Campaign To Kill CAPTCHA Kicks Off

Bismillah writes "CAPTCHA may be popular with webmasters and others running different sites, but it's a source of annoyance to blind and partially sighted people — and dyslexic people and older ones — who often end up being locked out of important websites as they can't read wonky, obfuscated letters any more than spambots can. A campaign in Australia has started to rid sites of CAPTCHA to improve accessibility for everyone."

Comments

Protection against drunk posting

[Anonymous Coward]

Makes it useful.

Re:Protection against drunk posting

[Richy_T]

I often need three stiff drinks just to be able to read the things.

Re:Protection against drunk posting

[WaywardGeek]

I've had four stiff drinks, and I can tell you that captchas still piss me off. I've got some crazy stupid central vision loss disorder, which is a real pisser for a professional programmer, but at least I'm not a surgeon. Captchas should be replaced with simple questions that currently only humans answer reliably. For example, "What color is the sky on a clear sunny day?". My site occasionally gets wise-guys answering "pink... on Mars".

Re:Protection against drunk posting

[RedHackTea]

stiff drinks? Is this an Aussie thing or an alternative to viagra?

Re:Protection against drunk posting

[ultrasawblade]

How many unique such questions can you generate automatically?

Part of the advantage of a CAPTCHA based on random sequences of letters and numbers is that if done right it should be impossible to build a database of all possible CAPTCHAs and correlate them with anything the CAPTCHA generator creates.

Re:Protection against drunk posting

[philip.paradis]

No, a stiff drink is what happens after the Viagra, but there's a bit of pump priming required as well.

Re:Protection against drunk posting

[tsalmark]

I think in all of N.A. a stiff drink is any hard liqueur, with or with out ice.

Re:Protection against drunk posting

[bratwiz]

Not to mention automatically OCR every book ever written... some Project Gutenberg sneakiness...? You be the judge.

Re:Protection against drunk posting

[hairyfeet]

You don't need to, because i thought we already solved this problem with kittenauth ages ago? I mean with kittenauth any human can tell you "Which kitten has a black patch on the right eye" or "Which kitten has a bobtail" but a spambot isn't gonna be able to figure out squat from that. Of course i suppose you could pay some Chinese a buck an hour to answer but you could do that to CAPTCHA as well, and at least this way we get to see kittens.

Re:Protection against drunk posting

[plover]

Don't try to beat them all in advance. Spammers have shown they will adapt.

Instead, the key is to update CAPTCHAs only in response to an automated spammer breaking through. Offer ten rotating questions today. If the robots get through, offer ten different rotating questions tomorrow. Make it expensive for the spammers to continually update their robots, and make it cheap for you to update your questions. Beat the spammers on cost.

How else do I protect my forms

[Anonymous Coward]

from automated submissions?

Re:How else do I protect my forms

[wierd_w]

Make it time prohibitive?

Prevent "5ns form posting" with a cooloff time, and also cache submitted forms from an IP address to prevent duplicates.

You can also implement a 50 message per day limit, and reduce as needed to stop spammers.

Re:How else do I protect my forms

[Anonymous Coward]

What if I want my users to be able to post the form more than 50 times per day?
Cooldowns and cacheing just wont do it. The only real alternative I see is to hide the form behind a login, which in the end is more inconvenient for the end user than a user friendly captcha.

There are simple ones that are easy on the eye out there ( like slashdot's ), and you can make your own quite easily as well. There is one widely used one, reCAPTCHA I think, that is just awful and should be avoided.

Re:How else do I protect my forms

[greenreaper]

Unfortunately it's not all coming from a single IP address - there are literally thousands out there - and any one would only post as regularly as a standard user, with randomized text from large templates. You stop them at various layers - DNSBLs, CAPTCHAs, form entry field checks, link checks, specific spam text . . .

Re:How else do I protect my forms

[Anonymous Coward]

from automated submissions?

If you don't know any alternatives, you shouldn't be administering them.

Yeah, I guess the folks at Google, Yahoo, Microsoft, Amazon etc don't know what they are doing either. Captcha is used because there is no real alternative if you want anonymous form submissions on your site. There are certain measures we can put in place, in certain contexts, but no catch all one size solution.

Re:How else do I protect my forms

[amicusNYCL]

Add some fields which start out as regular text fields but then hide them with Javascript. You can give them labels or default values like "Don't change this" in case someone doesn't have Javascript enabled. Give the real fields in your form random names. For the hidden fields, give them names like "subject" or "comments" or "url" (don't use common names for personal info like "email", "fname" etc that the browser might automatically fill out). When they submit the form, check for values in those hidden fields (either any value at all, or a value different than the default). If they are filled out, reject the form. Hiding the fields with Javascript will work for virtually everyone and it doesn't require real people to do anything extra. This will fail against bots that bother to actually render the page or bots that specifically target your site (which can be remedied if you randomize all field names and store the random names in the session to match them up when the form gets submitted), but those are far less common than bots that just get the HTML and parse it to look for form actions and field names.

Re:How else do I protect my forms

[Anonymous Coward]

This wont work. Just like in the real world, if you have a secret, and I know how you are storing your secret, you lose.

If the code representing Captcha is as you describe, it becomes easier to parse the javascript to find the names and submit the form. So now the captha needs to be a mutating algorithm to defeat this and now the bad guys are going to work out the random seed in your code to allow them to predict the next form sequence. Now you avoid anything computablly random (how?!) and now brute force is used to DOS the site.

It really isnt easy. Captcha is darn annoying when it locks out 99% of the users, and we have a life ahead trying to outwit the bad guys or good guys.

Re:How else do I protect my forms

[tftp]

You cannot stop a social problem with a technological measure. If all fails, the spammer will hire 10,000 people in Africa to post spam using cut and paste templates.

A partial solution can be achieved only if each poster has to authenticate with the server using a globally unique ID that is assigned to that person at birth. Then if that person abuses their right to post, you can kick them by that ID - and they have no other ID to use. In the end spammers will run out of willing workers.

Naturally, religionists will have a problem with their panties, but it is indeed strange that people don't have a planet-wide ID. They should have it; then so many problems would disappear. (and new ones appear.)

Re:How else do I protect my forms

[IamTheRealMike]

Google et al don't rely on CAPTCHAs exclusively, at least not for important things. Google accounts uses phone verification driven by some very sophisticated analyses of the signup data. You can actually choose to skip the CAPTCHA on Google signup if you like, phone verification is used as a replacement.

Re:How else do I protect my forms

[EvanED]

Add some fields which start out as regular text fields but then hide them with Javascript.

How is this harder to break than CAPTCHAs? I mean, CAPTCHAs are (or maybe were) actually a decent research question for how to get OCR resilient enough to solve them, or you have to figure out how to hijack other people to solve them for you. By contrast, ignoring fields that are hidden by Javascript seems like... 10 minutes of engineering.

OK, I'm exaggerating a bit. But I really don't see the difficulty there, especially when you start putting in "don't change this" for people sometimes like me with JS off.

You say that bots that pay attention to that aren't common now, but bots that do a decent job at solving CAPTCHAs also seem relatively rare, and if the "hidden fields" became as popular as CAPTCHAs are now I bet you'd see a lot more of them...

[targeted bots] can be remedied if you randomize all field names

And now you've broken form autofilling, which means that real people now need to fill out a lot more fields than they do if you have a CAPTCHA.

(Obviously not every form benefits from filling out, but I bet a lot of the ones where you'd see a CAPTCHA do.)

Re:How else do I protect my forms

[amicusNYCL]

Defeating a human reading the source code is not the point. The point is to defeat a bot reading the source code. Another solution that was pointed out was to use CSS to target the hidden element's parent and hide that through regular CSS, which would eliminate the Javascript. Now you're talking about a bot that renders the entire page and fills out the form visually, which is not common (if done at all).

Re:How else do I protect my forms

[amicusNYCL]

And now you've broken form autofilling, which means that real people now need to fill out a lot more fields than they do if you have a CAPTCHA.

That's true. It's not really necessary to randomize all of the fields, but it makes another good test if none of the regular fields are filled out or if they all have the same text in them. It's really only necessary to add fields with certain names that would trigger a bot to fill them out ("subject", "message", "comments", etc), and another suggestion was made to use CSS to target the field's parent element and hide that, which wouldn't require Javascript.

I think it's worth spending time on though, I use it for all of the contact forms I set up and it does a good job to stop spam. The best thing about it is that "normal" users never even come into contact with it, they don't even see it. The hidden field thing would need to be tested with screen readers though to make sure they also don't pick up the hidden fields. It also counts on bots being lazy and not actually rendering the page, which they might end up doing.

Re:How else do I protect my forms

[Macgrrl]

The only real alternative I see is to hide the form behind a login, which in the end is more inconvenient for the end user than a user friendly captcha.

That's the catch though, "user friendly captcha"s. Most of the time I encounter them I need to generate at least 4 of them before I encounter one I can actually read. And my eye sight is reasonably good.

That's before you take into account visually impaired users who are trying to do it from an audio queue.

Re:How else do I protect my forms

[ArcadeMan]

Spammers have millions of low-wage users at their disposal, none of these proposals will ever work.

FTFY

Re:How else do I protect my forms

[petermgreen]

Prevent "5ns form posting" with a cooloff time,

That helps to a point but if it becomes too common spammers will just design their spambots to work with whatever delays are commonly used. It means keeping a little more state in the spambot.

and also cache submitted forms from an IP address to prevent duplicates.

That helps to a point but if it becomes too common website spammers will just add message mangling just like email spammers do today.

You can also implement a 50 message per day limit, and reduce as needed to stop spammers.

50 messages per what per day?

50 messages per IP per day would cause a lot of pain to users stuck behind large scale NATs and probablly wouldn't impede the spammers too much, they often have an army of IPs under their control. 50 messages per user account per day would just cause the spammers to register lots of user accounts.

The problem with a lot of "clever" soloutions to spam is they work fine as long as their userbase is too small for the spammers to care. Once their userbase becomes big enough though the spammers will start putting real effort into attacking them.

Re:How else do I protect my forms

[petermgreen]

You cannot stop a social problem with a technological measure.

Maybe you can't stop it but you can often reduce it to more manageable levels.

Re:How else do I protect my forms

[danbert8]

Wouldn't it just be easier to teach people not to buy shit from spammers? Then wouldn't the problem go away?

Re:How else do I protect my forms

[ninlilizi]

I've found 100% success with a unique solution.

I've run a Lord of the Rings Online guild website with forum for many years.

Eventually I set the first input field on the registration page to a combo box for players to enter the class of their character.
The first and default entry is 'Scammer' ... Any restration attempts that choose this get auto banned.
Not had a single piece of forum spam ever since.

Re:How else do I protect my forms

[tftp]

Wouldn't it just be easier to teach people not to buy shit from spammers?

This is about just as easy as to teach people not to send spam.

The fact is that exactly 50% of the population have IQ below average. They operate with what is available to them. Some are only smart enough to send spam; other are not even as good, they read it and believe what they see. Some can't even read cursive :-) I can't imagine what avenues are open to those.

Re:How else do I protect my forms

[philip.paradis]

Millions of people are stupid enough to buy prescription medications of highly dubious origins and formulation from spammers. Every now and again you'll see a news piece about some idiot winding up hospitalized or dead as a result. This is a fine demonstration of a level of stupidity that you simply cannot overcome.

Re:How else do I protect my forms

[vux984]

What if I want my users to be able to post the form more than 50 times per day?
Cooldowns and cacheing just wont do it. The only real alternative I see is to hide the form behind a login, which in the end is more inconvenient for the end user than a user friendly captcha.

If users need to post 50x per day, then logging in isn't going to be more inconvenient than a captcha.

Re:How else do I protect my forms

[ultranova]

A partial solution can be achieved only if each poster has to authenticate with the server using a globally unique ID that is assigned to that person at birth. Then if that person abuses their right to post, you can kick them by that ID - and they have no other ID to use. In the end spammers will run out of willing workers.

Thus replacing a minor irritant with every tyrant's wet dream. And it wouldn't even stop spam: spammers would simply use a virus to send their spam from your machine in your name.

Re:How else do I protect my forms

[piripiri]

a globally unique ID that is assigned to that person at birth

What? Are you insane?

Re:How else do I protect my forms

[LanMan04]

Yup, did this years ago to protect against bots submitting our contact forms (Credit Union website).

I believe we hid the honeypot fields with CSS instead of JS, but either way it was damn effective.

Wouldn't it be ironic...

[Alejux]

If the campaign was taken over by bots?

Re:Wouldn't it be ironic...

[Evil Pete]

This is GENIUS! This is one of those ideas that must be implemented.

This is a very hard problem

[stewsters]

"W3C has suggested other techniques such as logic puzzles, limited-use accounts and non-interactive checks to prevent abuse such as fraudulent account creation and spamming."

Its going to be far harder to make an AI that can create a decent logic puzzle as well as make it accessible and hard for computers to solve than it it to make an image and warp it a bit. I think any such puzzle will probably be worse than the audio captcha button.

Re:This is a very hard problem

[CanHasDIY]

"W3C has suggested other techniques such as logic puzzles, limited-use accounts and non-interactive checks to prevent abuse such as fraudulent account creation and spamming."

Its going to be far harder to make an AI that can create a decent logic puzzle as well as make it accessible and hard for computers to solve than it it to make an image and warp it a bit. I think any such puzzle will probably be worse than the audio captcha button.

Not to mention, logic puzzles are unfair to people who have trouble understanding logic; which, in my experience, is damn near the entire human race.

Just swapping one type of perceived discrimination for another.

Re:This is a very hard problem

[i kan reed]

Yeah, but we value what blind people have to say. "Damn near the entire human race" can go fuck themselves.

Re:This is a very hard problem

[amorsen]

For every task that a computer is unable to handle, there exists a reasonably well-functioning human who cannot do it either.

Re:This is a very hard problem

[Anonymous Coward]

That's a feature, not a bug.

Re:This is a very hard problem

[king neckbeard]

It's quite likely that some forums may prefer only letting in people capable of understanding logic, and there aren't any laws against discriminating against those people.

Re:This is a very hard problem

[CanHasDIY]

It's quite likely that some forums may prefer only letting in people capable of understanding logic, and there aren't any laws against discriminating against those people.

Perhaps, but if you're trying to monetize the site you're running you'd be a fool to do something that prevents a good 80-90% of people from accessing it.

Re:This is a very hard problem

[Zmobie]

I think you're missing the idea of what type of logic puzzles they mean. Simple things like image processing (someone in the comments below brought the example up of using company logos and you type the name, pizza toppings matched to the correct pizza) or natural language processing could be used to WRECK a bot. Imagine this, I pose the question as a human verification, "What color was George Washington's favorite white horse?" A human (with half a brain) easily sees how stupid simple it is to find the answer which is white, but a bot would have hell with that type of question because it involves language processing to determine the appropriate response. That is a pretty simplified example, but you can find these all over the place and they are fairly easy to create.

Some of these could be defeated easily with something like a call to Wolfram Alpha, but you could quite easily find and create things that are not going to be simple to automate the logic processing, but would be completely trivial for a human to process, even stupid ones. Language and image processing are RIDICULOUSLY difficult to automate efficiently which would defeat the purpose of the bots, while making things a lot easier on the people that do have to deal with this sort of thing. I personally hate the current version of CAPTCHAS (hell, I can't read some of the more difficult ones and I write some of the software that USES them), but I do recognize the need for them. No reason they can't be improved upon though.

Re:This is a very hard problem

[tlambert]

It's quite likely that some forums may prefer only letting in people capable of understanding logic, and there aren't any laws against discriminating against those people.

Even if there were, let them take you to court on it, it's not like they're going to be able to make a reasoned complaint, right? ...

Re:This is a very hard problem

[Qzukk]

Wolphram Alpha had no idea about the color of Washington's favorite white horse (it looked up the distance between some town named George, WA and White Horse,NJ), but if you put it into google, you discover that Washington had no white horses, the closest being a gray named Blueskin.

Re:This is a very hard problem

[CanHasDIY]

I think you're missing the idea of what type of logic puzzles they mean.

... and here I was thinking that the last half of the statement made it pretty obvious I was being satirical.

Now, now I'm no longer sure that I was joking...

Re:This is a very hard problem

[mstefanro]

> someone in the comments below brought the example up of using company logos and you type the name
Sounds like something the computers can do better at than humans.

> Imagine this, I pose the question as a human verification, "What color was George Washington's favorite white horse?"
But would a computer be able to easily ask questions that itself cannot answer, but a human can? It sounds like
a set of formulations would have to be hardcoded, such as: "What [trait] was [person]'s favorite [trait value] [object]? -> [color]".
But these formulations can also be hardcoded in the bot, so this is not really a solution.

Re:This is a very hard problem

[mstefanro]

While this has the sounding of a very wise saying, I really doubt it is anywhere close to being true.

Re:This is a very hard problem

[Threni]

No, that's what lawyers are for.

Re:This is a very hard problem

[ZombieBraintrust]

Simple things like image processing

Are off limits and would be banned by this campaign. They are looking for test that can be solved by blind people.

That is a pretty simplified example, but you can find these all over the place and they are fairly easy to create.

How are these easy to create? To create these questions a program would need to start out with an answer. In this case white. It would then need to randomly generate a unique question that has never been asked before whose answer is white. This question would need to be easy for humans to solve. But it would need to be impossible to solve by the program that just generated the question. Ohh and you need to generate millions of these question answer pairs everyday. It also needs to be done quickly. People don't want to wait longer than a second for the CAPTCHA to load.

