You'd have to either arrange payment details for every communicating pair of SMTP servers or provide a clearing-house. Who's going to run this clearing house? And wouldn't it be in the clearing-house's interest to either see spam (and their their fees) increase, or to simply charge people per legitimate email? If you're willing to go that far, simply charging people per email would have the same effect on spam.

Keep in mind that people don't press the "spam" button. Most of the time, they just delete spam messages like other messages. The financial penalty for a spam message would have to take into account the low likelihood of the message being reported by a given user.

Also, it doesn't address botnets. In fact, it further exacerbates that problem. Now, instead of a user's computer being hijacked to send spam, it's hijacked to send spam and drain the user's bank account.

Maybe, maybe, consider header a saying 'This is for real, cryptographically-signed ClearingHouse: "I'm [foo@example.com]-0x54afafa and I guarantee this message is not spam. If it is, I agree to pay you $10 minus clearing-house fees, cryptographically-signed SomeCompany"'

If you attach that header, your spam score on heuristic filters would decrease markedly. If you forged the header, you'd be marked as spam instantly. (Since everyone using this system would have ClearingHouse's public key on file.)

Re:pay-per-email // smtp service charge

[vandan]

You want to charge to messages sent to your SMTP server? Okay, you go first.

Obviously this would require ISPs to get onboard and implement it. But considering that they're the ones choking under spam, I think they'd see the point. I know for a fact that some of the largest ISPs in Australia are experiencing serious interruptions to their smtp services because of spam.

You'd have to either arrange payment details for every communicating pair of SMTP servers

We already have a list of smtp servers the email has traveled through in the email headers. It's not hard to use this information to charge the associated party. As for the clearing-house approach, you're right - this is not the way to go ( conflict of interest ).

Keep in mind that people don't press the "spam" button.

This will change when they can make $1 per click.

Also, it doesn't address botnets. In fact, it further exacerbates that problem.

No, it helps solve the problem. That's like saying that prosecuting people for leaving firearms lying around only exacerbates the problem. If your PC is infected, then you're a part of the problem. Simple as that. If people want to take the issue up with Microsoft, then I encourage them to do this. But the buck must stop somewhere, and at the moment, it's stopping at me, because I have to pay to download spam ( over a mobile internet account, this is actually quite expensive ). My way, it will stop at the point that sent the spam, which is at least better if not perfect.

Now, instead of a user's computer being hijacked to send spam, it's hijacked to send spam and drain the user's bank account

OK. So people can nominate an smtp 'limit' on their account, or pay for smtp traffic in advance. So you can't 'accidentally' go over your nominated X number of messages, or X credit.

Maybe, maybe, consider header a saying 'This is for real, cryptographically-signed ClearingHouse: "I'm [foo@example.com]-0x54afafa and I guarantee this message is not spam. If it is, I agree to pay you $10 minus clearing-house fees, cryptographically-signed SomeCompany"'

No. We don't need clearing-house, OR an explicit message stating that it is not spam. ALL messages carry the IMPLICIT guarantee that the message is not spam, and have already paid their $10 guarantee, which I will refund upon deciding if it is spam or not.

Re:pay-per-email // smtp service charge

[PPH]

Charge for receiving? I don't know how you'd set up the transfer of payments infrastructure between ISPs.

Charging per message sent makes a bit more sense for the following reasons. It would be a charge imposed by an ISP on its own users. No funds need to be transferred between remote parties (probably a target for its own kind of fraud). It would be imposed by that ISP for the purpose of protecting its reputation. Spammers value this reputation highly, which is what motivates them to expend resources to crack CAPTCHAs in the first place. Essentially, what users are paying for is the reputation of their ISP.

ISPs that choose NOT to implement a charge per message sent system could continue to do business as before. They risk becoming targets of spammers, as they do now. But other countermeasures could be employed (IP blacklists, etc.) to deal with them.

Re:pay-per-email // smtp service charge

[tedu_again]

>> Keep in mind that people don't press the "spam" button.

> This will change when they can make $1 per click.

Sounds like a great business plan.

1. Subscribe to a hundred popular mailing lists.
2. Click spam on every message.
3. Profit.

No messy ??? in the way.

