Now Even Photo CAPTCHAs Have Been Cracked

MoonUnit writes "Technology Review has an interesting article about the way CAPTCHAS are fueling AI research. Following recent news about various textual CAPTCHAs being cracked, the article notes that a researcher at Palo Alto Research Center has now found a way crack photo-based CAPTCHAs too. Most approaches are based on statistical learning, however, so Luis von Ahn (one of the inventors of the CAPTCHA) says it is usually possible to make a CAPTCHA more difficult to break by making a few simple changes."

Comments

How about

[Rik Sweeney]

Instead of asking someone to type in the letters, numbers or how many cats there are in the photo, just randomly generate some scenario:

"Jim and Sue go to the park on Sunday. Billy the dog goes too."

Then you can ask random questions like:

"What is the name of the dog?"
"What day did they go to the park?"
"Where did they go?"

That might work OK for a while...

Re:I don't get it

[Abstrackt]

The best security I've seen on a sign-up form was "if you're a human, please leave this field blank". Bots tend to fill in all fields, so this already goes a long way towards filtering them out.

You can even take this approach one step further and use CSS to move the field outside the viewable range of the page or set its visible property to false so the user won't even see it.

Re:damn it

[Beardo the Bearded]

Ah-hah! I've got the answer to our CAPTCHA problems:

We just make them so hard that it becomes impossible for a human to solve it. Then we invert the solution: if you pass the CAPTCHA, you're obviously a bot, because a human can't solve it. FAIL the CAPTCHA, we know that you're human.

Re:damn it

[Chapter80]

We just make them so hard that it becomes impossible for a human to solve it. Then we invert the solution: if you pass the CAPTCHA, you're obviously a bot, because a human can't solve it. FAIL the CAPTCHA, we know that you're human.

You say this in jest, and I admit it made me smile, but we did something somewhat like this.

We have a website with a contact form on it, that gets lots of spam. After numerous discussions with marketing about implementing CAPTCHAs, we decided to simply put a text box on the form that says "leave this blank", with the HTML form field named "comment". Humans leave it blank. And sure enough, the spammers cram their links into all form fields, so we can ignore their crap.

We initially even made the form hidden (CSS font color and field color the same as the background), so a user wouldn't even see it. That was great.

Not a perfect solution for all cases, but it worked pretty well for us.

Re:damn it

[Beezlebub33]

Ah...reminds me of one of my favorite t-shirts:

http://www.tshirthell.com/funny-shirts/fuck-the-colorblind/

The underlying problem is that we're running out of things that are easy for people but hard for computers. Most attempts to expand or 'improve' visual CAPTCHA at this point will cause more pain to humans than reduction in computer success.

So, let's change directions, and make the computer solve a different sort of problem. For example, a turing test of sorts, where the problem is to solve something that is difficult to parse programmatically, but relatively easy for a person to answer. Maybe the recent Turing test results are a good indication of what the questions should be. Multiple related questions would be an particularly interesting area; for example, ask related questions where pronouns are ambiguous (to a computer).