Re:This is a very hard problem

[OneAhead]

If every spammer would need a Watson-class supercomputer to stay in business, being a spammer suddenly doesn't seem very lucrative anymore...

Re:This is a very hard problem

[Zmobie]

That misses the point. In this very singular instance yes it is easy to solve that one pattern, but you could formulate questions that are ridiculously easy to solve that even if they popped up in search or logic engines the bot would still need to use language processing to get past them.

Re:This is a very hard problem

[Zmobie]

But would a computer be able to easily ask questions that itself cannot answer, but a human can?

That is very nearly the basis of thought for encryption so I would say it is fairly possible. It is not trivial, but using some language processing techniques you could probably come up with some fairly simple questions and answers on a regular basis. Now, creating them on the fly might be more difficult I admit, but with some effort may be possible.

Re:This is a very hard problem

[Zmobie]

Simple things like image processing

Are off limits and would be banned by this campaign. They are looking for test that can be solved by blind people.

This isn't necessarily an end all solution I am suggesting, but definitely an improvement. This is no more excluding than the current system and helps in all cases but the one you suggest. Why would you shoot down an improvement if it gets all but one corner case while the current system barely even works in the general case?

That is a pretty simplified example, but you can find these all over the place and they are fairly easy to create.

How are these easy to create? To create these questions a program would need to start out with an answer. In this case white.
It would then need to randomly generate a unique question that has never been asked before whose answer is white.
This question would need to be easy for humans to solve. But it would need to be impossible to solve by the program that just generated the question.
Ohh and you need to generate millions of these question answer pairs everyday. It also needs to be done quickly. People don't want to wait longer than a second for the CAPTCHA to load.

Well, these are easy for a person to create, and while I admit a dictionary style would be difficult to maintain and be attack-able if the bots could get the dictionary, I would think in theory some of this could be generated with proper algorithms as this is the essence of encryption (albeit encryption is math based witchcraft to your average user). At the very least some measure of formula could be used to create some of this I would think, but I would have to do some significant work to figure that out (work I am not getting payed to do at that, i.e. spare time).

Re:This is a very hard problem

[Meneth]

Sure it is. For example: design a fusion reactor.

Re:This is a very hard problem

[Zmobie]

Not to be offensive or insulting, but that was some pretty weak satire. Especially when 95% of the internet (including slashdot) posts some very piss poor comments and arguments about things and they are totally serious.

Re:This is a very hard problem

[Zmobie]

Pretty much this. I am actually a software engineer and hold a degree in Computer Science, I know a thing or two about the processing power required for this and just because it can be done on the large scale of a supercomputer like Watson, doesn't mean your average spammer can even come close to natural language processing of that level.

Re:This is a very hard problem

[mpeskett]

Whatever you use, you need to be able to generate an arbitrary amount of it without significant repetition, without structure that can be automated towards, and with a large "answer space" (number of possible answers) to make the percentage of 'lucky guess' answers extremely low. Oh, and it needs to be easy for humans but difficult for computers.

Generating distorted text is perfect - random characters, random distortions, nothing about the form of the puzzle that can be used as a shortcut to the answer, guessing strings at random is fruitless, and it hits computers right in the vision, where they (used to) suck and we're really good. Unfortunately that gap is narrowing, and humans on the lower end of visual acuity are getting locked out.

Generating an endless stream of simple trivia questions is going to require a significant bank of facts, then you're going to hit the problem that if the generation method is known it can be reversed and used against you (e.g. if the answer aways appears as a word in the question, just guess a randomly chosen word from the question and you get a trivially easy 10% or so success rate). Automating the question generation is almost as hard as automating the answers...

Re:This is a very hard problem

[YukariHirai]

Still discriminatory. "The entire human race can go fuck themselves" would be acceptable, though.

Re:This is a very hard problem

[tftp]

Does it have to work?

Re:This is a very hard problem

[ZombieBraintrust]

In order for websites to use your system you would have to share the source code and the dictionary. Even if you closed sourced the project they would have a complete list of questions 24 hours after you went live. These types of things are not easy to do. If they were people would be doing them and we would not have spam.

Re:This is a very hard problem

[Somebody Is Using My]

design a fusion reactor.

Easy.

Components required
3 light years cold, empty space
2.0 E30 kg molecular hydrogen
insignificant chunks of other elements
1 billion years

Instructions
disperse hydrogen in center of open space.
give hydrogen a little whirl to get things going
add other elements to taste
wait.

Re:This is a very hard problem

[roc97007]

My understanding is that to equestrians, there is no such thing as a "white" horse. They're called "grey", no matter how snowy white they might appear.

So I answer "white" and..... Wrong? Crap. Try again.

Ok, "who is buried in Grant's tomb?" Easy... Grant.

Wrong AGAIN? Crap!! (Grant's remains are entombed aboveground, not buried.)

We could do this all day!

Re:This is a very hard problem

[jeff4747]

You're assuming warping an image a bit works.

It's really not that hard to break. It's just most botters get enough posts without bothering.

Re:This is a very hard problem

[garvon]

I think there are no white horses. The are classified as grays.

Re:This is a very hard problem

[rtb61]

What is needed is an analogue activity that a computer can not replicate but that can still be digitally encapsulated and transmitted and that can be automatically tested by a computer as being valid. This goal with ever increasing computing power looks to be impossible.

What people really need is a free open source range of douche-bots to scan inputs and reject them. A range of them to cover the various input activities, of course that would mean passing them through a secured support centre that could recognise various bot, hack, spam activities and then reject them. This seems the better solution as the capability of the douche-bot evolves with the computing powers of the douches.

Re:This is a very hard problem

[pspahn]

Exclusivity has its place. If the remaining 10-20% finds that it is worth it to keep those other cretins out, you'd be a fool to do something that allowed these masses of dolts inside the wall.

Re:This is a very hard problem

[TheLink]

What you could do is have a logic test and somewhat easy to read captcha test then:
a) if your account passes both tests you end up in Group 1
b) if your account passes the logic test but fails the captcha test you end up in Group 2
c) if your account passes fails the logic test but passes the captcha test you end up in Group 3
d) if your account fails both tests you end up in Group 4.

What you can see or access then depends on what group you are in and which part of the site. If you are in Group 1, you can access all forums and sections including Group 1 only forums. There should also be shared forums, but you can choose not to see posts by other groups. You could do something similar with Libertarian, Democrat and Republican. That way your site can serve multiple groups and they get to see what they want. ;)

I've long wondered about setting up something like a review site with a vaguely similar concept - you can choose to see things from any of the various automatically and manually computed Point of Views (most people tend fall into fewer groups for food, movies etc). Sometimes you're not buying stuff for yourself. So if you want to buy a present for your niece/aunt, you might enter her preferences and other details that you know of, then select a possible matching Point of View and go shopping based on that point of view.

Facebook or Amazon could probably do something like this from their "Likes" data.

Re:This is a very hard problem

[mysidia]

Its going to be far harder to make an AI that can create a decent logic puzzle

You don't necessarily need a full-blown AI to generate questions; you could use a series of templates with portions selectable from a predefined list. Build a library of questions with some bit of code for each question template. Yes, an adversary could eventually build a bot for one template.

Given that there are [number from 2 to 8] [painted,in a condition of being] [lit,unlit,orange,green,yellow,red,blue,....] and [number from 2 to 8] [square,round,triangular,....] [lights,blocks,LEDs,displays....] out of a total of [number from 11 to 30]; the [lights,blocks,LEDs,displays....] that are not [painted,in a condition of being] [lit,unlit,orange,green,yellow,red,blue,...] are all [painted,in a condition of being] [lit,unlit,orange,green,yellow,red,blue...], except [number], and all the [lights,blocks,LEDs,...] that are not [square,round,triangular,circular,lit,,....] are [square,round,triangular,circular,lit,,....].
The [square,round,triangular,circular,lit,,....] [lights,blocks,LEDs,displays....] are also [smooth,rough,sharp,metallic,cold,vibrating,rotating,...]. The blocks that are [painted,in a condition of being] [lit,unlit,orange,green,yellow,red,blue,....]

The first [number from 1 to N] [lights,blocks,LEDs,...] are [painted,in a condition of being] [lit,unlit,orange,green,yellow,red,blue,....]
The first [number from 1 to N] [lights,blocks,LEDs,...] are [square,round,triangular,circular,lit,,....]
The ones in positions [number from a to b] {except [list of numbers]} are [smooth,rough,sharp,metallic,cold,vibrating,rotating,...]
The ones in positions [number from a to b] {except [list of numbers]}are [smooth,rough,sharp,metallic,cold,vibrating,rotating,...]

CAPTCHA Question: Please enter the [comma separated list or number] of items that [are,cannot be,might be] { [smooth,rough,sharp,metallic,cold,vibrating,rotating,...] or [painted,in a condition of being] [lit,unlit,orange,green,yellow,red,blue,...] or [square,round,triangular,circular,lit,,....] }

In addition; if every item that is { [smooth,rough,sharp,metallic,cold,vibrating,rotating,...] or [painted,in a condition of being] [lit,unlit,orange,green,yellow,red,blue,...] or [square,round,triangular,circular,lit,,....] } has a A% chance of being [desired,wanted,hated] and the others have a B% chance [plus number from 0 to 10%] if the item is { [smooth,rough,sharp,metallic,cold,vibrating,rotating,...] or [painted,in a condition of being] [lit,unlit,orange,green,yellow,red,blue,...] or [square,round,triangular,circular,lit,,....] }.

What are the highest and lowest possible chances for block [number from 1 o 30] to be [not] [desired,wanted,hated] ?

Please enter three status words to describe item # 5 :

Re:This is a very hard problem

[mysidia]

Not to mention, logic puzzles are unfair to people who have trouble understanding logic; which, in my experience, is damn near the entire human race.

At least there is some Meritocratic element of being able to solve a simple logic puzzle; versus not having been blessed with good vision.

If you cannot understand basic logic -- do you really have anything intelligent to say, or is it likely to be flawwed?

Personally, I believe it's wasted on internet forums though --- a test for understanding of logic should be applied at the voting booth, not in online forums.

Re:This is a very hard problem

[mysidia]

Even if there were, let them take you to court on it, it's not like they're going to be able to make a reasoned complaint, right? ...

You might have missed the fact, that when it comes to technology: many judges and jurrors fall into the same category as people not capable of fully understanding logic --- or the related category of people who can be persuaded despite logic (sometimes via money, relationships with the attorneys involved, or arguments that are emotional or otherwise sound persuasive even though irrational and bad reasoning).

Re:This is a very hard problem

[mysidia]

Simple things like image processing (someone in the comments below brought the example up of using company logos and you type the name, pizza toppings matched to the correct pizza) ,

Wait... typing the name of the content you see in an image? That doesn't exactly resolve the objections of blind people. Although poorly sighted people should find it easier to identify toppings on a pizza, than horribly distorted text.

Re:This is a very hard problem

[mysidia]

For every task that a computer is unable to handle, there exists a reasonably well-functioning human who cannot do it either.

How about this task... hold up a copy of your state ID to the webcam, and let the site use image recognition to check its authenticity. (2) Enter your phone number, and click this button to receive a telephone call; when the phone answers, please dial this 6 digit code, press pound, then say your name.

Of course what we really need is SSL and a client-side certificate for every unique human :)

Re:This is a very hard problem

[mysidia]

I have an alternative suggestion to logic puzzles: Payment

To signup, you can choose to complete the Captcha, or you can send me $1 PayPal, or 1 Bitcoin. If you pay me, then you get to register without answering the Captcha.

Then blind people can still gain access, by exercising the alternative option; there is just a nominal fee -- just like they had to pay a nominal fee for the screen reader and their other assistive devices.

The forum admin could also provide a street address, for blind people to mail a human-signed form with a self-addressed stamped return envelope to receive a transaction code for 'free' access; that would be a reasonable accomadation.

Re:This is a very hard problem

[evilviper]

hold up a copy of your state ID to the webcam, and let the site use image recognition to check its authenticity. (2) Enter your phone number, and click this button to receive a telephone call; when the phone answers, please dial this 6 digit code, press pound, then say your name.

Most people don't have webcams connected to their computers... Getting more common thanks to phones and tablets, but it's quite common that there's only one on the front or the back. Besides, when you ask me to install some app that gives you access to my webcam, I'm going to tell you to fuck off...

State ID's are easily forged with basic image manipulation. The app only gets a photo, it doesn't know you're injecting a still PNG into the video stream, or that you're holding-up a print-out of an ID.

Voice isn't that hard for machines anymore... TTS and voice recognition are reasonably good. Not to mention people who are either deaf or mute are screwed, so you're cutting off another group instead of the blind.

Re:This is a very hard problem

[AK Marc]

http://abcnews.go.com/US/court-oks-barring-high-iqs-cops/story?id=95836

Well, they can ban you for being too smart, so why not for being too dumb?

Re:This is a very hard problem

[mysidia]

Voice isn't that hard for machines anymore... TTS and voice recognition are reasonably good. Not to mention people who are either deaf or mute are screwed, so you're cutting off another group instead of the blind.

The image-based Captcha can be offered as an alternative for the deaf or mute.

If they are blind, deaf AND mute all 3 at the same time, then yeah, there is a problem. Although as mentioned earlier.... I think the Alternative to Captcha should be pay $1 --- $1 from a confirmed Paypal address, and you get signed up -- no questions asked. Only a small number of sites should need to go to extreme lengths -- the financial sites. Everyone else can leech off that identification and proof of humanness by leveraging a token financial transaction or security-token based identity to do so; try as they might, bots can't readily clone such things.

State ID's are easily forged with basic image manipulation. The app only gets a photo, it doesn't know you're injecting a still PNG into the video stream, or that you're holding-up a print-out of an ID.

There are commercial services that specialize in that sort of thing, and I am certain they have given some thought to that risk. You don't get to just have a still image of the ID; you have to rotate it on camera.

If the forums/sites are using the same service; you don't think it will raise alarm bells if the same ID is being used to attempt automated signups to large numbers of forums?

Re:This is a very hard problem

[jecblackpepper]

You seem to have ignored the problem of generating the millions of natural language questions that would then require natural language processing to solve. It's easy to come up with one or two as a human, like the George Washington question above, but unless the majority of questions posed as a replacement for CAPTCHA are unique then all that will happen is that the spammers will use a human to solve the relatively few questions and store the result in a lookup table.

We can see how difficult it is for spam bots to generate to natural language posts so why do you think it would be easy for a computer to generate meaningful natural language questions?

So to paraphrase you: now every web site would need a Watson-class supercomputer to stay in business, being a site operator suddenly doesn't seem very lucrative anymore...

Re:This is a very hard problem

[AmiMoJo]

Even that's discriminatory. Some people can't fuck themselves.

A strange game. The only winning move is not to play.

Re:This is a very hard problem

[tofarr]

But how many such questions could you create? In your example, it would be trivial to look for strings starting with "What color" and then search for known color strings in the rest of the text - Add that to the rules of your spam bot and hey presto - no such question will stop them anymore.

So you think up a new question, and the spammers break that just as easily. And a new one with the same result. And so on, and so on.

The only way this could possibly work is if few enough people are doing it so that the spammers don't expend effort on cracking your system - It is security through obscurity. If you are trying to create a general purpose anti spammer mechanism that can be widely used, then captchas although not perfect are the best current solution to a nasty problem.

Re:This is a very hard problem

[CanHasDIY]

Perhaps, but if you're trying to monetize the site you're running you'd be a fool to do something that prevents a good 80-90% of people from accessing it.

Not everything is about fucking money, you soulless cretin.

No, some stuff is about making money, you retarded hippie.

Re:This is a very hard problem

[CanHasDIY]

Well, sure, but I never so much as implied that making money from a website via increased accessibility was a universal requirement, so...

Re:This is a very hard problem

[Yer Mom]

If they are blind, deaf AND mute all 3 at the same time, then yeah, there is a problem

At this point you throw them to a pinball game and check their high score.

Re:This is a very hard problem

[Zmobie]

There are actually a couple of other basic language techniques I can think of off the top of my head that could be used against the spammers.

For starters, you can use a language processing trick that essentially allows humans to gloss over a lot of typos. In general when a person sees a word as long as the word starts and ends with the correct letters and contains the correct ones (in some cases just close to the correct letters), we will process them like they are in order when they are completely out of order without even thinking about it since we process words and not individual letters. This would add some additional complexity to machine processing because now not only does the bot need to tokenize and understand the sentence, but it has to rearrange half the letters in the words to get the correct meaning from the sentence. A human would barely notice and it could be somewhat randomized within the phrase.

Another thing would be word substitution for slang or synonyms that a machine would then have to reference, but as long as the substitutions are not overly complicated the human user would again have no issues. This could also result in some jargon filled goofy sentences that a person can figure out pretty simply, but a machine would get confused as hell.

Those are just off the top of my head, with some additional research it could possibly be made more viable. I am not saying this would be easy to implement (or necessarily even feasible, you do raise valid points/concerns), there is a reason we use the current image distortion system, but I think there are some alternatives to what is currently being used.

Re:This is a very hard problem

[Zmobie]

I agree that security through obscurity is not smart practice, but this is only a very basic form of the idea. As I stated, it would require a lot more research into language processing and implementation of a lot of tricks. The two I mentioned in another comment, intentional randomized typos that humans will gloss over and word substitutions for synonyms and slang (possibly even some phrases). Those are only a couple that I can think of right now. I admit, it would require more research and design (that is how the current system came to be as well) and may not even be feasible in the long run, but I am saying there are alternatives to the current system.