Re:pay-per-email // smtp service charge

[plasmacutter]

Your post advocates a

() technical ( ) legislative (X) market-based ( ) vigilante

approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

( ) Spammers can easily use it to harvest email addresses
(X) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
(X) It will stop spam for two weeks and then we'll be stuck with it
(X) Users of email will not put up with it
(X) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
(X) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business

Specifically, your plan fails to account for

( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
(X) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
(X) Asshats
(X) Jurisdictional problems
(X) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
(X) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
(X) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook

and the following philosophical objections may also apply:

( ) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
(X) Sending email should be free
(X) Why should we have to trust you and your servers?
(X) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough

Furthermore, this is what I think about you:

(X) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your house down!

Re:pay-per-email // smtp service charge

[Ash-Fox]

I don't think you've considered the fact that if this were implemented - People would start stopping using SMTP e-mail and use another free service instead. To the point that companies would start using this other free service and the spammers would very likely catch on.

Re:pay-per-email // smtp service charge

[vandan]

They're free to do this, and deal with the spam. Legitimate senders would have no worries. For example, why would one of my friends worry about sending me an email? The answer is that they wouldn't. But a spammer would worry a lot ...

Re:pay-per-email // smtp service charge

[Ash-Fox]

For example, why would one of my friends worry about sending me an email?

Why would my friends use e-mail? We have instant messengers for that. Legitimate senders have plenty to worry if they're businesses, automated verification systems etc.

Adding a cost is just going to discourage using SMTP. Company's can require using another system entirely and there is nothing the consumer can do other than not use it - if people want something, they will do it.

Re:pay-per-email // smtp service charge

[vandan]

Why would my friends use e-mail?

You're not paying attention to the answer I've given on this plenty of times now. People would use email because it would be exactly the same as it is now, only there would be no spam. Would YOU charge your friends who send you email, or would you refund the amount charged into their ISP's account? In truth, you'd probably have something set up to automatically refund all your friends' account right away.

Legitimate senders have plenty to worry if they're businesses

No they don't. They're have a small initial cost, which would be quickly refunded. If they're really business contacts, them they'll make plenty more back out of their relationship to you than this initial cost ( which, again, gets refunded ).

Adding a cost is just going to discourage using SMTP

It's not a cost if it gets refunded.

Company's can require using another system entirely and there is nothing the consumer can do other than not use it - if people want something, they will do it.

What are you talking about now? Look. I don't care if companies want to go and start their own messaging service - they're free to do this, but it won't catch on if they allow anyone to send anything they want to anyone and everyone en masse. That's the whole point. And extending your logic of "if people want XXX they'll just do it", then consider this ... if I want to charge people who send me email, then I'll just do it ... which I'm seriously considering doing anyway ( for spammers only of course ). Don't worry though - I'll keep letting people like you respond to me, as long as you don't try to sell me anything.

Microsoft has a better captcha already

[melted]

Check out ASIRRA: http://research.microsoft.com/asirra/

It's a better user experience as well - I'd much rather tell the server where all the cats are instead of trying to parse out barely recognizable characters.

AI isn't beating captchas -- networks are

[patio11]

>>
AI in the form of image processing is now about the same "intelligence" as a human
>>

Not even close, but it doesn't need to be.

What useful work could you do with an OCR program which was correct only 25% of the time? Nothing -- any book you read would look like one of those Babblefish English-by-way-of-Russian-by-way-of-English monstrosities. But a 25% accurate OCR is a 100% solution to the captcha, because you have a big freaking botnet and can generate additional requests for free.

Aside from botnets, the cloud-based outsourced captcha busting business model ($1 per 1,000 captchas done by a subcontractor of a subcontractor in a place where paying people to get a repetitive-stress injury makes excellent economic sense as long as they have an automated assistant to keep the queue full, like a factory line) is also doing some severe damage. Forget the old "Ahh, we'll give you porn for breaking a captcha you didn't even realize was Yahoo's" exploit, which was mostly theoretical. This gives you a *controllable, constantly available, scaleable* level of whatever the resource protected by the captcha is.

Captchas: pretty much screwed.

Social engineering vs captchas

[gmuslera]

Even if developed a clever image captcha that can't be solved by computers but yes for humans, spammers can use social engineering to make humans solve that captchas for them (i.e. bulk paying or showing porn).