Re:This is a very hard problem

[ZombieBraintrust]

person sees a word

How would these work when used by a blind person? They will be using a screen reader. When it hits the typos it is going to either spell things out, autocorrect, or say something odd. If the substitution is easy enough for the screen reader application then it will be easy enough for bots.

Re:This is a very hard problem

[TJNoffy]

"What color was George Washington's favorite white horse?"

80% of users can't even correctly answer "Who's buried in Grant's tomb."

Re:This is a very hard problem

[kmoser]

You can look forward to payments from spammers made via stolen credit card numbers.

Re:This is a very hard problem

[plover]

It's quite likely that some forums may prefer only letting in people capable of understanding logic, and there aren't any laws against discriminating against those people.

Next up: Jim Crow-bot laws. "You must make your content accessible to all people, regardless of IQ."

Re:This is a very hard problem

[Svenia]

I'm really tempted to try something now, because I'm pretty sure if I asked 20 of my old coworkers "What color was George Washington's favorite white horse?" at least half would just give me a blank stare, followed by "Well.... How would I know that?" /sigh

The good side of that though, is I really don't mind the idea of filtering those types of opinions off the internet.

Re:This is a very hard problem

[plover]

How are these easy to create? To create these questions a program would need to start out with an answer. In this case white.
It would then need to randomly generate a unique question that has never been asked before whose answer is white.
This question would need to be easy for humans to solve. But it would need to be impossible to solve by the program that just generated the question.
Ohh and you need to generate millions of these question answer pairs everyday. It also needs to be done quickly. People don't want to wait longer than a second for the CAPTCHA to load.

You're trying to solve the problem once and forever. That encourages the spammers to solve the generic problem. But spammers are lazy, and they will solve only the problem presented. Instead of creating millions of questions, create only ten or a hundred questions. Deploy that until the spammers adapt their robots. Then replace those with ten new questions with a different set. Change the format slightly with the new questions. Force the spammers to chase you. That increases their costs dramatically, but makes your problem as simple as updating ten trivia questions per day.

If the spammers switch to Mechanical Turk, you lose no matter what - you can't block humans with spam intent with a human detector.

That suggests a new approach: instead of a "human detector", we really want a "topic detector." We desire people who are going to post on topic, so make them write an on-topic essay in their sign-up request (or first post from a new account.) Slightly tougher to automate than a CAPTCHA, but it would stop even Mechanical Turks if their goal was volume CAPTCHA busting.

Re:This is a very hard problem

[Svenia]

While I applaud your wit, I guarantee there are more people out there that don't share that quality with you than those that do. So instead of hearing how the blind and elderly can't fill out a captcha, soon the complainers will be the idiots who can't get on the CNN forums. I'm willing to bet the idiots can whine louder, in greater numbers. (Then again if they can't get on the 'internet' to whine, where will they do it?)

Re:This is a very hard problem

[Zmobie]

One word: anagrams. Now that "solution" is broken entirely and the bot now needs to do heuristic natural language processing to figure out which word it is supposed to be, much less what words are possible as it may not be in the bots dictionary which at best can run lookups in O(nlogn) but more likely will run them in at least O(n^2) probably worse. You can also use homonyms to force additional computational efforts on the bots part.

String processing just to do word matching with known good words is quite complex and often times will run in exponential time. For correct answers you are looking at running in essentially O(n^n) where n = the number of letters, for EVERY SINGLE WORD which is geometric growth in computation time.

Everyone seems to be missing the point with trying to defeat this argument using processing logic. The CURRENT system is defeated using processing logic and short of using flat out encryption levels ALL systems will eventually be beaten by a bot with unlimited time and processing power. Essentially you have to create something that is difficult for the bot to effectively break and have 100% accuracy. Even the blind squirrel finds a nut so to speak, but natural language processing is not 100% certainty or even close in many cases.

Re:This is a very hard problem

[ZombieBraintrust]

spammers are lazy

I think this is a bad assumption. People who use bots to scalp tickets have the financial motivation to answer 10 questions everyday. Organized crime that rents out botnets to spammers have the financial motivation to answer 10 to 100 questions everyday. Plus there are plenty of people who do if for the lols and then share it with the spammer community.

Re:This is a very hard problem

[Zmobie]

Valid point, but there are probably ways around that to make it more accessible though damned if I can think of one right now. I really have already expanded a hell of a lot more on this idea than I intended to in this discussion, my point was that it is a possible replacement, not that it definitely would work. It might, it might not, but there are probably alternatives to the current system, people just have to research them and put some work into it.

Re:This is a very hard problem

[AK Marc]

Amazon Mechanical Turk would fix that. Unless you created an endless chat program that was a Turing test, people would be paid $0.05 per answer, and your limited answers would be discovered and broken.

Unless you created a separate pool of underpaid workers to give the test, so that the test was inconsistent, never ending, and implanted with piles of errors. Now, what happened if you pointed the Turk at the Turk?

Re:This is a very hard problem

[doccus]

Finally, a website that the DHS and NSA can't crack ;-)

Re:This is a very hard problem

[Zmobie]

Well that is the theory, you use some linguistics tricks in such a way that the bot would need to nearly Turing complete to effectively defeat the system. It is a bit of a challenge though as the system itself would probably become very nearly Turing complete to accomplish this goal, but there are probably some short cuts one could take to help with that challenge. Now it would be quite entertaining to point the Turk at the Turk though if money were not a concern...

Re:This is a very hard problem

[uninformedLuddite]

Now I understand the new /.

Re:This is a very hard problem

[king neckbeard]

That depends on what your strategy for monetization is. If it involves targeting highly intelligent people, then you are more or less cutting out noise. It may also boost your traffic within that demographic, given that it would make for a better community. There's also the allure of exclusivity, which itself can be a venue towards greater widespread appeal. That's more or less what facebook did. At first, it was just select colleges, then basically any college, then anyone in a school, then anyone. It was essentially the marketing technique described in Cartmanland.

However, there's also the possibility that the intention of a site might not be to monetize it, but to create a good environment for discussion.

Re:This is a very hard problem

[mysidia]

You can look forward to payments from spammers made via stolen credit card numbers.

CVV required for verification. AVS checking mandatory. If the street address they provide doesn't match the card's billing address, then the transaction is rejected.

To avoid additional e-mail based verification, the transaction must be over Paypal with a verified Paypal user via a confirmed home address.

Re:This is a very hard problem

[Cillian]

If you use something like wikipedia for your legit sentences then cracking it is simple. Google each sentence, the one which turns up exact phrase results is legit.

Re:This is a very hard problem

[Meski]

It's quite likely that some forums may prefer only letting in people incapable of understanding logic, and there aren't any laws against discriminating against those people.

Fixed it for you. I'm thinking of NewsLimited forums.

Re:This is a very hard problem

[Meski]

Damn, I just posted, so can't use a mod point on you.

Some of the logic puzzles go like - "what colour is snow?" - me answers "yellow" - a good site might recognise human humour here.

Re:This is a very hard problem

[Cillian]

Letter substitution or jumbling would totally muck up a screen reader, though. Humans' very efficient reading only works with visual reading, in which case you're back to square one, a visual captcha.

Re:This is a very hard problem

[Cillian]

If your spammers are using Turk or any other form of human labour, all bets are off. I can't think of any reliable way to stop the captcha being captured and played back to another person. A time limit would make it harder, but isn't a problem if you can get your solvers working real-time.

Re:This is a very hard problem

[bill_mcgonigle]

If it involves targeting highly intelligent people, then you are more or less cutting out noise.

yeah, I'm on a homebuilding forum and the captchas are things like, "the inner stud framing a window is called a" or "the piece of wood that covers the gap between adjacent doors is a", etc.

Basically, if you've ever read a carpentry book, you can come in. If you're just looking to complain about the contractor who installed your kitchen counter, you'll probably not be able to post.

It could still be a "CAPTCHA", though: "Completely Automated Public Turing test to tell Contractors and Homeowners Apart".

Re:stupid

[rudy_wayne]

Yes it is stupid. I understand that spam is a problem, but if you run a website, it's *YOUR* problem. CAPTCHAs make it *MY* problem and that's just stupid.

sounds like a wetware problem

[Gravis Zero]

there isnt a single thing that everyone will like or approve of.

let's say you change it do you have to answer a simple addition math problem. what you get is someone crying, "i have to answer 5+8?! but i dunno maths you insensitive clod!"

you know that person really exists.

Re:sounds like a wetware problem

[Anonymous Coward]

there isnt a single thing that everyone will like or approve of.

let's say you change it do you have to answer a simple addition math problem. what you get is someone crying, "i have to answer 5+8?! but i dunno maths you insensitive clod!"

you know that person really exists.

Yes they do. The solution is that they learn simple math so they're a fully functioning member of society. I suggest an intensive period of schooling - say 11-13 years. Oh wait...

Who are you going to cater for next? The guy that can't read the damn form. "But I'm illiterate you insensitive clod"? It's not a question of eliminating all objections, just ones that actually stump your audience. Capture is the worst of the worst. You can have a PhD. and get it wrong a substantial portion of the time.

Re:sounds like a wetware problem

[war4peace]

On the other hand, the captchas became ridiculously fuzzy as of late. My vision is 19/20 (rough comparison; doctor said I can be anything BUT an aviator) and I still find myself refreshing several captchas because they don't make sense. Sometimes I eyeball a "word" for 10-15 seconds and then I'm sure i got it right, I type it in and ERROR, wrong captcha.

If anything, word captchas became impossible to solve for most people and very annoying to perfect vision ones.
Why can't there be a captcha showing a picture and three buttons with possible answers? Like an image of a baby and three buttons saying MAN, WOMAN, BABY. Or a picture of a running man and buttons saying SLEEP, RUN, CHILD.

Re:sounds like a wetware problem

[Anonymous Coward]

Lazy people can learn to add. Blind people can't learn to see.

Re:sounds like a wetware problem

[amorsen]

Why can't there be a captcha showing a picture and three buttons with possible answers? Like an image of a baby and three buttons saying MAN, WOMAN, BABY. Or a picture of a running man and buttons saying SLEEP, RUN, CHILD.

Because you just plug that image into Google 3 times with each key word and pick the answer with the highest score. Or, much easier, you just randomly pick one of the options. One in three is a good hit rate, and even if you block by IP, getting past the system hundreds or thousands of times is trivial.

Re:sounds like a wetware problem

[adolf]

Like an image of a baby and three buttons saying MAN, WOMAN, BABY. Or a picture of a running man and buttons saying SLEEP, RUN, CHILD.

They can't be automatically generated, because automatic generation is equally as reliable as automatically solving them.

So a human would have to design each and every one of them, which is a job that nobody wants to pay somebody to do. There will thus also be a limited sampleset which will easily be learned by a crafty spammer (and like anything else digital, it only takes one person to figure it out).

Re:sounds like a wetware problem

[Culture20]

Why can't there be a captcha showing a picture and three buttons with possible answers? Like an image of a baby and three buttons saying MAN, WOMAN, BABY. Or a picture of a running man and buttons saying SLEEP, RUN, CHILD.

Because then on average, 1/3 of all spambots would succeed. You need thousands of possible answers before it becomes usable as a barrier, and you'll need millions of photos (to prevent learning) and someone will have to choose a correct answer per photo, and make sure all other thousands of answers are incorrect.

Re:sounds like a wetware problem

[nigelo]

> Why can't there be a captcha showing a picture and three buttons with possible answers?

Well, ~33 per cent will be correct due to chance, which isn't a very good success rate considering there may be BILLIONS of bot-members posting spam.

So, a picture and 10,000 possible answers? Might be considered clumsy.

Re:sounds like a wetware problem

[houghi]

slashdot is one of the few sites with reasonable captchas.

So how is it that they don't get gazillion spammers posting? Are they on to something?

Re:sounds like a wetware problem

[ZombieBraintrust]

math is a terrible example. a spambot can do addition better than a human can.

Re:sounds like a wetware problem

[Your.Master]

Canada has had exactly that sort of "captcha" for decades without computers, called a "skill testing question". It is a a legal workaround to gambling laws that has been tolerated (and it's typically slightly more complicated than 5+8, but only slightly).

Really doesn't stop stupid people from using calculators.

Re:sounds like a wetware problem

[Krishnoid]

The solution is that they learn simple math so they're a fully functioning member of society.

Canadian society, anyway.

Re:sounds like a wetware problem

[EvanED]

"To create an account, type "green" in the box below."

Jeff Atwood's codinghorror.com used to have "type orange in the box", but I think he switched to an actual login thing.

The other is to realize that your blog/website/etc is not all that special, and doesn't need YouTube/Gmail/Wikipedia grade bot protection.

OK that's fine, but now what should the YouTube/Gmail/Wikipedias do?

Or take one of the more convincing examples in TFA: ticketmaster. That's a service that can't reduce the benefit, because the whole point of the site is to provide the exact service (selling tickets) that bots want to achieve (buying tickets).

Re:sounds like a wetware problem

[mpeskett]

I've seen greek/cyrillic characters and mathematical notation before. That was fun to try to answer, but was in the "transcribe this book for us" section rather than the "figure out if you're human" section. Wish I'd known about that before receiving the captcha.

Re:sounds like a wetware problem

[sjames]

In fact there are cases of localized brain injuries that make anything dealing with numbers nearly impossible for the person while they are otherwise quite normal.

Re:sounds like a wetware problem

[vux984]

OK that's fine, but now what should the YouTube/Gmail/Wikipedias do?

For better or for worse...gmail seems to be on the verge of requiring you to have a mobile phone. And youtube is pretty much one with gmail so that's 2 out of 3 down.

Wikipedia can probably do with a reputation system.

Re:sounds like a wetware problem

[mysidia]

let's say you change it do you have to answer a simple addition math problem. what you get is someone crying, "i have to answer 5+8?! but i dunno maths you insensitive clod!"

I got it... The problem is we're looking for the "one CAPTCHA"; when we should be looking for the right set of CAPTCHAs.... different kinds of questions for different kinds of people.

There's no reason the site can't let the user choose their CAPTCHA category. It can be Maths, Logic, Geometry, Physics, Biology, or History, Celebrity gossip, Food, Sex, Psychology, Art, Literature, Prose, Christianity, Islam, Buddhism, Shintoism, Architecture ...

Pick your category, and a question is asked that can be answered by an expert in 10 seconds, but would take a novice or computers perhaps years.

Re:sounds like a wetware problem

[mysidia]

Because you just plug that image into Google 3 times with each key word and pick the answer with the highest score. Or, much easier, you just randomly pick one of the options. One in three is a good hit rate, and even if you block by IP, getting past the system hundreds or thousands of times is trivial.

So give them 5 options, not 3, and make them answer 3 questions each with 5 options. 1/(5^3) is about a 0.8% chance of getting the set of right answers by chance alone.

Make sure to provide no hint about correctness or incorrectness until an answer is provided to all 3 questions. You fail the entire sequence of questions, or get them all right as a group.

If you get all 3 wrong, then you have to wait 15 minutes before trying again.

Re:sounds like a wetware problem

[mysidia]

So a human would have to design each and every one of them, which is a job that nobody wants to pay somebody to do. There will thus also be a limited sampleset which will easily be learned by a crafty spammer (and like anything else digital, it only takes one person to figure it out).

Not if as part of the Captcha solving, you ask the person to type three words describing each image.

Supposing you present 3 images... make them pick a word from a 4 or 5 item picklist, and type a few words of their own.

You will eventually get data about how people describe the image, based on the people who successfully solved the Captcha.

You can infer that if their solution to the Captcha was correct, and there is a consensus of enough other successful solvers offering a certain keyword, then that keyword has relevance to the image.

Thus you can discover additional keywords besides the image name automatically. By using the disparity in information available between Your site and some random bot with no dataset.

Re:sounds like a wetware problem

[mysidia]

Because then on average, 1/3 of all spambots would succeed.

No.. if a bot visits a site with a 33% chance of success; on average, you could expect the bot will succeed. The question of what fraction of spambots will succeed will be the question of how many bots are updated to attempt the unique kind of CAPTCHA.
If it's a very small site, and just one using this Captcha, then may be 0% of spambots will succeed, because nobody felt it was worth coding up an exploit for a CAPTCHA used by some small site with so little traffic (so little to gain by spamming).

OTOH... once Spambots are updated to answer the CAPTCHA
They will try multiple times from different IPs. If the bot makes enough attempts, the law of big numbers says the bot's success rate can be brought within an epsilon of 33%; it would be foolish for the spammer to not have their bot retry a sufficient number of times to guarantee success.

Thus 80% or more of Spambots that are updated will probably succeed.

Re:sounds like a wetware problem

[mysidia]

So how is it that they don't get gazillion spammers posting? Are they on to something?

Slashdot is a very large site, so there are likely to be plenty of human spammers. CAPTCHAs don't stop those. I think they might make it less attractive for spammers by marking links in comments Nofollow. If the Spammer doesn't get a search engine boost from the backlink, then what's the point?

The spammers are around... they are called Anonymous Cowards. Not all of them are bots
I believe they occassionally ban IP addresses. Slashdot also limits the rate at which anonymous users can post. You can post a comment --- then you can't post anymore for half an hour or so.

Re:sounds like a wetware problem

[jecblackpepper]

You do know that the problem they are trying to solve is accessibility for blind people? Presenting images isn't going to help there.

Re:sounds like a wetware problem

[jareth-0205]

Yes they do. The solution is that they learn simple math so they're a fully functioning member of society.

Yeahh..... I don't think trying to beat a computer at maths is the best way to go...

Re:sounds like a wetware problem

[LordLimecat]

Like an image of a baby and three buttons saying MAN, WOMAN, BABY.