Captchas alone don't solve the problem, but maybe combined with some kind of behaviour blocking, or add more human/machine detection (i.e. sometimes require an answer to be able to send the Nth email) after the account was created could make things a bit less profitable for spammers.. Or other kind of solution.

If only

[andreyvul]

spammers could break Rapidshare's CAPTCHAS....

reCAPTCHA has a critical flaw in its strategy

[patio11]

The reCAPTCHA strategy is that one of the following two things will happen:

1) No improvement in OCR happens and the CAPTCHA remains effective
2) Spammers improve OCR substantially and we get books digitized for free

It fails to account for the 3rd option

3) Spammers improve OCR marginally, achieve a 20 ~ 25% success rate on reCAPTCHA. There is no penalty for getting it wrong if you can generate requests for free and only care about maximizing successes! Its a multiple choice test with infinite questions and a fixed bar for passing! As soon as this happens, spammers will flood the legitimate users out of the system, because they can generate infinite requests and legitimate users can not. Its usefulness as a CAPTCHA is compromised and its usefulness for text digitization is zero, because the "multiple users checking each other" becomes multiple instances of the same lobotomized spam OCR program vouching for its own accuracy, with an infintessimal portion of humans being drowned out by sheer numbers.

Re:reCAPTCHA has a critical flaw in its strategy

[Creepy Crawler]

Then you test 20% as known good and verified and see what the spambots say. You also have a few select reCaptchas tested by trusted individuals and then refuse to serve reCaptchas to bots.

Re:reCAPTCHA has a critical flaw in its strategy

[patio11]

So you've got two fixes for the problem:

1) "It won't matter that my database is absolutely overflowing with garbage answers because I can hand-score a test subset". Great. So you are now hand-scoring a test subset, which will be known good, but this in no way allows you to delete the garbage on words not in the test subset.

2) You can avoid serving captchas to bots. Brilliant plan! One question: who are the bots? Answer: we've got no bloody clue who the bots are, *thats why we have captchas*. If your captcha is only secure when you can guarantee that no bots are using it, *your captcha is useless*.

Where do I sign up?

[Nimey]

I will provide my own rifle, bullets, and bayonet.

Re:Where do I sign up?

[Anonymous Coward]

I will provide my own rifle, bullets, and bayonet.

I will provide my own rifle, and bayonet, but no bullets....

Re:Where do I sign up?

[mjwx]

I will provide my own rifle, bullets, and bayonet.

Good start, now provide them for the rest of the company.

Re:Where do I sign up?

[Nimey]

I've got enough ammo, I think. Almost 800 rounds of 7.62x54mmR, nearly all of it Czech FMJ from the '60s. Only one carbine to fire it, but if you want in AIM Surplus is selling Mosin-Nagant M91/30 rifles for $70, complete with bayonet, ammo pouch, and cleaning kit.

Hashcash?

[fuzzyfuzzyfungus]

Since CAPTCHAs are frequently an indirect anti-spam measure, somebody may have already mentioned HashCash. It was designed as a mechanism to put a computational cost on sending email, to discourage spamming in a standard market solution type way; but without having to wait for a viable micropayment system.

It strikes me that, with the rise of javascript and xmlhttprequest, and so on, the hashcash concept could be trivially adjusted to serve as a CAPTCHA like mechanism. All one would have to do is include a little javascript implementation of the hash calculator and a random challenge string into the form being protected. The client would then compute the hash, and submit it along with all the other information. The user would notice nothing, other than a short CPU spike; but it would be easy enough to make the computational demands too high to be paid 10s or hundreds of thousands of times without significant cost.

Re:Hashcash?

[kvezach]

That won't work, because Javascript interpreters use some processing power of their own. Say there's a 9x slowdown from native code. Then the spammer can just write a C implementation of the hashcash mechanism, and then have the effective power of nine computers. Even if, by some miracle, Javascript interpreters become as fast as compilers (but without the compilation stage), the hashcash solution has two drawbacks. First, it'll hurt ordinary users that don't upgrade their computer every Moore's law cycle (and if there was a way to signal that "I have an old computer, give me an easier problem", spammers would spoof that). Second, it wouldn't actually help, since the spammers would just use their zombie network to calculate the hashcash. See Proof of Work Proves Not To Work.