Why wouldnt the hypothetical spambot just guess randomly? 33% success rate makes it useless.

Re:sounds like a wetware problem

[Svenia]

If someone isn't moderating which "popular choice" words are added in the describe the image, I'm pretty sure we're going to end up with a few common but juvenile and irrelevant choices. I'm sure you can deduce a few of these on your own. Perhaps have these barred from the start?

Re:sounds like a wetware problem

[war4peace]

Put 5 images, 3 answers each, get all right or GTFO.
Or have image matching, like two columns of 5 images each, click on any image on the left and then its pair on the right (example: a groom on the left and a bride on the right, obviously that's a match; lemon on the left, orange on the right; pen on the left, paper on the right).

i love it when people get stuck on a fucking EXAMPLE and refuse to think any further with as much as a whiff of extrapolation.

Re:sounds like a wetware problem

[amorsen]

So give them 5 options, not 3, and make them answer 3 questions each with 5 options. 1/(5^3) is about a 0.8% chance of getting the set of right answers by chance alone.

So you have slowed my attempts down by a factor 100. A determined attacker can easily make thousands of requests per site from individual IP's. That gets tens of spam posts in per site every 15 minutes. Have fun removing those by hand.

If you get all 3 wrong, then you have to wait 15 minutes before trying again.

Good luck implementing that. If you do it per-IP, you will block entire companies or service providers using NAT whenever one user gets the attempt wrong. Also, it will be too much hassle for me to use your site. Anything that is not per-IP is easily defeated by a spammer.

The spammer does not really care about the 15 minute wait anyway, there are plenty of other sites to attack while waiting for the next 15 minute window to open on your site.

Your proposals are less effective and less convenient than existing CAPTCHA.

Re:sounds like a wetware problem

[markxz]

One of the advertising CAPTCHA tests had a text box where you had to enter some text to describe a product. On the test selections on the providers website "shit" worked every time.

Re:sounds like a wetware problem

[mysidia]

If someone isn't moderating which "popular choice" words are added in the describe the image

You mean like the word "prostitute" or "whore" appearing for the Queen of England, or "Dick" appearing as a choice for a picture of fmr. president George Bush?

I assume there'd need to be a dictionary of known English words, a totally banned words list and a 'suspicious words list'. With words on the suspicious list requiring approval before use with an image.

Also, any word that a significant portion of the population would fail to select from the pick list more frequently than some threshold would be omitted or deemed 'bad/junk'

The era of CAPTCHA is over

[Anonymous Coward]

OCR has advanced to the point it is now possible to beat it 99.99% of the time no matter how difficult to decipher -- which has a side effect of making even real humans have trouble reading the CAPTCHA. Not willing to shell out for quality OCR? No problem, Amazon's Mechanical Turk provides you all the tools you need to get people to read the CAPTCHAs for you and the spam goes on. Don't feel like spending any money at all? No big deal, many CAPTCHA services are easily bypassed. (Let's not get into the ethics of certain companies using CAPTCHA solutions for third-party websites as unpaid labor.)

This was an early-00s temporary solution to a permanent problem better solved via other means.

Fun Fact

[HairyNevus]

Not sure is this is already super well known, but only 1 word is actually used for verification. In this example you could type "thrand " and pass it. The verification word always looks similar in font/size to 'thrand'. Oh, and the other word I believe is a scan from a book and if you *do* type it in, it will help the digital scan of the book actually pin point what word it is.

Re:Fun Fact

[mrjb]

Fun fact 2: To ensure the "scanned" word is read correctly, multiple identical matches need to be given by multiple users. In the example, the correct "scanned" word is likely to end up being "wtf?"

Re:Fun Fact

[amorsen]

I am fairly sure that your information is out of date. Not 100% sure admittedly. I have tried the trick of trying to guess which word is the important one before and failed miserably. Try it for yourself, maybe you can do better than I did.

Re:Fun Fact

[timmyf2371]

With the example you gave, I'd be surprised if they got enough matches to identify the second word. I know I'd have taken one look at it and hit the refresh button to get two words I can actually decipher.

Re:Fun Fact

[darkfeline]

That's only for reCaptcha, you dolt. reCaptcha is charity-ware, and each captcha goes toward scanlating texts. That's why one of each pair looks much neater (and more comprehensible) than the other. The idea is that you solve a captcha and digitize some text for goodwill. Of course, this is open to abuse, which emerged most clearly during 4chan hijack of that one Time Person of the Year poll a while back. But reCaptcha does have mechanisms in place to prevent you from bullshitting the real text word (so as not to have /b/tards placing the word "penis" in every digitized text in the future), to some extent, but that is not infallible to the best of my knowledge.

Re:Fun Fact

[HairyNevus]

I thought the links I provided made it fairly implicit I was referring to reCAPTCHA. I mean one is a picture of a reCAPTCHA, and the other is a link to a page explaining the reCAPTCHA digitization process. But, in case anyone else missed it, I'll spell out reCAPTCHA one more time.

Re:Fun Fact

[YukariHirai]

Whereas I expect that the people behind recaptcha have thought about some of the possible abuses and have some kind of checking applied to prevent that from happening.

Re:Fun Fact

[NJRoadfan]

Google also uses images of house addresses captured on Streetview.

Re:Fun Fact

[poizan42]

What's the problem in just typing "A"? Almost all of the characters are right in front of you on your keyboard!

Re:Fun Fact

[darkfeline]

Sorry, I jumped the gun there a little. You posted on a news item about captchas in general without mentioning a thing about reCaptcha, so I assumed you meant all captchas only use one word for verification, which is completely false.

much better out there

[Xicor]

there are already several types of captcha nowadays that are newer and much easier to use. one of the ones ive seen is one with a company logo and you have to type out the company name. another is one where you have to makea pizza with specific toppings. another one is where you have to draw an image. captchas are necessary... the problem is that they have become too ridiculously difficult instead of making it easy to use for normal ppl.

Re:much better out there

[ZombieBraintrust]

A blind person can not solve any of those captchas. This campaign would ban those captchas as well.

Re:much better out there

[umghhh]

what you mean is that the bloody bots are already better than average human at reading?

Re:much better out there

[ZombieBraintrust]

Blind people can navigate the web if the website is built correctly. The blind use screen reading applications. They read the text portion of a site out load. They then use keyboard commands to select links. Images are described using their alt text.

Re:much better out there

[Xicor]

so what you are saying is that maybe .5% of websites can be navigated by blind ppl?

Somewhere on the intarwebs...

[Sponge Bath]

A stoned person types his password into a CAPTCHA field.

"Wrong? Ah man, I know that's my password."

CAPTCHA not going anywhere

[Dynedain]

CAPTCHA will be around as long as it is the best way to stop programatic submissions.

CAPTCH sucks for sighted people as well, not just the visually impaired.

As long as we have need for tools to discern software from people, something like CAPTCHA will exist. And so far we haven't developed anything that only humans can do, but computers can't.

Re:CAPTCHA not going anywhere

[tlambert]

CAPTCHA will be around as long as it is the best way to stop programatic submissions.

It's well documented that there are several groups who have put put porn sites using collections of images from around the net; then they attack sites that require answering CAPTCHA. When challenged by the CAPTCHA, the forward it on to someone seeking the "free porn", and then forward that persons answer back to the site they are attacking.

So the CAPTCHA-using site wants a human to solve the CAPTCHA, a human solves the CAPTCHA, gets their porn, while the attacker gets into the "protected" web site that they actually wanted to attack.

In the limit, they don't work; in practice, there's an amount of effort barrier that makes your site "sorta safe" from bots, if it's small enough that it's not going to be useful to an attacker as a link farm anyway, since it doesn't have enough page-rank credibility of its own that it's worth subverting.

Re:CAPTCHA not going anywhere

[rasmusbr]

Actual solution:

1. Sign up for an account with a major social provider (Facebook, etc)
2. Tie your social account to your cellphone number/SIM
3. Verify that you own the SIM and that the same number has not been used to register other accounts on the same social network. )Possibly verify that the SIM is registered with the government on the same name used to sign up.)
4. Done. From now on you do one-click signup with other services.

By the way it's only a matter of time before governments begin to dictate (at least de facto) that you must be on at least one of the major social networks, so saying that you don't want to is not going to be an issue. I'm sure there will be "anonymous" signup for porn sites too, with some identifier that the government can use to link your anonymous account to you...

Re:CAPTCHA not going anywhere

[Dynedain]

I know there's plenty of ways to break the intent of CAPTCHA. But at the moment it's still the easiest to implement and most difficult to break solution we have.

Until a better solution is developed, or CAPTCHA is completely broken, it's not going anywhere. It sucks, but for the most part it does work.

Re:CAPTCHA not going anywhere

[Dynedain]

You're just pushing the problem to the social media providers then. And they do captchas as well. There's plenty of fake social media profiles out there and if you use social media logins, be prepared for bots using fake or hijacked social profiles.

Re:CAPTCHA not going anywhere

[aNonnyMouseCowered]

"By the way it's only a matter of time before governments begin to dictate (at least de facto) that you must be on at least one of the major social networks, so saying that you don't want to is not going to be an issue."

What you're suggesting will only make the work of the spy agencies of the world all the much easier. When FB accounts become legally binding, then, guess what, you can get arrested, and not just suspended, for registering as Albert Einstein Tarkovksy. I can tolerate FB so long as there's no obvious legal consequences for being an online schizophrenic.

Re:CAPTCHA not going anywhere

[jeff4747]

You're assuming CAPTCHA works.

It doesn't. OCR can handle virtually all of them. Even if you invent a CAPTCHA OCR can currently break, cheap Chinese labor (or "Free porn if you solve CAPTCHAs") is extremely effective.

Re:CAPTCHA not going anywhere

[Dynedain]

Agreed that CAPTCHA is not a be-all-end-all tool. However, it is the most effective and easiest to implement solution for the particular problems it solves.

Until there is something more effective than CAPTCHA, and at least as easy to implement, we'll be stuck with it.

Re:CAPTCHA not going anywhere

[serviscope_minor]

It's well documented that there are several groups who have put put porn sites using collections of images from around the net; then they attack sites that require answering CAPTCHA. When challenged by the CAPTCHA, the forward it on to someone seeking the "free porn", and then forward that persons answer back to the site they are attacking.

True, but that still does not make them not worthwhile. The thing is that spammers are doing this for money, not for grins, so as long as you make it sufficiently difficult and expensive, the incentive goes away.

I run a small, special interest technical forum using PHPbb. Cheap and cheerful software but works well enough except that it was overrun with hundreds of thousands of pharma spam messages very quickly.

Adding recaptcha slashed the amount of spam dramatically. Then adding some trivial questions to be filled in cut it down to so far one spam message ever.

The trivial questions don't change they're really easy. A spammer could take the time to check the site and then write some special code to fill in the right questions in that form.

The thing is though that recaptcha cuts down the volume they can churn through and requiring the spammer to go to the extra effort makes it even less worthwhile. Given the size of the forum I have almost certainly raised the cost of spamming it above the amount of money that would ever be recouped.

Spam is a high volume, tiny margin game. If you can take even a little ding out of the volume and add a little bit to the cost then the finances simply do not work out for the spammer.

Could a targeted attack wreck my forum? Yes of course. But the problem I was actually suffering was indiscriminate pharma spammers.

Re:CAPTCHA not going anywhere

[jeff4747]

The entire point is CAPTCHA does not solve a problem.

Thanks for sharing

[foma84]

Another "service" Goggle capitalizes on, for free.
It makes me want to cry when I think of how many catchas I've typed...

Re:Thanks for sharing

[Richy_T]

It makes me cry how many accounts I've had to register, confirm and forget just to add a comment to a forum I'll never read again (typically when I've been searching for the answer to a problem, found the answer elsewhere and want to share that answer with others who have not yet solved the problem).

Re:stupid

[pseudofrog]

If taking a couple seconds to answer a CAPTCHA is too much effort, I probably don't really care what you have to say in the comment section.

Re:stupid

[aardvarkjoe]

I understand that spam is a problem, but if you run a website, it's *YOUR* problem. CAPTCHAs make it *MY* problem and that's just stupid.

If the website you use is overrun by spam to the point of being unusable, then it's your problem as well.

Re:stupid

[Idimmu Xul]

As someone that runs a website, without CAPTCHAs I'd be fucked.

There are bots that can automatically register on a site, then check the email account for the activation link, in order to start spamming, so that's not a solution.

The newer 'flash games' e.g. 'out of 5 objects, put the drinks in the cooler' are an interesting solution, but that probably still won't work for people with accessibility issues.

Moderation can work on sites like slashdot, but on lower traffic sites not so much, and the signal to noise ratio will be awful.

If Australia pass this and actually clamp down on 'offenders' it will do more harm than good as the only recourse webmasters will have is to not allow people to register/interact with the site as the cost of cleaning up spam will be too high.

Re:stupid

[Baby Duck]

Offloading some of the responsibility to you as a human co-processor is an effective tactic called Share The Pain. It's not stupid, it's genius. You just don't favor the end result. You can always vote with your mouse and go to another website.

Re:Pissing and Moaning

[stewsters]

I will create a single sign on service where you pay $1 to sign up. If someone reports you as a spam bot, you will be disabled until you pay me another $1. I will take the money and give a small percentage to some charities (EFF probably) and keep the rest as server and administration costs.

If people want to spam or create fake accounts, it will cost them a lot more than just having some guy answer 1000 Captchas for a buck. I could track where I get the money from to locate the spammer's accounts.

Let's Have a 2015 Solution!

[rueger]

Passwords, with no two sites accepting the same format. CAPTCHAs, which often as not even normally sighted people can't read without difficulty. Security questions which are either inane or represent their own special security risk.

God almighty, can't we come up with something to replace all of these?

Re:Let's Have a 2015 Solution!

[icknay]

Ok repeating myself, but the open, standard, non-one-corp-controlling-it-all solution is Mozilla Persona http://www.persona.org/ -- it's in like alpha state now, should ship for real this year. You heard it here first!

Re:Let's Have a 2015 Solution!

[You're All Wrong]

"""
Adding the Persona login system to your site takes just five steps:

1) Include the Persona JavaScript library on your pages.
"""

Unacceptable.

Oblig. XKCD

[djlemma]

Mission Accomplished.

Annoyance to older people

[Culture20]

Annoyance to older people who were used to buying their overseas Viagra from forum spambots.

Captcha is necessary.

[mrjb]

Captcha fulfills a need - it is, as the name implies, a test to completely automatically tell computers and humans apart. It's necessary to keep spambots from registering accounts and spamming the hell out of us. Granted, the "type this wobbly word" may not be the most practical (nor safe) solution. It's easy enough to come up with alternatives- Perhaps show four photographs and ask the user to click on the one that doesn't belong (maybe the kitten out of a picture of 4 cats). Coming up with good ideas? Much harder. Complain about it all you like. Come back if you have a better alternative.

Re:Captcha is necessary.

[amicusNYCL]

Perhaps show four photographs and ask the user to click on the one that doesn't belong (maybe the kitten out of a picture of 4 cats).

Yeah, that will totally solve the problem for blind people.

Hidden fields, people, the answer is hidden fields. Hide fields from people using Javascript, bots still find them, if they're filled out reject the form.

Re:Captcha is necessary.

[Ichijo]

Captcha fulfills a need - it is, as the name implies, a test to completely automatically tell computers and humans apart. It's necessary to keep spambots from registering accounts and spamming the hell out of us.

I hardly ever see spam. My mail provider decided that the content of e-mail is its own Turing test. So why do we need Captcha anymore?

Re:Captcha is necessary.

[jeff4747]

That's not the need it fills. The need it fills is making administrators believe they are doing something to stop bots.

CAPTCHAs don't work. They stop the least sophisticated bots which are only used for "bulk". It's the bot equivalent of the meth-addict breaking into houses - they're only looking for enough money for their next fix. The fact that you have pointy bushes outside your house doesn't make it secure. It just makes it less appealing to that meth addict.

Same with CAPTCHAs. It only thwarts the bots that are selling "We make X posts to advertise your product". They don't give a damn where those posts are made, just that they hit the quota and they can get enough without breaking CAPTCHAs.

If your site is actually worth targeting, CAPTCHAs will fail miserably. OCR can handle the vast majority, and cheap Chinese labor or "free porn if you solve CAPTCHAs" will handle the rest.

Re:Captcha is necessary.

[ratbag]

... bot checks for fields hidden by javascript, doesn't fill them in, you accept the form. The arms race continues.

Re:Captcha is necessary.

[serviscope_minor]

If your site is actually worth targeting, CAPTCHAs will fail miserably. OCR can handle the vast majority, and cheap Chinese labor or "free porn if you solve CAPTCHAs" will handle the rest.

But that's the thing really. Spam, even targeted spam is a high volume, tiny margin game. You only have to alter the balance slightly for it to become financially unviable.

For the forum I run, I am fully aware that it could be spammed quite easily. But no one does because the cost of doing so ins't worth it.

Re:Captcha is necessary.

[amicusNYCL]

Um, how many blind people ARE there?

According to WHO, there are 285 million visually impaired people, so about 90% of the population of the US. 39 million of those are completely blind, which equates to a country the size of Poland or Argentina.

Wth

[Impy the Impiuos Imp]

Apparently blind people are unaware of all the spam postings clogging porno web sites without it.

Re:stupid

[nitehawk214]

If taking a couple seconds to answer a CAPTCHA is too much effort, I probably don't really care what you have to say in the comment section.

Or a couple of minutes considering most capchas are illegible.

Re:stupid

[smagruder]

Tell that to my 46-y.o. eyes that can barely decipher these increasingly difficult eye puzzles, and I have a computer engineering degree. Think about others, will you?

Not at all

[oGMo]

This kind of thing shouldn't be hard at all. You don't need complicated logic puzzles or any such thing. You just need something that's hard for a computer to figure out, but easy for a human.

For instance, render a 3D scene and ask a question about perspective. "What is the person holding in her right hand?" "What is the person looking at?" and similar such questions. Trivial to render. Hard to figure out, because it's far beyond simple image recognition: you have to see and interpret what's going on in the scene. It doesn't have to be confusing or hard at all. (And rendering is super cheap these days.)

Re:Not at all

[oGMo]

Wow poor edit sorry ... should be: "Trivial to render. Hard for a program to figure out ... It doesn't have to be confusing or hard for a human at all."

Re:Not at all

[ZombieBraintrust]

You need problems that are generated by computer that are hard for a computer to answer. In your example the computer program rendering the image must understand perspective, english grammer, and handiness.

Re:Not at all

[amicusNYCL]

you have to see and interpret what's going on in the scene

You realize that many of the people complaining about captchas are blind, right?

Re:Not at all

[stewsters]

This is far harder for a blind person than the audio captchas we would be getting rid of.

Re:Not at all

[Obfuscant]

You realize that many of the people complaining about captchas are blind, right?

Easily solved with an appropriate ALT tag, something like "A picture of a person holding a frankfurter in her right hand." In fact, can't all CAPTCHAS be fixed by simple use of the appropriate tag? "A picture of the characters E, Q, 3, 6, T and 9".

Re:Not at all

[mpeskett]

Are you serious?

I seriously doubt it.

Re:Not at all

[YukariHirai]

Easily solved with an appropriate ALT tag, something like "A picture of a person holding a frankfurter in her right hand." In fact, can't all CAPTCHAS be fixed by simple use of the appropriate tag? "A picture of the characters E, Q, 3, 6, T and 9".

If by "fixed" you mean "made trivially easy for bots to answer", sure.

Re:Not at all

[mysidia]

Are you serious? That's like leaving the key in the lock. Great security there. The bots can read the alt tags.

You may still get away with it if you are the one site that does it.

The key has been placed on top of the doormat, but the bots currently in the wild are not designed to look on top of the doormat, only under it.

Re:Not at all

[LordLimecat]

You forgot to mention that you need to specify that the page should not be spider'd in your robots.txt, so that the spambots know that they shouldnt parse the page. Setting the evil bit to 0 may help as well.

Re:Pissing and Moaning

[intermodal]

Why would they want to recommend an alternative? If they're like me, they don't want nor need an alternative. It's the companies using them that want these systems. The users really don't care how much botcrap the server takes in.

it's a pain

[renegade600]

there are a few websites I want to access but cannot because their CAPTCHA is unreadable. Some of them are just way too complicated to read. I use it on my own blog but it is simple enough so you can get it the first time. It would be nice if there was some other way to prevent bots.

Please note...

[fahrbot-bot]

... the Feedback page for TFA blog has a CAPTCHA.

Re:stupid

[AchilleTalon]

It is possible to train an algorithm to recognize CAPTCHA, even if the success rate isn't 100%, it is high enough to enable bots to register on websites with CAPTCHA. So, Australia is only pushing people to find out better solutions than CAPTCHA. In short term, a large amount of spammers will rely on optical recognition algorithms to decipher CAPTCHA anyway.

Re:Pissing and Moaning

[A non moose cow]

Well they did give an alternative...

"According to Hollier, a better way for everyone would be the use of emails to activate and verify users, instead of CAPTCHA"

...but how do they sign up for that email account?
Indeed, they seem to be pissing and moaning about inconvenience without really grasping the problem being solved, as evidenced by this gem:

"With time sensitive things like concerts, this can mean I miss out on the tickets as the transaction times out," Hollier said.

As opposed to everyone missing out as a bot buys all the tickets.

Re:stupid

[smagruder]

There are plenty of other technical measures available these days. Captchas are unnecessary.

It's really taking off!

[Anonymous Coward]

The campaign support page already has 17 billion supporters!

Re:Pissing and Moaning

[CanHasDIY]

Well they did give an alternative...

"According to Hollier, a better way for everyone would be the use of emails to activate and verify users, instead of CAPTCHA"

 

Yea, suppose I could have clarified by adding "alternatives that aren't worse than what they're replacing," but I figured that was a given.

idea

[edxwelch]

Get rid of them and replace with simple maths question:
http://farm3.static.flickr.com/2174/2268237733_cda4a1dbb3.jpg?v=0

Re:idea

[loufoque]

wolfram alpha can solve this captcha better than a human can

Re:Pissing and Moaning

[CanHasDIY]

Why would they want to recommend an alternative?

Because otherwise they come off as a bunch of whiny narcissists who should be summarily ignored? That's my take, anyway.

The users really don't care how much botcrap the server takes in.

On the one hand, lol and touche.

On the other, they'll start to care when the botcrap makes the server unreachable to them; at which point they'll just start pissing and moaning again, and the cycle begins anew.

Re:stupid

[pla]

Yes it is stupid. I understand that spam is a problem, but if you run a website, it's *YOUR* problem. CAPTCHAs make it *MY* problem and that's just stupid.

You assume the website needs you more than you need it. For the standard commercial "wall of ads with some random content between" site, sure, what you say holds true

For a lot of smaller interest-group-themed sites, usually run by a handful of non-IT-gurus, put bluntly you need them more than they need you, and they don't have a full-time body around to read through all new posts to purge the spam.

Now, personally, I prefer the "math word problem" style CAPTCHAs - Because not only do they not discriminate against the blind or the old, they effectively keep out the spam and the stupid. Win-win!

Until AI improves

[schneidafunk]

We have AI units that are equivalent to 4 year old kids. How much longer until they can defeat standard CAPTCHA systems?

Re:Until AI improves

[serviscope_minor]

That system gets IQ tests as good as a 4 year old.

We certainly do not have general AI systems that are a patch on 4 year olds. Try comparing a 4 year old to even the most sophisticated computer vision object detection schemes, for instance and you will see how very far we still have to go.

Is this needed?

[JustAnotherIdiot]

CAPTCHA may be popular with with webmasters and others running different sites, but it's a source of annoyance to blind and partially sighted people — and dyslexic people and older ones — who often end up being locked out of important websites as they can't read wonky, obfuscated letters

CAPTCHAs tend to have an audio button where a string of numbers is read off to you.
Even Slashdot has a "mp3" button that reads the letters on the CAPTCHA off to you.
Doesn't that already help all the above people with issues listed here?
(Except possibly the "older ones", who may have hearing issues too.)

Re:Is this needed?

[iggymanz]

just for fun I clicked one of the mp3 links on my mac here at work. A popup appeared saying QuickTime was not equipped to support the media but would I like to search for one.

So no, that would not seem to help the people listed there.

Re:Is this needed?

[Thry]

Slashdot's may be functional, but try out a reCAPTCHA one - it sounds like too much salvia.

Re:Is this needed?

[Nemyst]

ReCAPTCHAs are actually one of the very few CAPTCHA systems which work without Javascript - a big accessibility bonus for text to speech.

Re:stupid

[mstefanro]

Care to elaborate?

Re:stupid

[Thry]

I was about to tell you to take advantage of the audio alternative offered by many services, then I went and tried a reCAPTCHA audio test to make sure I knew what I was talking about.

I apologise for even considering telling you to use those.

Re:stupid

[icebike]

If taking a couple seconds to answer a CAPTCHA is too much effort, I probably don't really care what you have to say in the comment section.

Or a couple of minutes considering most capchas are illegible.

This!

More and more, captchas take two or three attempts.
(Disclaimer: IMHO, I'm not senile, dyslexic, a horrible typist. blind. Your opinion may vary).

I suspect some sites are intentionally forcing a fail once or twice, at least occasionally, especially when you enter the word
in a timely interval. Bots probably give up after two failures, and they probably answer quickly.

So implementers make it more and more restrictive and throw in bogus failures.

Re:stupid

[mstefanro]

Because we all know computers are terrible at doing arithmetic and solving simple equations

Re:stupid

[noh8rz10]

i've been using minteye on my site. it's a visual captcha, works pretty well. you move a slider back and forth to unscramble an image.

Good riddance

[roc97007]

I've become convinced that the purpose of captcha is to punish regular users. I strongly suspect that spambots merely push the re-captcha link until they get a pattern that's easier to parse.

Re:Good riddance

[Derekloffin]

Indeed. A couple sites I visit have captcha's on their login pages, not account creation, login, and the really annoying ones that even I, a well sighted person, can't read about 1/2 of them. I know they want to avoid spambots, but seriously, why do I need this stuff when I already have an account? You afraid someone is going to hammer the login? Well, I can tell you implementing a simple couple second timer is far less annoying than those captcha's are.

Re:Then create a better solution.

[amicusNYCL]

Any solution that uses images fails. You need to account for blind people. Hidden form fields are the answer! Don't require people to do anything extra!

I've never used CAPTCHA'S

[corychristison]

I've been developing websites over 10 years and have never needed a captcha system.

This is how I always go about it:

1) Include a form input element labelled as something common, like a telephone number but on a registration form that would never actually require a telephone number. Hide the parent div using CSS in an external CSS file. When the form is submit, check to see if the element is filled out. If it is, simply display a message that you think their registration may be automated and to try again. If it continues, please contact us by other means (phone, email, etc) and we will help them through it.

2) Time the registration from the time the page is loaded to the time it is submit, if its less than 10 seconds, do the same as above, simply display a message saying you think their registration is automated and to try again, etc.

When used in conjunction I feel I've cut out 99.9999% of spam or false registrations. The timing method has to be done server side and stored in a session, and is fairly involved so not easy to do properly if you are new to web development. There is also the issue of someone hitting the back button to try again after a failed submission (if you don't use client-side validation), and them submitting from a cached page, but can be worked around if you know what you are doing.

Obviously its not bullet proof, and if the CSS file doesn't load then someone would see the extra form element. But its a small price to pay for effective protection.

Anyone else have other methods they use?

Re:I've never used CAPTCHA'S

[Quirkz]

I've done some custom questions. Something simple, like "what is this forum about?" or "what's the name of the game this forum is for?" Something a person would immediately know, but a bot wouldn't.

Re:I've never used CAPTCHA'S

[Dynedain]

If you are a high-profile site, the spammers will build rules to handle your specific form edge case.

Re: I've never used CAPTCHA'S

[xebecv]

It might work if your web sites are not particularly popular. Above a certain threshold of popularity, spammers might actually personally visit your site to fine-tune their spam scripts.

Re:I've never used CAPTCHA'S

[darkfeline]

Thank you for that information. We will keep that in mind while we work on the next version of our spambot.

Re:I've never used CAPTCHA'S

[Anubis IV]

Ironically, what you've described is a form of CAPTCHA. "CAPTCHA" doesn't just refer to obfuscated text, but is rather any public-facing Turing test designed to tell the bots and humans apart from each other. The funky text stuff is just the most common variety, but trivia questions, object recognition, etc. can all be forms of CAPTCHA as well.

Re:I've never used CAPTCHA'S

[cdrudge]

If this isn't already in the current version of your spam bot, you are seriously behind the time. This technique has been used for relative ages in forum registration, blogs, etc.

Re:I've never used CAPTCHA'S

[AmiMoJo]

These days they just hire some people living in the 3rd world to fill out the forms for them.

Re:I've never used CAPTCHA'S

[cavebison]

Thanks, I'll try implementing the hidden common field (if there's already a phone field, I'd just call it "phonereal" or something and the hidden one stays "phone". Instead of hiding it, another tactic may be to put it inside a 1x1 pixel "overflow:hidden" DIV. You could also set the border to "none" and the input box very small, essentially hiding it in plain view. Or absolutely position it off the screen (eg. left: -100px). Or all of the above just to make sure. What's the idea of the CSS in a separate file? Why not in the HTML page, or even inline?

But my 99.99% successful tactic to date (over the past year anyway) has been to use a jQuery get() to call the form HTML from the web site. So, when the page first loads, there is no form at all, and no hint of a form being there. I can only assume bots are looking at the page and deciding there's "nothing to see here" and/or can't be bothered running a webkit client and loading a lot of JS - which is understandable if they need to be quick and efficient. So people see the forms, but bots seemingly don't. I've had maybe 10 "manual-looking" spams (ie. friendly one-liners) in a year, but nothing which looks like a bot (ie. elaborate, formal or includes links/html).

I think if both this and your "honey-pot" approach is combined, it might be a winner?

Re:I've never used CAPTCHA'S

[cavebison]

Thank you for that information. We will keep that in mind while we work on the next version of our spambot.

jQuery is the way to go to get around most bots, which need to be quick and efficient, so can't be arsed running a complete Webkit implementation and loading a lot of extraneous JS & CSS just to put some crap in a form. That would be a far too inefficient way to scrape sites for forms - it's not even "scraping", it's loading the entire page in a browser every time, running the JS and checking the DOM when it's all done.

I assume not many bots are going to employ that method just to spam a contact page. Probably just the ones targeting high profile things, like Wordpress sites, with exploits.

Re: I've never used CAPTCHA'S

[corychristison]

The specific reason I suggest an external CSS file is to rule out simple parsing of the DOM/CSS. Also because I put everything in cacheable, minified CSS files. Just a matter of preference, really. I intentionally avoid Javascript solutions to make it simpler for me, and so I don't rule out the odd user using NoScript or similar. As others have mentioned, it is very commonly used. And typically inneffective on high traffic sites. I run a business doing design/development/hosting where 80% of my clients are local SMB's (although I am currently in the process of expanding into virtual server hosting, but that is another story). The described methods work for me and my clients. There are clearly much more complex routes you could take, but usually at a cost of causing more problems than it is worth. Just my opinion, though.

Re: I've never used CAPTCHA'S

[corychristison]

I didn't want to get too indepth but I have covered that issue simply by using autocomplete="off" on thr form, and input elements.

To take it even further I generate the form field 'name' & 'id' tag attributes at random on page generation, and store a 'map' in the session data to un-obfuscate it on the submitted page. My session handling implementation prevents session hijacking, also.

Re:stupid

[icebike]

It is possible to train an algorithm to recognize CAPTCHA, even if the success rate isn't 100%, it is high enough to enable bots to register on websites with CAPTCHA. So, Australia is only pushing people to find out better solutions than CAPTCHA. In short term, a large amount of spammers will rely on optical recognition algorithms to decipher CAPTCHA anyway.

True, but I think the OPs point is those smart bots are not that frequently encountered. We know it can be beat, but in everyday life it is still not common to encounter such bots, and even when you do, you end up blocking 98% of the bots.

As those bots become more common, captcha will become less and less useful. Its a self solving problem that probably doesn't need any help from government, because government will invariably impose something more stupid and useless.

It's not just a matter of registration

[roc97007]

One time registration is one thing -- I can just punch the re-captcha until I get something I can read. (But if I can do that, couldn't a bot do it too?)

It's the sites that require captcha for each login that really chaps my ass. Yeah, I'd vote for it to go away.

Re:stupid

[prestonmichaelh]

Not if you employed other technical measures. Search around a bit and you'll find captchas are unnecessary.

In all sincerity, can you post some links? I'll even take an insulting "lmgtfy" that end up with some good results.

I hate captchas, but all the other methods I have seen and tried (hidden form elements, javascript checks, etc.) all break down in one place or another.

Re:stupid

[Teancum]

I'd be curious about what "technical measures" you are talking about. There are some "universal IDs" that help to filter out some of the spam, but it still can slip through in a way that Captchas help prevent. There is also something philosophically wrong with trusting in some huge 3rd party vendor like Facebook, Microsoft, or Google to be processing authentication on your website, not to mention concerns about the NSA tracking everybody who is logging into your website as well.

Again, I'd be curious about what technical measures you are talking about.

Re:stupid

[Belial6]

I'm not a fan of CAPTCHAs, but your statement makes no more sense that declaring passwords bad because it is the websites problem, not yours.

Great news for those without Old English keyboards

[ambanmba]

Looking forward to not needing to look for the "Long S" character on my keyboard anymore http://blog.ambor.com/2013/07/an-unexpected-risk-of-using-re-captcha.html - I'm always worried that my employer is filtering on words like goatfucker when I mean to write goat(Long-S)ucker.

Re:stupid

[Anonymous Coward]

The easy thing for you to do would be to simply detect if the user is in Australia, and simply ban them from your website.

If this law passes, and most websites just refuse to serve Australians, then the fault, blame, whinging and recriminations can lie solely with the law and the people who created/passed said law.

Re:Pissing and Moaning

[mlts]

What might work would be a pseudo-anonymous service:

Company "A" demands some personal info, validates it, chucks it, and makes a master certificate on your private key. You can then have other private keys (as many as you want) certified, each completely separate from the others, and the only connection is company A's certificate. Company "A" can even charge a small fee, say 25 cents for each key certified, and an initial fee of $1.

Then, the website could ask for you to just copy, sign, and paste some random text with your key. Then, the website checks if your key is validated with company "A", and grants/denies access.

If the website noticed that they are getting spam from someone with the key, they notify company "A" about it, and they revoke all keys owned by that user. This prevents any new accounts from being made, although current ones are left intact.

Of course, there would have to be degrees of separation, so that the user info that is validated never leaks to the throwaway keys used for each site, and there are some tuning items such as what constitutes validated, and what to charge. It isn't 100%, but it can be used.

Of course, another solution is requiring clients to have a client cert from a known good CA (and making sure the cert is a paid one, not a temporary, 30 day.)