There's a way around the zombie problem: you can have a reputation network and then make known "bad apples" pay more, but that would be hard to set up for websites. For the application to mail, see Proof of Work Can Work. The Moore problem can be somewhat mitigated by using a function bound by memory access time (since that improves more slowly), but the problem will still be there.

Re:Hashcash?

[caluml]

Can't we have a configurable system, so that you can specify: I don't want mails from anyone who has only generated a 12 or less bit HashCash? (or whatever would be a trivially small amount). Then, if you *did* often get mails from people with slow computers, you could drop that down, but if you're a techie, and everyone you know is running some fast box, you could ask (demand?) more crunching.

Solutions

[Tablizer]

Could there be any better CAPTCHA? A better solution?"

One possibility is call-back phone calls. It's harder to master both web hacking and phone hacking. Plus, there are more regulations for phones, making it easier to prosecute. Pay phones are known and would not be allowed.

Another approach is an "ID center" where you physically visit a small office and your driver's license (ID) and signature are checked and photocopied for a small fee. The verification could be used by multiple web services.
   

Re:Solutions

[Anonymous Coward]

Ugh... I'll keep the spam problem, if I had to choose between spam and having to have every website I visit have my RL personal info on hand. There is no need for 99.99% of the websites out there to know any more than my E-mail address and my name. Any extra data is just more fodder for identity thieves and criminals to amass for crimes.

Re:Solutions

[Tablizer]

every website I visit have my RL personal info on hand

There seems to be a misunderstanding. This is not what I proposed.
     

Re:Capitalize on which computers are poor performe

[ragethehotey]

Microsoft and many other companies already have license-free picture repositories for use for this (flikr and the like).

This is the problem, is that unless you had near infinite amounts of pictures (which is why we currently use "random" data), it would soon be cracked to the point of perfection.

Captcha: Thirteen = 4 + ? Ask questions??

[dj42]

Why not make Captchas math problems. Or ask questions that have obvious answers.

What color is the sky?
What color is the sun?
What is seven plus three?
What common pet barks?
What animal meows?
What animal does milk come from?

Three college interns and 3 months and you've got like 2300230023 million of them.

Show picture of cat. "What is this animal?"

[dj42]

Oh. I didn't realize that.

Then I guess my suggestion of asking simple questions or showing pictures and asking people to name what they see don't matter.

My suggestion would still be easier than deciphering the nonsense the put out now. Show a picture of the sun, "What is this?" sun. Show a picture of a cat, "What is this animal?" cat.

Re:Capitalize on which computers are poor performe

[Anonymous Coward]

I vote for "hot chicks" version of this approach. Like 'which one is topless?'. I'd use the signup form all day long.. (sorry, can't determine looking at this set of pics, please show another one!)

Sorry, but you get the form too...

[SanityInAnarchy]

Your post advocates a

(X) technical ( ) legislative ( ) market-based ( ) vigilante

approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
( ) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business

Specifically, your plan fails to account for

( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
(X) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
(X) Bandwidth costs that are unaffected by client filtering
( ) Outlook

and the following philosophical objections may also apply:

( ) Ideas similar to yours are easy to come up with, yet none have ever
been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
(X) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough

Furthermore, this is what I think about you:

( ) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your
house down!

Note two things:

Akismet actually does work, mostly. Huh. The Form isn't infallible, especially when it applies to things other than email.

And, all plans fail to account for asshats.

Re:Sorry, but you get the form too...

[KrimZon]

The form neglects to provide a "We don't _have_ any laser cannons" field. Therefore, blasting the spammers with our laser cannons will solve the problem of spam.

Re:Sorry, but you get the form too...

[Anonymous Coward]

"We don't _have_ any laser cannons"

Well, you might not...

Re:Sorry, but you get the form too...

[Anonymous Coward]

but it does have

(X) Killing them that way is not slow and painful enough

Limit the value of free accounts

[davidwr]

One way to take yourself off the "target list" is to limit the value of free accounts.

An obvious way is to limit the number of outgoing message-recipients per day.

If instead of registering 10,000 free accounts per month to do effective spamming, you had to register a million to send the same amount of spam, all the sudden your effort goes way up. You'll start targeting email services that don't have these limits.

it doesn't assume a cost-free solution exists

[Anonymous Coward]

It in fact doesn't assume that any solution exists. Maybe there is none.

Re:it doesn't assume a cost-free solution exists

[AaronLawrence]

That's a good point, and seems increasingly likely by now. Still, when trying to evaluate solutions, it doesn't help to have a list that blanket excludes everything. If the problem gets bad enough, some of those things it excludes will turn out to be tolerable (for example, anonymous mailing).

Self plug: my coffee cup CAPTCHA

[sugarmotor]

Put a CAPTCHA together at

http://stephansmap.org/sign_up

Why not hire some programmers to come up with a new CAPTCHA distortion every few weeks? It's definitely not easy to produce a distortion that leaves text still easy to read.

Stephan

It doesn't work cuz of Chinese workers

[Darkk]

Problem is spammers are using HUMANS to do the dirty work for them. They basically employ thousands of poor Chinese folks as cheap labor.

So CAPTCHA doesn't work anymore.

I have an idea.

[kamatsu]

Waiting for that guy with a form to post for this. Pick a random word from /usr/dict/words. Search for it on google images, return one of the first 5-10 results. Ask the user to identify the term in the image. Admittedly it would be slightly annoying because if it searched for "Aardvark" and you wrote "anteater" it wouldn't work, but i reckon something along those lines might work.

Re:I have an idea.

[rivercityrandom]

That's all fine and good for nouns, but what happens when it tries to find a Google Image for an abstract concept, like truth, beauty, or goodness, or things like adjectives, adverbs, pronouns, articles, prefixes, suffixes, or grammatical particles, or any other sort of thing that doesn't match one to one with any concrete object in the real world? Even if you narrowed the list to a subset of nouns, it would probably unnecessarily frustrate a lot of non-native English speakers, non-English speakers, undereducated people who couldn't tell an aardvark from an anteater if it bit them on the leg, owners of copyrighted visual material reproduced without permission on your website... at least current CAPTCHAs frustrate everyone equally...

What about A Logic Test

[gizmo2199]

...for email registration.

You know, like at those IQ test websites where you have a series of polygons

and you have to pick which one comes next.

You could conceivably create millions of these fairly quickly,

but even the best bot in the world could never solve it.

1) Which one is next:  | ...  |_  ...  |_|

     _
a)  |_|

b)   _|

     _
c)  (_)

The solution doesn't have to be multiple choice. You could have the user draw the answer
with some flash app, and then just compare the drawing to the answer. A human would pass
most of the time. A machine not so much.

It would be very expensive, computationally to have bots solve problems like these.
Considering all you have to do is change the shapes (trivial) to stump a bot, but
a ten year old could easily solve one of these.

And let's face it no spammer is going to pay to solve captchas. The whole point
of a botnet is that somebody else pays for it.

If it cost spammers even a few pennies for each spam message, it would be gone overnight.

Alternatives to CAPTCHA

[Slur]

CAPTCHA can be very annoying to people, and you can't just throw them in everyplace. But there are other solutions nearly as effective, and I'm surprised that more exploration isn't being done in alternatives to less and less legible CAPTCHAs.

On one site we had a simple form, a pair of fields for submitting URLs with a description. We started getting spammed through the form, so to reduce it I implemented a simpler option. When the form is submitted, it puts up a javascript prompt that asks the user to type in a pair of words. The words are combined together, a suffix is added, the whole thing is MD5'ed, and the MD% checksum is submitted with the form. This stopped all SPAM completely.

On another site I use PHPBB, and whatever CAPTCHA it is that PHPBB uses has been vulnerable for quite a while. So we were getting a half-dozen automated fake registrations every day. Rather than dump the CAPTCHA altogether I just changed the instructions and the logic for validation. The user is instructed to type "PRE-" followed by the CAPTCHA text. This eliminated almost all our fake registrations.

There must be a thousand other ideas. For example...

* You could use Javascript / AJAX to produce the CAPTCHA, or to open it up in a separate window.

* As browsers improve static images can be replaced by SVG.

* Why not Flash? A Flash solution would work for the majority of users, and could include special instructions in both text and audio. The letters could be animated and overlapping.

* Insisting on an email confirmation before accepting submitted data can also eliminate a huge amount of abuse.

* If you're really into static CAPTCHAs perhaps another layout can work better. For example, arrange the letters in a circle with some special indicator of which letter to start with and whether to proceed clockwise or counter-clockwise. "Start with the blue letter... Start with the letter at 7 o'clock... Begin with the numeric character and proceed clockwise... etc. etc."