Re:stupid

[mrjb]

More bitching. Got a better idea to prevent bots from signing up?

Re:stupid

[icebike]

i've been using minteye on my site. it's a visual captcha, works pretty well. you move a slider back and forth to unscramble an image.

I never heard of it, and upon googling it, their own website wouldn't couldn't get pass my no-script. So right there, a significant and growing number of customers would be turned away.

But, I wonder of that would remain effective, after all, bots already exist to recognize letters in images. (Those bots existed before captcha). So as soon as Minteye becomes popular it will be bot-stormed.

I've also seen the word games, these are fairly unique as well. But I'm not sure they couldn't be attacked as soon as they become popular. It almost seems that obscurity is the best we have these days.

Re:stupid

[ancientt]

Twilio. Facebook Connect. Twitter @Anywhere. OAuth. OpenID.

I wasn't posting that, but it is kinda obvious what some better ideas are.

The problem is the symbols

[Karmashock]

The "which of these pictures is a kitty" or the question "what is 1+1=?" are superior. The distorted text is irritating.

And as to the deaf... most CAPTCHA's will offer a "press to speak" feature.

Re:The problem is the symbols

[Smauler]

And as to the deaf... most CAPTCHA's will offer a "press to speak" feature.

Very useful ;)

Re:Pissing and Moaning

[intermodal]

Hey, don't get me wrong, I generally agree with you on this. Unlike Anon, you properly read the tone of my previous post as indicated by your reaction.

This group is, in fact, a bunch of whiny narcissists who will be ignored. And I'm fine with them being such.

As far as the when they'll start to care bit, you're right about that too. But we are, of course, dealing with narcissists. I can't come up with any good reason to really care if they're happy or not. These are the people who will demand to know why they can't embed media files on a forum that disallows it, and then whine and try to take their ball and go home when they don't get special permissions to do so. And then be back a month later, still pissed off and wondering why nobody wants to be their friend anymore.

solution

[Khashishi]

The solution is not to make it harder for spammers to post. The solution is to murder spammers after they post.

Re:stupid

[icebike]

If taking a couple seconds to answer a CAPTCHA is too much effort, I probably don't really care what you have to say in the comment section.

It's not longer just a couple of seconds when one has to hit the reload button a dozen or so times before they get a CAPTCHA that's remotely readable.

And half the sites bit-bucket at least some of the data you've entered just as further punishment. So you have to type that in again.

Show me the captcha before I enter any data please. That alone would confuse half the bots out there. (For a while).

Re:Pissing and Moaning

[EvanED]

How do you propose working around the following problem:

Someone named "stewsters" is spamming me. Please disable his account.

Re:Pissing and Moaning

[timmyf2371]

To an extent, you're right in that it's the website operators who want to use systems like the CAPTCHA. But the primary reason for using such a system is so that users can access the website quickly, and without wading through a tranche of spam to get to what they want to read.

The companies and website operators who use technologies like CAPTCHA didn't suddenly decide they would implement them, just to annoy their users. They are there for a reason and if we as users want rid of them, then we should absolutely be in favour of better alternatives.

Re:stupid

[icknay]

Mozilla Persona http://www.persona.org/ is the new best one -- not tied to any corp, but without the usability problems of openid

CAPTCHA is dead! Long live CAPTCHA!

[Anubis IV]

People seem to forget that the term "CAPTCHA" (Completely Automated Public Turing test to tell Computers and Humans Apart) applies to a much broader set of tests than just those obfuscated text-based things that most of us loathe. Banning CAPTCHAs is a silly notion that would adversely affect every site currently using them, as they become swarmed by spammers. Instead of banning them, they should be asking people to use sane, simple CAPTCHAs.

For instance, on a forum I run for a group in a game, I use a form of CAPTCHA that has people drag words into categories. As an example, if our group name was "Guild X of Y", I might make the categories "Words in our group's name" and "Words not in our group's name", then ask them to categorize the words "Guild", "Elephants", "X", "Tree", "Honor", "Plus", and "Ocean". I have about two dozen sets of categories and words configured, and so far it's had a 100% success rate at stopping spammers from registering. It's also made it easier for people to register, since the number of e-mails and other off-forum messages I've received complaining about the difficulty of the CAPTCHA has dropped to 0 while registrations have actually picked up.

Such a system would obviously not work for Google or someone that large, since a spammer would just train the bot to know all of the answers, but for smaller sites, there are plenty of solutions that work just fine, and I'm sure we can find more systems that are simple for a human but complicated for a computer. No need to make something that's so complicated for a human to solve.

Alternatively, go with xkcd's approach to solving the problem of spam.

Re:CAPTCHA is dead! Long live CAPTCHA!

[soccerisgod]

I myself was thinking of this...

Re:stupid

[IamTheRealMike]

The NSA and its friends already track who logs into your website (or at least the IPs that do) so I wouldn't worry about that one too much.

One technical measure that has been floated recently is the idea of using Bitcoin. What you do is provably sacrifice some bitcoins to miner fees, thus creating a kind of anonymous passport. That proof of sacrifice has public keys embedded in it to which you own the private keys, and it was provably expensive to create. So the idea is that you sign up with your passport and then if you misbehave, it can get added to a blacklist kind of like how Spamhaus blacklists IP addresses. Now you can set the cost of abuse to a precise degree. Good users only have to pay once and can use the same passport for years. Abusers find their business models are unprofitable.

Unfortunately the software and protocols for that aren't implemented yet.

OCR is too good

[Animats]

Text-oriented CAPTCHA schemes are obsolete, especially as a way to get humans to help with book OCR jobs. If the OCR program can't read it with context, humans probably can't read it out of context. A sizable fraction of book-scan CAPTCHA images aren't even text, let alone words. I've seen ink blots, mathematical formulas, and Cyrillic in what were supposed to be English-language CAPTCHAs.

Re:Pissing and Moaning

[EvanED]

am also not a doctor but I can say that a patient dying on the operating table was likely not the desired outcome. I can tell you this despite not knowing how to design a rocket or operate on a person.

Yep. But at least for a while, people dying on the operating table will happen, because even if people were perfect and never made any mistakes, we simply don't know how to prevent such occurrences completely.

I don't think you'll find people claiming that CAPTCHAs are a good solution to the problem, but without stating a position on the matter (I'd have to see some hard evidence) it seems to be not completely unreasonable to say that that they're better than the alternatives.

Let's go back to the OR table. Suppose that you have a condition that has a 90% chance of being fatal sometime in the next year. We can operate, but the operation has a 10% of fatal complications. Should you say "Operating has a 10% chance of a negative outcome. I'm not gonna do it. Figure out something better?" and wait around until we do?

Re:stupid

[zieroh]

Not if you employed other technical measures. Search around a bit and you'll find captchas are unnecessary.

You keep saying this, and you continue to not provide any citations. Just because you say it is so does not make it so.

I run a web forum that is attacked every single minute of every single day by spambots from China, Russia, India, and Pakistan. Captchas are one of several technical countermeasures I use to keep from being overrun with spam -- and by overrun, I mean really, seriously overrun. Forum spam is incredibly prolific.

Each of the technical countermeasures stops some of the spam. Dropping captchas from the mix would allow far too much spam to get through. And yes, I've closely examined the contribution of each countermeasure.

Re:stupid

[prestonmichaelh]

Twilio. Facebook Connect. Twitter @Anywhere. OAuth. OpenID. I wasn't posting that, but it is kinda obvious what some better ideas are.

So on a business site, you would require a user to log in with an account from another site/system before they could contact you to show interest, request a quote, etc.?

I understand for web forums, etc, but my issue is contact forms on business sites. Most users don't want to share their facebook or twitter accounts and haven't heard of most of the other options.

I did see another post about combining the hidden form element technique with a short submission timer that looked interesting though.

Re:stupid

[N_Piper]

If what presents itself as only the most barely notable disability in day to day life excludes me from your consideration as thoughtful well spoken adult due to a single special circumstance, I don't care too much about your comments either.

Re:stupid

[plover]

Minteye was very thoroughly broken.

http://translate.google.com/translate?sl=ru&tl=en&js=n&prev=_t&hl=en&ie=UTF-8&eotf=1&u=http%3A%2F%2Fhabrahabr.ru%2Fpost%2F167359%2F&act=url

Essentially, the guy realized that jpeg pictures with distortions should have a completely different size than the undistorted picture. But all pictures delivered by minteye were of identical length. He figured they were padding the files with zeros, and he was right. By counting the number of zeros at the end of the file, the local maxima/minima was the correct file. He wrote a few lines of javascript, and it was broke.

Re:Pissing and Moaning

[intermodal]

This is not a negotiation. Nor would I want it to be. I'm fine with a better alternative being presented, but these users are the last ones I want to see present it.

You seem to assume I'm siding with the group. I'm not, really. I'm just saying that they want to be rid of captcha, and that's fine. When it becomes not fine is when the companies fail to respond to user issues with the current system.

Seriously, we can do better than Capcha, and I bet the guy who comes up with that idea is going to rake in a lot of cash, not tack it for free to a petition.

Re:stupid

[nbauman]

How many blind people are there who use the Internet without assistance?

I know blind people, and people who have very poor eyesight. Most of them are older. When I talk to them about computers, they're not interested. One woman with macular degeneration tried a screen reader, and didn't like it. (That's $10,000 worth of equipment sitting in her closet.)

Back in the days of COBOL, there were a lot of training programs to teach programming to blind people. And there were a lot of successful blind programmers. There were braille printers. Then came Windows, and it got a lot harder for them to read the screens....

There are laws that require organizations that serve the public to provide reasonable accommodations to the handicapped. I support those laws. A lot of people have problems with hearing or vision. A lot of people can't climb stairs.

The question is, "What's reasonable"? If this were a widespread problem, and a million blind people can't read CAPTCHAs well enough to use Skype, that's a big problem and we might have to throw out CAPTCHAs. If it's just a dozen blind techies, maybe we could work out some simpler solution.

It's a cost/benefit question. What's the scope of the problem?

Re:stupid

[dkf]

Because we all know computers are terrible at doing arithmetic and solving simple equations

But they are. It's out of context, and it's much harder to make programs that are flexible like that. They're bringing a regular expression to an arithmetic party.

Re:stupid

[PPH]

So you push the bot detection problem onto a third party. But when they are overrun, the smarter bot operators won't spam the identification sites. So these service providers will never have good statistics on which measures work and which don't.

Re:Pissing and Moaning

[Richy_T]

Also, because emails are completely impossible to process automatically and not as trivial as adding "*:|spambot.pl" to the aliases file.

Paid services

[dumky2]

I have a solution. It's called paid services. Services where users have to log in and pay a subscription are much less susceptible to bots than free services. No CAPTCHA for users, less spam for hosts.
Yet somehow I feel most of the slashdot crowd (and internet crowd in general) doesn't sympathize enough with service providers to consider this an acceptable alternative.

Re:Paid services

[YukariHirai]

For me, it's less "doesn't sympathize enough with service providers" and more "doesn't see enough value in a webforum to think it worth paying a subscription for".

Re:stupid

[Spazmania]

Or a couple of minutes considering most capchas are illegible.

Hear hear! Captchas were fine when they started but lately they do this weird wavy thing. I have to hit reload a few times before I get one where I can make out all the letters... and my vision is just fine.

Re:stupid

[game kid]

Facebook Connect is not a "better" idea.

Re:stupid

[Leslie43]

Agreed, my systems (combined) are hit every 3 seconds by spammers and hackers.
While people may hate Captcha, webmasters do as well, until we have something that works at least as good, it stays, along with my other levels of fighting spam. It's imperfect, troublesome, and a hassle at times, but it's still one of the more effective anti-spam systems out.

And no, I will not let you login from Twitter or Facebook or any other junk, that opens up a whole new host of issues.

Re:stupid

[Garridan]

Looks like it's a flash-based captcha that applies a simple transformation to an advertisement. So, it forces your users to stare at your ads. It's got a huge flaw -- a human might need to decode each ad once to train a bot to decode every instance of that ad. Minteye will work until the point that it gets even a little popular. It would take a competent programmer with experience in image processing an afternoon to break this.

Easier technology to circumvent captcha

[symbolset]

Bad guys run some pretty high traffic sites that oddly enough, require captchas. Their client bots forward the real site captcha to the bad-guy site, which delivers it to a human who wants access to the bad-guy site and answers it - which answer is passed back to the bot and submitted to the legitimate site in real time. They also compromise legitimate captcha-secured sites for the same method. It's the Mechanical Turk method of defeating CAPTCHA. Machine learning of text recognition is not required.

Re:Easier technology to circumvent captcha

[Goaway]

I have never seen any evidence whatsoever that this actually happens.

It has been suggested many times that it could be done, but not once have I seen anyone point to it actually happening in the wild.

Re:stupid

[cheekyjohnson]

Facebook Connect. Twitter @Anywhere.

Just no.

Re:stupid

[Quantum gravity]

Agreed. I've found asking a question like "What is five plus seventeen?" is much more effective at keeping spambots out than any standard CAPTCHA.

This is Australia

[PPH]

One of the Five Eyes Alliance. No doubt, the 'best' replacement for CAPTCHAs will be a centralized authentication/login authority. Or at least a few large outfits that can be arm twisted into linking everyone's accounts together. Like Google, Microsoft, OpenID, etc. Its just a variation of 'think of the children'. Think of the blind.

No thanks. I'll keep my on-line personas separate.

ASCII Art CAPTCHA for the Win

[spinozaq]

I recently started getting hundreds of spam signups a day on my site. So I installed a CAPTCHA to prevent that. I setup a standard image CAPTCHA with a plugin for the CMS. More then 80% of the spam sign ups just walked right through it. Then I changed the type of CAPTCHA to an ASCII art CAPTCHA. I haven't had a spam sign up since. The ASCII art CAPTCHA is also much easier to read then weird image CAPTCHAs.

Re:ASCII Art CAPTCHA for the Win

[hh10k]

I think you miss the point of the original article. A blind user will find it impossible to register on your website.

For my sign-up page, I replaced the image CAPTCHA with a text box labelled "Enter the text 'I am not a spammer'". This solved my spam problems, but neither of our solutions would work if our websites became popular and spammers decided to specifically target us.

Re:ASCII Art CAPTCHA for the Win

[spinozaq]

Maybe, but I think an ASCII art is quite a bit more difficult to break, even if directly targeted. There is enough font and size variation that you would have to get an image and then use OCR. That's a lot of extra work.

Re:ASCII Art CAPTCHA for the Win

[Dynedain]

In other words, the spammer's bots had rules to handle the particular image captcha you used, and didn't have rules for the ASCII one you chose.

It might have been a bad CAPTCHA system, I've seem some that do stupid things like put the actual letters in ALT text or the image asset URL. Hell, I've seen one that draws the image using javascript, and the original letters are right in the source for anyone to harvest with basic scripting abilities. Those kinds of systems are easily broken, and when you know a large percentage of a particular CMS install base uses the same broken system, you end up with the experience you described.

If your ASCII-based plugin becomes common, I guarantee the bots will start detecting and bypassing it.

Re:ASCII Art CAPTCHA for the Win

[Andreas Mayer]

The ASCII art CAPTCHA is also much easier to read then weird image CAPTCHAs.

ASCII art should be rather easy to beat. Just blur the image and increase contrast.

Re:ASCII Art CAPTCHA for the Win

[Andreas Mayer]

Maybe, but I think an ASCII art is quite a bit more difficult to break, even if directly targeted.

It's not. It's essentially just adding a bit of noise to the image.

Force the SpamBots to Moderate Your Forum for You

[Stormy Dragon]

Instead of a CAPTCHA, show them two posts and indicate if none of them, one of them, or both of them are spam posts. Behind the scenes, one if a post you know for sure is good or not and one you don't know about.

You can use the responses to rate users (how effective is this user at rating posts, based on how well they do identifying spam?) and posts (how likely is this post to be spam based on what users say about it?). Bad users and bad posts get booted from the system.

Re:stupid

[longk]

I bow to you, because to my simple brain many captcha's these days are a PITA. Enough of a PITA that I'll say fuck-it half the time and a website just lost a potential subscriber/user.

Re:stupid

[YukariHirai]

I can't say I like the idea of having to buy into something I don't trust to get the privelege of using certain websites.

Re:My first anomynous coward post on Slashdot

[flimflammer]

LOL I have to submit a Captcha code to post this to Slashdot, I love the irony!

How is that ironic?

Upper Case or not?

[Trax3001BBS]

Even now I'm not sure if letters need to be entered as shown ie: some letters are upper case, some lower case.
I'm leaning towards it doesn't matter.

Re:stupid

[wonkey_monkey]

These are only first impressions, but it looks ridiculously easy to solve automatically.

First of all the warp angle jumps significantly more before and after the "correct" image than between other images, so a fairly simple block tracking algorithm would have a very good chance of identifying the correct image:

[image]

You don't have to get exactly the right image - one or two either side and you're okay.

Secondly, the warped images are significantly less sharp than the correct image - in a purely mathematical sense, too, which means it'd be simple for a computer to identify the correct image (confirmed with high pass filters and histograms).

But it's actually a lot simpler than that, as plover has posted here.

What you've got there is CAPTCHA through obscurity, nothing more.

Re:stupid

[YukariHirai]

Those are not effective solutions. At best, you'd be shifting the problem slightly, and those services present other problems.

Re:stupid

[wonkey_monkey]

Actually, my mistake; what you've got is a company selling adverts through your site that users are forced to look at.

Re:stupid

[Marxist Hacker 42]

I moderate on a blog about autism. It uses captcha fairly heavily. Adding catpcha has done exactly NOTHING to reduce the 20 new users a day and the three or four who post spam.

It does go in waves. And from the language used, I've got to think it's Eastern European/Asian mainly. But boy is it prolific, and apparently captcha is worthless for stopping it.

Truly, Capcha is worse than worthless.

[VortexCortex]

Anyone using a widespread bulletin board software will know that despite hard Caiaphas, spammer accounts are registered like crazy.

I include a small set of questions and answers relative to the interests of those who would visit the board. E.g., for Slashdot:

Complete the following sentence:
[randomly select from sentences]
"TFA" is an acronym meaning "The _______ Article". (7 letters)
Another alias for "Anonymous Coward" is "________ Dweller". (8 letters)
--etc--
Prior to instituting this simple questionnaire there are usually hundreds of spammers a day. Afterwards? None.
This is actually trivial to solve, indeed I don't even use the session token as a seed for creating new mappings between the numeric question ID, and the answers. So, a diligent spammer could simply collect all the questions then add the responses to the bot... Only THEN would I escalate to the code I've already written that does the randomized mappings, after first swapping in a new set of questions / answers.

But why?! Why wouldn't I use the MORE secure way right away? Because I'm not a fool. It has to be worth their time to enter an authentication war with me. Let them waste time writing a bot solver first, then immediately have their work become useless. In fact, this has already happened a few times. It's even rarer for spammers to then continue escalation -- they could just migrate to one of the other boards that is not so hostile, and upon which pre-made automated solvers still work. In fact, I have found good success Starting with only a single question. Replace the selection function:
sub random(){ return 4; } # Return truly random number, selected by fair dice roll.
Then I can simply revert to the randomized set of questions to escalate the spammer's coding and deployment cost. Thus, gaining yet another defense at little cost.

Any heterogeneous environment has what's called a "Single Point of Failure". This is why sex exists. Combinatorials are a simple way to get some randomness without all kinds of unexpected outcomes that rampant mutations in an asexual production would first attempt. Bacteria can use other methods because they've abstracted reproduction from defense: transformation, conjugation, etc. So, the uniform use of SSL, is stupid to put it mildly. It could have been like a bacteria, standardized and abstracted extensible protocol for defensive encryption... It's not though, it's a dumb for including a heterogeneous set of transforms dictated by AES standard. I mean, virtual machines exist; You're using one to decode font glyphs, and Unicode BIDI right now, but not for extensible encryption? How daft. Pervasive use of a brand of Captcha is equally retarding.

How foolish you humans are to not even learn the most basic of Life's Lessons. Diversity is a defense. When you use science to analyze natural selection's method of Trial and Error, Observation of results and Preservation of favorable outcomes... I bet you don't even make the correlation that Nature invented Science billions of years before you rediscovered it... I bet you don't even realize that's a universal truth inherent to any self improving cybernetic system, from DNA life compilers to C compilers. Ugh. Humans: Can't live with 'em; Can't teach 'em to survive.

Re:Truly, Capcha is worse than worthless.

[quenda]

> Another alias for "Anonymous Coward" is "________ Dweller". (8 letters)

That one is culturally biased and took me a while. It might eliminate a lot of humans from countries (or even states?) where such architectural features are never found in homes.

Re:stupid

[plover]

Adding rel="nofollow" to any links provided by your untrusted commenters is a good start. It's a promise that Google and other search engines won't do any indexing or page ranking based on the href in the same tag.

Spammers have a pretty common M.O. They sign up with an account and use their spam link as their "home page". They then pollute the blog. The obvious spam is repeated variations on the same topic, and looks like "brand name products, products brand name, brand products name, ..."

Lately, link spam is done with a flattering but generic message that looks like it came from a non-native speaker: "I thanking you for your keen insight, have you other similar articles online? I would like to know more how you come to know this." An unwary site operator will often mistake the flattery for a conversation, and allow the spammer to remain a user. (The flattery is script-generated, by the way.) Their "home page" is often a dummy "news portal", which is just replaying whatever feeds they can get. The trick is this news portal has lots of links to the sites the SEO is trying to push.

While rel="nofollow" will render their efforts to associate their spam with a legitimate blog completely wasted, there are two negatives. First, unless the spammer knows it's there, they're going to spam you anyway. Second, it takes away your contribution of "linkiness" for your legitimate users' links to Google's pagerank algorithm. You can fix this with extra work like "probationary" and "full" users, but then you're taking on the task of rating your readers, which may be Sisyphean on a site the size of Slashdot.

Re:stupid

[Marxist Hacker 42]

I still think for small topic-based blogs, a set of whitelisted words works the best. If a post doesn't contain any of the whitelisted words, it's spam.

Annoying only for the blind and dyslexic?

[FuzzNugget]

I'm neither and they annoy the hell out of me; and those little "validation games" (dump the fish into the bucket, or whatever) are ridiculous time-wasters. I'm also a web developer, so there's that. CAPTCHAs are for lazy web developers to offload the task of anti-bot protection to the user.

Create some dynamic form elements that only display via Javascript DOM and are required by a backend script. Create a per-IP limitation on registrations per 10 minutes. Require a minimum time between form loading and form submission. Require a cookie to submit the form.

The point is: the more variety of anti-bot systems that exist, the less attractive a target there is for bot makers.

Re:Annoying only for the blind and dyslexic?

[Dynedain]

You do realize there are javascript-enabled browsers out there that can be used as libraries in any software, including bots?

I tried using the audio CAPTCHA a couple times

[NotSoHeavyD3]

Each time I swear it was an Aztec chant out of the Necronomicon to raise the evil dead. (And I'm only being partial sarcastic when I say that.)

Re:I tried using the audio CAPTCHA a couple times

[Capsaicin]

Each time I swear it was an Aztec chant out of the Necronomicon to raise the evil dead.

Well that explains the Poltergeist at my place, but it still doesn't help me access the damn site!

Re:stupid

[plover]

There's an obvious measure: don't allow untrusted users to provide links at all, and sanitize their data (server side) to mangle any protocol headers from their text, like adding a space before any text matching ://, so the results become http :// , https ://, or mailto ://. No search engine will try to follow those. You are already santitizing your inputs to restrict users from posting bad stuff like javascript, right? This is just one more thing to check.

You could even get cute using javascript in the browser to flag the text in red if they try to type a URL so they might know in advance they will get nowhere.

Then, to reward the faithful, you can have a karma system that permits voted-up users to post valid links (like stackoverflow). Or you can have an admin manually grant them "good user standing". Either way, your spammer is either contributing real value to your site (which is great) or they've gone away (which is great.)

Re:stupid

[mpeskett]

Because it's an unusual approach. If it were adopted en masse it would become the biggest target, and you'd see bots that were able to parse simple math problems from natural language and compute the answer. That isn't a thoroughly hard problem, and may even be amenable to hand-coding the set of cases for different wording the generating system is programmed to use.

Re:stupid

[noh8rz10]

don't you think they fixed it? it sounds trivial to fix.

Here's a CAPTCHA

[Alomex]

/\37R07URF campaign. Most captchas nowaday even included a link for an audio CAPTCHA.

Re:stupid

[noh8rz10]

no, you can choose among three options: 1) they show ads, 2) you show your own photos (which could be ads for your producs, lolcats, or whatever, 3) they show generic photos, flowers in this case. so some of the criticisms on this thread are valid, but the adversing one isn't an issue.

Re:Captchas were completely defeated YEARS ago

[Anonymous Coward]

If you actually read the links you posted, you would know that apart from the ‘just hire humans’ approach, only 1 worked with Recaptcha and that problem has since been fixed. That article also makes it apparent that simple difficulty increases need not-so-simple AI increases to be overcome.
And hiring humans isn't popular, probably because the response rate for Viagra spam is so low that even a tenth of a cent per captcha is simply too expensive.

What?

[viperidaenz]

So people who can't see are unable to click a button that plays the word so they can listen to it?
The same people who use screen readers...

What's wrong with putting aria tags on the button, so their screen reader tells them about it?

Re:What?

[Dynedain]

Click on that audio button sometime and see if you can solve it.

Re:stupid

[noh8rz10]

i said below - adverts are just one option. you can also show your own images (plugs for your own products, lolcats, whatever, or have them show generic images like flowers. i agree about potential for breaking - sounds like a cat and mouse game where they keep refining their photo algorithms.

Re:stupid

[noh8rz10]

i'm not surprised their site would fail, but the captcha itself doesn't fail when put on other sites.

Re:stupid

[mysidia]

Show me the captcha before I enter any data please. That alone would confuse half the bots out there. (For a while).

Show me a simple Calculus problem or Trigonometric identity to solve in regular text, instead of a single word all muced up. It would be easier to solve

Re:stupid

[rduke15]

This tehnique won't work for long: https://www.google.com/search?q=five+plus+seventeen

Re:stupid

[mysidia]

There are bots that can automatically register on a site, then check the email account for the activation link, in order to start spamming, so that's not a solution.

You e-mail them an encrypted PDF or encrypted Word .DOCX file. With an instruction to visit the link; when they visit the link, they are prompted to double check their phone number -- a call is placed using VoIP technology, and an agent speaks out the secret code required to open the PDF or MS Word file.

The DOC file when opened contains "Unique directions"; for example a link to click on

Then a phrase such as "Four score and seven years ago"

Instructions: Please type the digits of all spelled out numbers in the above and then subtract the square root of 16 from them. Type in twice the value calculated.

Remove every 2nd word from the above phrase, then make the next to last letter of each word capital and remove trailing vowels. Add a trailing punctuation mark and lowercase the first word.

Questions

[ducomputergeek]

I run a couple Wordpress sites for people and ran into massive spam problems. Askimet solved many of the comment spams, but not user registration. Eventually found a plug in that inserts random questions like What is the fourth word of the sentence." Or What colour is the sky? That has effectively blocked 99.9% of splog spam.

Re:stupid

[AlphaWolf_HK]

The only alternative to this that I see is for a central ID system which independently verifies you are an actual person. Trouble is this has some rather severe implications for privacy, in addition to being a central point of failure.

In either case, spam isn't going away anytime soon now that spambots are operating out of the Tor network.

Re:stupid

[mysidia]

But they are. It's out of context, and it's much harder to make programs that are flexible like that. They're bringing a regular expression to an arithmetic party.

It's not necessarily trivial, but it is definitely a lot easier than an image recognition or image CAPTCHA solving problem.

Regular expressions are great for parsing and normalizing.

s/seven/7/ s/minus/ - / ....

Re:stupid

[mysidia]

It does go in waves. And from the language used, I've got to think it's Eastern European/Asian mainly. But boy is it prolific, and apparently captcha is worthless for stopping it.

It's probably called: human help in solving the captchas. Captchas eliminate lots of spam --- the automated stuff, not the stuff that has human help behind it.

I wouldn't judge it 'worthless' until you've experimented with shutting the CAPTCHAs on and off many times at different randomly selected sampling intervals -- gathered the data, and found; no effect on the rate of spammers signing up.

Re:stupid

[bdwebb]

If the site is designed for those of us who have been through semi-advanced maths and if the spambot had no ability to perform basic calculations sure.

Ultimately I agree that it would be easier for you or I to solve than trying to decipher the Sumerian cuneiform that most CAPTCHAs pass off as text...in practice, however, I think this would alienate about 90% of the target audience while making it easier for bots to decipher and bypass.

Re:stupid

[TapeCutter]

I support those laws.

Ditto. Hovever installing a ramp does not mean you are not allowed to have a staircase. I seriously doubt introducing a law that technically handicaps web site owners is the best way to help blind people access the web.

Re:stupid

[rueger]

Show me the captcha before I enter any data please.

Yes! God yes! I've walked away from a few sites that expected me to re-enter a whack of data because the CAPTCHA borfed. Including some where I had intended to spend money.

It always seemed stunningly obvious that you carry over the form contents in situations like this.

Re:stupid

[SolitaryMan]

That is what pisses me off the most about it. You have to struggle *after* you have already made some effort to enter information.

However, they know it very well too that if they show you the captcha *before* you enter any data, most people will just give up right away, because they haven't invested anything yet.

Re:stupid

[BrokenHalo]

Likewise. If it looks like it might be worth my time to get to the content of a site, I might make two, maybe even three attempts. More than that, and I'll abandon the site and add it to my hosts file never to be visited again.

An authentication tool that is easier for computers to solve than for humans isn't of much use. Especially when the user is being made to feel like he is being punished for visiting the webpage.

What about...

[msobkow]

If this is such an issue for accessability, how much worse are Flash media, .jpeg'd text messages/media, and AJAX?

None of those technologies lend themselves to text reader applications nor to braille translation.

Nor have I ever seen a Captcha on an actual useful web site -- instead they use little things like manual verification of new accounts, especially things like IBM's developer web sites and my bank account. In fact both my bank account access and my government tax account access required snail mail verification codes for the initial log-in.

Methinks someone over-rates the importance of websites that rely on CAPTCHAs.

Re:stupid

[ancientt]

I like it. I hadn't done any quality research, but it is nice to see work done toward making a non-corporate and easier option.

Re:stupid

[ancientt]

I prefer to use one or two accounts to having to create a new one for every site I go to, yes. I prefer to trust one or two well designed systems rather than every half-baked cowboy coder, yes. I think that most people don't care much what system they use and are more likely to trust twitter than john's-favorite-blog system. They're also more likely to remember a password to a couple of sites they regularly use than use a complex system to generate new ones for each of the dozen ones they otherwise.

Plus, with most of those options, I don't have to process a CAPTCHA each time.

Re:stupid

[ancientt]

They move the authentication process to a few providers rather than hundreds. The few used are more likely to be secure and less likely to need complex authentication each time.

Re:Force the SpamBots to Moderate Your Forum for Y

[Dynedain]

This would fail.

The majority of spam comments now are autogenerated with keywords and generic "thanks for this info, I will come back and read again" messages. Your typical user won't recognize this is spam. It's just like using bayseian filters for email spam.

Re:stupid

[ancientt]

Remembering a couple passwords and using an authentication they already have is more effort? I don't get how you come to that conclusion. They address the problem of having to create a new ID and prove humanness via CAPTCHA, which is rather the point of the discussion.

no. computers render game scenes 100 times per sec

[raymorris]

Um, no. The computer doesn't have to understand the meaning of a scene in order to render it. Games are rendered a hundred times per second. The GPU doesn't know that's Lara Croft's boobs, it's just polygons.

Re:stupid

[master5o1]

pad it with random instead of zeros?

Re:Are you retarded? And how are we gonna stop spa

[Andreas Mayer]

Vastly superior methods for stopping spam have existed since well before captchas were invented.
They still exist today. I've written about them at great length (elsewhere), as have others.

I guess it's just an oversight on your part, that you didn't include a link, right?

The problem is not that these methods don't exist, or aren't effective, or aren't well-understood; the problem is that people refuse to invest the effort to learn them.

Well, I would love to learn them. Unfortunately, every alternative method I heard about, was either less effective or did simply solve a different problem altogether.

Re:stupid

[slartibartfastatp]

An anedocte: I had a website which the only page which is accessible for a non logged user is the user request page.

I got a lot of user requests with bizarre usernames. Denied them all. But I started getting 10-20 per day, and increasing. That only stopped when I put a captcha on that page.

huh?

[therealkevinkretz]

If it's reasonable to kill captcha because it's something that works for many but not for a few, why shouldn't the entire (well, 99.999%) of the web that's inaccessible to the totally blind be banned as well?

Re:huh?

[uninformedLuddite]

in the US that would be 99.97%

Re:stupid

[crossmr]

purging the spam comments isn't even half the problem. I recently set up a site for a small hobby group here using Joomla with K2. As they only had a few members and were migrating people from a facebook group to their site, they didn't really feel the need for a lot of things, like captchas on the blog comments. 2 months after we set it up, I get a panicked text about how it isn't working and the hoster had shut down their site. After getting access to site, I found there were hundreds of thousands of blog comments which had basically been posted at once by some spam bot.

Captchas enabled, no problem since. Screw blind people. If they want a site to even use, they'll just have to deal with it. not that I think they'd be much for a bike club..but I could be wrong..

Re:Are you retarded? And how are we gonna stop spa

[marcosdumay]

Don't read the references I provided.

And where did you provide those references?

Re:stupid

[InvalidError]

Quite right.

While some visual captchas can be quite obnoxious, audio captchas (at least the ones I ended up trying) are truly evil.

Good thing blind people tend to develop much better hearing. They're really going to need it on those audio captchas.

Re:Pissing and Moaning

[grumbel]

...but how do they sign up for that email account?

Via your mobile phone number, Gmail has been doing that for a while for new accounts.

And its already failed.

[pimpsoftcom]

I'm visually disabled and while I agreed sighties often overlook our needs the cold hard truth is that any sort of support for the blind will be leveraged by spammers and bots who seek profit at the site owners expense. Would I love to have better support for mend others like me? Yeah.. but I'm a realist and I know its never going to be a priority for most people because the sighted done care about the blind like me.

Collateralized Identity

[Gareth Williams]

I think Joe Cascio's idea of "collateralized identity" looks really interesting here:
http://joecascio.net/joecblog/2013/03/25/collateralized-identity-using-bitcoin-to-suppress-sockpuppets/

The core problem we're really trying to solve with a CAPTCHA is: anonymous identities are very cheap to create. We can require the user to provide and verify an email address, but it turns out those are cheap to create too. What we really need is a way for the user to prove that they have something invested in their identity - be it monetary value, time, cpu cycles, or whatever. A bit like slashdot karma (so you can filter out trolls/spammers using identities with nothing invested in them, which are cheaply created/replaced.)