Certainly the clever minds of Slashdot can come up with several more.

Re:Alternatives to CAPTCHA

[Dan541]

Better yet Charge $1 to the users credit card and put a capcha code on their bill.

Now if you run a blog like I do and require capcha to post a comment.....

$$$Profit$$$ :)

Simple Solution...

[Anonymous Coward]

Create a number sequence with a missing value. Rather than use numeral such as 2,4,6,_?_, use shapes and objects.

Or use an object like a book, car, bike, etc., and ask the user to confirm what it is.

SUE them

[zymano]

Sue them.

Over. Done. Fini

Great: now the DMCA looks tame.

[plasmacutter]

Under the DMCA, my site gets killed from a false accusation or spoofed address.

Under your approach to spam, I get killed from a false accusation or spoofed address.

I can't wait.

Suicide by spam patrol!

Move that object.

[Anonymous Coward]

How about a script that requires the movement of an element over another element via CSS and Javascript to a certain position? Kinda like... inserting a key into a keyhole. Maybe? Yes? No?

Irony?

[oldhack]

Just as porn ushered in VCR age, spam advances AI.

CaptCharity

[Anonymous Coward]

I'm familiar with The Form, thank you very much.

Set up a facility that can accept micropayments and forward them to various charities. To email me for the first time, you have to transfer say 10 cents (or more, if you wish) to one of the charities that I approve. If I ever reply to your mail, I return you your 10 cents.

simple question

[spacecowboy420]

I know this isn't new, but it is extremely simple. Ask simple questions instead of captcha.

who is buried in grant's tomb?
1+1?
3-2?
There are 50 stars on an American flag. How many stars are on the American flag?

Confuse the Bots

[TechForensics]

Why not just randomly vary the number and identity of click-through pages to register? In other words to solve a CAPTCHA you must handle an unexpected number of preliminary pages. Bots = confused.

Re:Confuse the Bots

[amn108]

Exactly how will this confuse the bots?

ReCAPTCHA

[David Gerard]

More sites should use reCaptcha. If the spammers break that, they'll have advanced computer science and the freeing of knowledge.

(Wikimedia considered reCaptcha, but insists on running on all-free software. ReCaptcha won't release any of their software or data, so it's out of the running. I suppose we could reimplement it if anyone cares enough to spend time doing so.)

[We used a bit of Java before it was entirely free - e.g. the Lucene search, which sucks much less than it used to and is pretty much usable now - but were reasonably sure Sun would proceed with their program to free it and we wouldn't be embarrassed by it. Which is just as well, 'cos we tried a Mono version of the Lucene search and it ran at about half the speed.]

Microsoft's revised CAPTCHA publication

[Anonymous Coward]

Microsoft's revised CAPTCHA busted. This is the latest publication on Websense's blogs. The spammers certainly seem to improve their attacks with every move. Authorities have to be more strict and more rigid in terms of punishing such spammers. Also, the domain registrars if spammers should be treated in the same way...hunt them and burst them!!!

3D CAPTCHA is the answer

[hat_eater]

Of course it can be beaten by a human but for quite a while it should deter the automatons: http://spamfizzle.com/CAPTCHA.aspx Oh, and I can't believe I'm the first to post this. It's been mentioned recently here or on Wired.

The best solution:

[nurb432]

Death to spammers and total shut down of companies using them including oppressive fines to the directors.

As long as there is a market, it will continue to exist.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:Captcha: Thirteen = 4 + ? Ask questions??

[Ash-Fox]

Where I am currently:

What color is the sky?

Gray.

What color is the sun?

White.

What is seven plus three?

seventhree

What common pet barks?

a canine pet.

What animal meows?

A feline.

What animal does milk come from?

All of them?

Your comment has too few characters per line (currently 7.3).

Internet finally a better place

[DrYak]

I just want to register to post a comment, not take my PhD exams.

Well, maybe the quality of internet forums will finally improve once all the "Fr1st ps0t", "me too", and other trolls are weeded out.

Hey, I think we finally found a solution against the never ending september

Re:Internet finally a better place

[russotto]

Well, maybe the quality of internet forums will finally improve once all the "Fr1st ps0t", "me too", and other trolls are weeded out.

Not likely. Because getting their comment posted is MORE important to the trolls than it is to the normals, making it more difficult to post will actually sway the balance in their favor; they are more motivated to jump through the hoops.

Re:Internet finally a better place

[lysergic.acid]

that depends on your definition of "normals."

i think to most moderately intelligent users, an arithmetic world problem or even a basic calculus equation, like taking the derivative of cos(x^2), wouldn't be that much harder than reading a very distorted CAPTCHA. it's just a different kind of difficulty. instead of straining to make out twisted and shrouded letters, you're just forced to think a little.

personally, i'd much rather complete a simple, straightforward mental exercise than to solve a randomly generated CAPTCHA, which you're likely to fail by misconstruing a lowercase "L" for a capital "I," or the number one.

of course, if you run a site like IGN, in which most of your posters are 13-year-old retards, yes, you might drive away a lot of your "normals." but you'd be sacrificing quantity for quality. there are still plenty of people willing to solve an easy challenge to make a post. a lot of people won't even be slowed down by them compared to standard CAPTCHAs.

besides, if you're not willing to make an effort to solve the CAPTCHA, then maybe your comment isn't really worth posting. it would at least make people put more thought into their posts and filter out a lot of kipple.

Re:Internet finally a better place

[Dan541]

besides, if you're not willing to make an effort to solve the CAPTCHA, then maybe your comment isn't really worth posting. it would at least make people put more thought into their posts and filter out a lot of kipple.

Perhaps the site is not worth me posting my comment on?

I have comment on blog that require me to register, since feedback is obviously not very important to them.

Re:Internet finally a better place

[lysergic.acid]

well, making you sign up is a different story since you have to give out your e-mail address, fill out a huge form, confirm the sign-up, etc.

and i didn't mean that as an insult. that statement would apply equally as well to anyone.

if you aren't willing to spend at least 30 seconds on a comment, then that comment probably isn't very well thought out. think of the difference between letters and e-mails, or e-mails and IMs. the more time & effort required for a particular communication, the more thought the sender will put into it.

most internet message boards i've been to have an overabundance of banal, poorly-written comments--things like, "me too," "LOL," "n00b!," etc.--that are just a waste of space. then there are the threads that consist entirely of people listing things (the last movie/tv show they watched, or the last song they listened to or book they read, etc.) there's nothing wrong with such threads per se, as long as they stimulate discussion, but these threads go on and on for pages with people just listing movie titles/tv shows and not a single comment on the things listed. it's utterly retarded. these people might as well just list these things in a text file on their computer if they have no desire to actually converse with someone else.

and i know that even i have made useless, poorly thought out comments on many occasions. it's just part of our compulsive nature when people have access to immediate self-expression.

Re:Internet finally a better place

[Dan541]

think of the difference between letters and e-mails,

Email is convenient and I often receive well thought out email as a result. I have however NEVER received a letter at any point in my life and I don't know how to send a letter except that you need to take it to the post office, unless you know how to stamp it yourself.

I don't know how you figure
Inconvenience = Responses

Because after writing several paragraphs I want to post my comment not register for the 999999999 billionth time. So I just scrap the response if I am asked to register. If people wish to keep their blogs closed that's their choice.

The FINAL SOLUTION

[Anonymous Coward]

KILL THE INTERNET!

It's just one small step for AI.

[DamnStupidElf]

Eventually, computers will pass any captcha we can create and thereby pass the turing test. Then we can just put them to work filtering spam for us.

Pay for the service.

[amn108]

I do not see a good reason why a third-party (as opposed to using ISP services, already payed for) email service should not be payed for?

hotmail spam Re:Captchas are no longer good enough

[damn_registrars]

spam emanating from hotmail accounts.

Do you see a large amount of spam coming from actual hotmail accounts? I know I have in the past, but lately my own experience is most spam comes from (bogus-name)@(bogus-domain). I don't see much spam that is routed through hotmail servers, either.

Not that I want to defend hotmail or their overlord Microsoft, but by my experience they have a pretty negligible role in spam propagation.

Actually, looking through my mail logs I would say that yahoo mail is probably a bigger problem in the spam and phishing epidemic. I have five different phishing emails pretending to be either IRS or FBI, all with yahoo.com return addresses that yahoo support won't do anything about.

Captcha

[LiteralKa]

So, what is this CAPTCHA? "ILUVBILLGATE$" or "MAC$UXX"? Grow up Microsoft, CAPTCHA is soooo 2004.

multiple captchas

[Mes]

How effective are spammer bots at deciphering captchas? If they are only 20% effective then why not have 5 pictures to solve. 0.2 * 0.2 * 0.2 * 0.2 * 0.2 = 0.032% which might be small enough to minimize the problem.

Re:multiple captchas

[egandalf]

Simultaneously minimizing the number of legitimate visitors who sign up on your site. I can deal with one, I can understand two. Put me at a third, and I'll leave your site as fast as my mind overcomes the inevitable WTF delay period.

The politicians can solve this

[Fjan11]

There are a million technical solutions proposed here but curbing spam should simply be left to politicians and lawyers. We know who the spammers are: they always want money and we can track that.

We just can't get at them because they are in different jurisdictions. But that can be solved by the UN by simply setting up an "international criminal court" like the one we now have for war crimes.

here's a better captcha

[nblender]

squiggly text that says, in effect:

If you are being paid to interpret this captcha, we will pay $1104 USD for aid in the arrest of spammers. Please contact _some email address_ and if your information helps us arrest your employers, we will pay you $1104 USD.

How much money could a person be paid to rat out their spammer-employer? [ ]

US Has Something Like That

[Anonymous Coward]

secondly, you need a large budget and specialized training in invading hostile territory and killing possibly armed men in ambushes and guerrilla tactics.

So we can send the CIA?

Artificial Intelligence

[not-my-real-name]

I've been wondering if the arms race between spammers and people trying to stop them may be what eventually leads to a true artificial intelligence.

Consider: We want to distinguish between a machine and a human (presumably intelligent). The spammers are motivated to make their machines act more and more intelligent. We also want to distinguish between valid, meaningful messages and spam.

So, on both fronts there is pressure to increase the intelligence of the machine.

Ultimately, there will be one set of AIs sending messages to another set of AIs offering to improve body parts that the AIs don't have.

Re:hotmail spam Re:Captchas are no longer good eno

[ralphdaugherty]

Do you see a large amount of spam coming from actual hotmail accounts? I know I have in the past, but lately my own experience is most spam comes from (bogus-name)@(bogus-domain). I don't see much spam that is routed through hotmail servers, either.

      yes, that's my experience as well. Hotmail now comprises a small portion of my incoming.

      I think most spam is coming from PC's with forged from addresses, and I can attest that my email address or some from my domain are used in that forging periodically, including recently. I get all the spam rejection emails from it, but Postini catches most of them so not a problem.

  rd

Weak identity verification, control/permission dns

[scientus]

I honestly think strong identity verification such as XMPP additional headers or even the "who is allowed to send from my address" dns extentions are absolutely critical in getting anywhere. From there it provides the recievers more control in hard filtering

Shit posing as mail

[tepples]

First of all, stop calling it SPAM. It's not an acronym

It's at least a backronym: "shit posing as mail".

Re:Captcha: Thirteen = 4 + ? Ask questions??

[bussdriver]

Fixed dictionary.
Items will be reused and therefore the more known answers the higher the odds are that will be asked a known. One doesn't need to use humans that much to get a reasonable result--- setup a website that mirrors the problems to get people to solve it for free for you. Something people will be motivated to do it...

Spammers Targeting Microsoft's Revised CAPTCHA

[Miow]

I am not a programmer (in fact a 78 year old ex-sailor), but I do waste my time doing puzzles like those on jigzone. It seems to me in my ignorance, that it may be possible to have a Captcha like a puzzle that has two or more pieces that can be simply put together with a mouse. Does that sound stupid?

At least for ASP.NET

[Anonymous Coward]

At http://www.mondor.org/captcha.aspx there is a very good (and free!) ASP.NET component which shows what sophisticated CAPTCHA may look like. For example, it can display a mathematical equation, like "35 + 7" and expect "42" as an answer.

NB: Math equation is available in 2nd version, which is downloaded in forum area of that site.

Picture matching

[DaVince21]

One method of security I've seen on forums and such is image matching - you have a field of 9 to 16 somewhat random pictures, and have to pick out the three or four ones that have "a car" or "a cat" in them... This is pretty good human security, especially if you try to make as many pics and only few picture combos.
Wouldn't work on email, of course.