Bitcoin, if it should ever gain widespread adoption, provides a very convenient mechanism to accomplish this:
1. each bitcoin user already owns pseudonymous unique public identifier (ie. their bitcoin address), which they can provide to any website as a portable identity
2. to prove ownership of this identity the user can sign a challenge from the website using their private key (hey, we just solved the password problem too!)
3. an amount of monetary value (ie. bitcoin) stored at this address, plus the length of time it has been stored there, is publicly visible on the block chain.

This allows the website to assign weight to the identity based on a combination of: the amount of value stored with the identity + the time it has been stored there. An identity that has had $20 stored with it for 3 days is probably not a spammer. An identity that has had $0.20 stored with it for 3 months is also probably not a spammer.

Of course it is easy to generate an unlimited number of such identities - but hard to have a decent amount of value stored with each of them for a decent amount of time. Websites can easily adjust the weighting threshold required to sign up / post comments based on experience with incoming spam. And there's always the ban hammer - which suddenly has some real weight behind it again :)

Important to note:
1. the money (ie. bitcoin) associated with the ID stays under the user's control at all times. The user alone has the private keys required to transfer/spend it any time they like - of course doing so would lower the weight assigned to their identity by any websites that inspect it.
2. the website need not store any authentication information for the user (eg. a password). The user retains control of their private key, and can use it to authenticate without disclosing it to the website.

Too hard for Joe Public to understand? Maybe.

Just imagine this all wrapped up in a friendly browser plugin. When you visit a website there's no login page - your browser has your private keys (perhaps encrypted with a master password, like Firefox's password manager does today) and just automatically authenticates you. Your browser could provide a drop-down "switch identity" widget in the toolbar to let you flip between multiple IDs / generate new ones, which is the only bit visible to the user (they need never hear terms like "private key".)

An "add weight to this identity" option would allow you to add/withdraw funds for any ID. Initially this might look like a bitcoin transfer (confusing for non-technical people), but a private company could easily provide a regular payment gateway on top of this (ie. accepting dollars), making the process no harder than recharging your skype credit.

Adding weight to any identity would be strictly optional, but might eg:
* allow you to skip CAPTCHAs
* allow you to post at +2 on slashdot by default
* generally increase the trust in your identity being genuine all over the web - use your imagination....

Re:stupid

[epyT-R]

fine.. run your own site, or go somewhere else.

Re:stupid

[Capsaicin]

You could start off with your common-or-garden variety spam filter and increase the linguistic sophistication for your defences from there ...

C'mon, given the technology that exists to spy on you everyday, CAPTCHAs are a really dumb way to deal with this problem. I mean, if we can land a man on the moon ... oh yeah we can't any more, forgot.

Protection against copyright extension

[tepples]

What happens once Project Gutenberg runs out of books published before 1923?

Re:Protection against copyright extension

[bratwiz]

Simple, they re-up the patent extension on the printing press and hire a gaggle of submarine shysters and start knocking on doors...

TFA is about blind people

[tepples]

Suggestions probably get shut down because the "one corner case" happens to be the subject of the featured article.

Re:TFA is about blind people

[Zmobie]

From TFA:

and dyslexic people and older ones

No, there are more to consider than just that corner case in the summary alone. Besides that, the discussion evolved into how bad CAPTCHAs are in the general case too which is what I was talking about.

You think phone number is a unique key

[tepples]

Your solution breaks with multiple people in the house who share a phone.

Re:You think phone number is a unique key

[uninformedLuddite]

That's OK. Obama can give them all one.

Web != visual

[tepples]

The web is not a visual medium. It is a medium of the HTML DOM, even if your favorite user agent happens to present it visually. Blind people use tools called screen readers that read text in the DOM aloud.

Captcha for the blind

[Time_Ngler]

For a captcha for the blind, how about the question "Which sentence makes sense?" and grab a sentence from some out of copyright book or something with four other computer generated ones, that are grammatically correct, but otherwise are nonsensical. Something like:

A. He was a light, slow, and there is a small Saturn -- away from a high flame lying in the life within it.
B. This was not illegal (nothing was illegal, since there were no longer any laws), but if detected it was reasonably certain that it would be punished by death, or at least by twenty-five years in a forced-labour camp.
C. Its neck was a novel entitled "Kaleidoscope Vision," which is hat crinkle were like fresh glass domain key
D. He was shrill the world was a greenish drink at me that leads to allow the cold water

Re:Captcha for the blind

[Dynedain]

Interesting idea, but it's clear that systems like Wolfram Alpha, IBM's Watson, etc, are making inroads into language processing which means it's only a matter of time before this would be broken as well.

The featured article

[tepples]

Read the (7 letter word starting with F) article: I must be lousy at counting today because "featured" looks like it has eight letters.

Re:The featured article

[uninformedLuddite]

I always read it as 'the fucking article' myself

Re:stupid

[Thanshin]

I have no mod points so I must say that if everyone had that same reflex you just displayed, of checking ones assumptions when it's trivial to do so, humanity would be conquering the universe at this point.

Re:stupid

[old_kennyp]

As a moderator on a Popular Australian bonsai website, Without captcha we wod be screwed. the amount of spam whil having it on is bad enough, We had it turned off for a while and got hammered!

We actually use multiple methods, and we still get spam!

the only answer would be to shoot every spammer!

Re:stupid

[Quantum gravity]

True, but that is likely to be the same for any widely adopted solution. The best protection is probably just to have a question that is fairly unique and yet has a well defined or known answer.

Re:stupid

[FireFury03]

They move the authentication process to a few providers rather than hundreds. The few used are more likely to be secure and less likely to need complex authentication each time.

Or: They move the authentication process to a few providers rather than hundreds. The few used are more likely to be heavilly targetted by spammers and less likely to do the required job.

Authentication and determining trust (i.e. determining whether the "user" can be trusted not to spam) are two separate problems that are perpetually bundled together inappropriately. IMHO they need to be separated:

The authentication service provider needs to be someone the user trusts - when I go to some-random-blog.com and have to authenticate to leave a comment, the blog can contact my authentication server to find out who I am. The blog doesn't need to know how my authentication server is authenticating me (could be a password, or kerberos, or whatever), all the blog needs is confirmation from the auth server that I really am who I say I am. So I can log in with "me@example.com", the blog makes a DNS SRV lookup on example.com to find the auth server, does a challenge/response handshake with the auth server that proves that the auth server has determined that I really am me@example.com. The authentication server can be run by myself, my ISP, my email provider, facebook (if I were insane), whoever - the important thing is that the authentication provider is someone I trust and no one else gets my actual authentication credentials. This immediately massively reduces the threat of leaked passwords, etc. since I'm not having to hand my passwords out to random people I don't trust.

The "trust provider" (i.e. the service provider that determines whether or not I'm a spammer) needs to be someone the blog owner trusts - it could be run by the blog owner themselves, or some third party (google, etc.). All it does is some verification that my ID (me@example.com in the example above) is used by a human. The blog asks the trust provider for verification, the trust provider says "this ID doesn't belong to a spammer" and the blog allows me to post. I guess some kind of feedback mechanism would be good so the blog owner can inform the trust provider if I start spamming.

This even provides some level of anonymity - I can have multiple IDs all backed by the same authentication credentials at the same server if I want, and it could be arranged so the blog itself never even sees my ID, only the trust provider actually needs to see it. And if I *really* trust my authentication service (i.e. if I run it myself) then I only need one set of authentication credentials in order to log into anything - whether that be slashdot or my bank - because no one except my auth service actually ever gets trusted to see those credentials.

Re:stupid

[jellomizer]

If the site you like does get spammed, then it is your problem.
More Spam = more expensive site to run = need for more income = more adds smarter adds ones that go around add blocks.

I am all for ending capatachas however what are the alternatives?
Please I would like more discussion on good alternatives, then just busting on an old attempt that works OK.

zoom zoom zoom

[admiralfurburger]

I am vision impaired & *had* a hard time with captchas.

Until I remembered that in firefox, ctrl+ zooms.

When I run into a captcha, I hit ctl+ a few times, fill out the captcha & submit.

Then I hit ctrl- a few times to get it back to the appropriate size. Yes, I know about ctrl0, but I already run most pages a little zoomed.

Every single person I have shown this to, vision impaired or not, no longer has a problem with captchas...

pass it on!

Re:stupid

[mysidia]

I think this would alienate about 90% of the target audience while making it easier for bots to decipher and bypass.

We need to ask 4 or 5 questions, and allow the visitor to "Choose which question to answer"

Please answer three of the following, and leave the rest blank:

1. If it's a leap year, and February 29th is a Tuesday. How many days will there be in February next year, and what day of the week will it be come March 1?
2. If you turn on the television and there is no signal, what might you hear?
3. If Google, Yahoo, and Bing, are my favorite search engines, in that order. And Google shuts down permanently, which of these could still be my favorite?
4. If the policeman decides to arrest a person, he binds their hands with what?
5. If you are supposed to be at work at 4:30 AM, and you are 10 minutes early, then what time did you arrive at?
6. If Barrack Obama was elected in 2012, what year does the term of office legally end?
7. If John borrows $1000 from his bank on February 1 2014 and repays the loan with a lump sum payment on February 1 2014. How much does he have to pay if his bank charges 10% APR monthly compound interest over the period?
8. What lies at the root of suffering?
9. The 8th commandment says that you shall not what?
10. What number is missing from the sequence? 1,1,2,2,3,3,4,4,5,5,6,__?__,7,7,8,8,9,9
11. The person who was president of the United States in 1998 had a pet dog. What was its name?
12. What actor played Luke Skywalker's father?
13. What does Bilbo Baggins hate?
14. What title did Gryffindor first appear in?
15. If you mix yellow paint and blue paint in equal proportion, what kind of paint do you get?
16. If you bought a $5 lottery ticket once a week for 22 weeks, how much money did you spend?
17. The globe coordinates 28 degrees N, 81.9 degrees W are nearest which continent?
18. A right triangle has a 45 degree angle. Please list the measures of the other angles in ascending order:

...

Re:stupid

[maroberts]

Captchas are a regrettable first line of defense to keep the remaining spam manageable. You really need multiple defenses to keep the conniving bastards out.

Re:Are you retarded? And how are we gonna stop spa

[Arrogant-Bastard]

There's a missing comment upthread which included half a dozen or so links (including one back to Slashdot) about projects that have quite, quite effectively demonstrated that captchas are worthless.

Of course anyone of even modest intelligence would be capable of doing their own homework and searching the web for things like "captchas defeated", then reading what they find. It's old news (years-old, in fact) by now, so there's plenty to read about. But then again, nobody of modest intelligence would even consider using captchas: that's the province of the lazy, the stupid, the ignorant, the worthless.

Here, I'll get you started: https://freedom-to-tinker.com/blog/felten/cheap-captcha-solving-changes-security-game/

That's one of MANY. You should be able to find some of the rest in a few moments without further assistance from me.

Re:Are you retarded? And how are we gonna stop spa

[Arrogant-Bastard]

No, not a troll, just very aggravated that this conversation is apparently necessary. The lack of cognitive and research skiils among defenders of captchas is appalling; how can ANYONE be so amazingly ignorant as to not recognize that the only captchas that haven't been thoroughly defeated are those that aren't worth defeating -- because what they "defend" is so pitiful that not even spammers care about it?

As to your incorrect speculation on my background: I go back to ARPAnet days, kid. So I've earned the right to be a little snotty from time to time when faced with the kind of monumental ignorance on display in this discussion.

But you know what? If you want to blindly persist with your pathetic captchas and your laughable belief that they have any value at all: go right ahead. Just keep holding up tissue paper in front of a tank and hoping it'll work. I'm sure that'll work out just great for you.

Doesn't work anyway

[Arancaytar]

Computers can solve some of these more easily than humans can. We can stop pretending we're still better than machines at optical character recognition.

Re:Doesn't work anyway

[Arancaytar]

Could try a Web of Trust / reputation approach instead. A site may require your content to be signed with a key (which may be linked to a pseudonym, and which the site operator may allow hiding from the public) in order to be published without pre-moderation, or in order to bypass strict filters. The identity that the key protects could then be rated by reputation databases.

You'd lose some anonymity on sites that require such keys, but nobody forces you to limit yourself to a single identity for posting everywhere.

Re:stupid

[pla]

That isn't a thoroughly hard problem

Solve it, then.

From apples three, bright and red, Billy ate the first and bled - A razor had a witch hid there. One drop, two drops, three drops, more! And gazing down at the evil barb, he reflected on the primary causes of World War II. Drip. On the Pythagorean theorem, drip. On shoes and ships and sealing wax, drip drip drip. On the price of a first class stamp. On dasher and dancer and oh, the agony. He noted the blood, ignored the rest, what is six times 9 less pi? Then he died. Alone. In the rain.

Go ahead. I'll give you another when you have a program that can parse that one correctly.

You can automate one part of that, though - Any IP that answers 50.858, you simply auto-ban as a spambot.

Counterproductive captchas

[RabidReindeer]

no.. this is about blind people complaining that audio captchas are too hard.
you know why they complain? they haven't had to deal with a bunch of impossible visual captchas.

slashdot is one of the few sites with reasonable captchas.

There's more than just that involved.

A certain nameless site for a very popular product has color captchas. I desperately needed support, but could not register because it used a color captcha which rendered very poorly at my screen resolution and used colors that strained my less-than-perfect color vision.

And the maddening thing about it was was that I already had seen plenty of spam posted to the forums. The spammers had presumably simply hired cheap labor to defeat the captchas manually.

Re:stupid

[patiodragon]

They've gotten too good. I cannot read them!

Re:Captchas were completely defeated YEARS ago

[serviscope_minor]

No. They are not. You are simply not worthy of attack

Once you climb down from your exceptionally high horse, you will realise that that is the very definition of working.

The *VAST* majority of spam is commercial spam. They routinely scour the entire internet looking for insecure forums and dump massive quantities of spam onto them. You don't have to tilt the economics very far in your favour before you're not worth the money to target.

I run a small, special interest professional forum. The first time I tried to put it up, it was unusable. Captchas made it usable.

And you're trying to tell me that it didn't work.

hey will go right through your alleged "captcha" defenses without the slightest problem.

And? Most places have a weak lock on the front door. A targeted attack would go through in seconds. That doesn't mean that the lock and door do not prevent the vast, vast majority of opportunists.

Re:stupid

[richlv]

spam would be your problem as well, as it would make many pages/sites unusable. while i do find some captchas annoying, i find spammers a thousand times more annoying. i wish them painful death, maybe by suffocating in sleep and waking up too late. or something.

Re:Are you retarded? And how are we gonna stop spa

[serviscope_minor]

because what they "defend" is so pitiful that not even spammers care about it?

You say that like it's a bad thing. I have a small, technical, professional special interest forum. It seems to be of value to the users given that they keep posting, but is "pitiful" according to you. The readership is not big.

Initially it got overrun by the massive bulk spamming operations. I put in a captcha. Now the economies don't work out for targeting a small forum like that.

Great! Captchas worked!

So I've earned the right to be a little snotty from time to time when faced with the kind of monumental ignorance on display in this discussion.

Yet you are the one being monumentally ignorant by assuming that anything worth protecting but not worth attacking is "pitiful". You seem to be ignorant of the whole world of small special interests out there that are valuable to the members but will never be big.

I am fully aware that captcha's are not very strong security. Neither is the lock on my front door. But I guess my house is "pitiful" since I don't have the crown jewels locked up inside.

Re:stupid

[wonkey_monkey]

don't you think they fixed it? it sounds trivial to fix.

Their website's examples are still zero-padded, so it seems not.

Re:stupid

[wonkey_monkey]

It's still trivial to break: https://gist.github.com/Glyxbaer/4564489

Re:stupid

[jareth-0205]

If taking a couple seconds to answer a CAPTCHA is too much effort, I probably don't really care what you have to say in the comment section.

If you can't take a couple of seconds to skim through the summary and discover that it's not just about time, it's about accessibility, then I don't care about your opinion either.

Create a better service alternative

[Ash-Fox]

Instead of complaining for it's removal, they should instead implement an alternative to systems like re-captcha, such as a world wide phone verification system and their expense and provide it free to webmasters. Otherwise free solutions like re-captcha will remain dominant.

Alternative CAPTCHA

[mcalchera]

All you have to do is ask a simple question: "Are you a robot?" with radio buttons for "yes," or "no." Bots can't lie if you ask them if they're a machine. I know because an undercover cop told me.

Re:Pissing and Moaning

[Ash-Fox]

Do that, and support bitcoin (its way easier to support than most currencies).

Two problems:

1) People are lazy and don't want to know.
2) People can't figure out how to get Bitcoins - See 1.

Re:stupid

[plover]

That implies that spammers are unconcerned whether or not their spam is effective. They're concerned about the ease of spamming.

Which makes perfect sense if you're farming out the task of spamming to cheap labor or to robots - the laborers will follow your instructions, it's not their job to analyze whether or not it's working. So you could warn the users all you want that their spamming will not be effective, but the spammers are not even going to read it, and will pollute your site anyway.

That further implies that even a weak captcha would be enough to stop robots and low-paid laborers. And a friend of mine offers anecdotal evidence that it helps. He added a check box to his site: "check here if you are not a spammer [ ]". It reduced some of the automated spam. But he still reads and approves all comments before they're posted, as there is still spam.

What about a script that produced randomized simplistic captchas: "Human test: two plus three equals [ ] four [ ] five [ ] six" "Please answer this question - three added to three is [ ] six [ ] seven [ ] eight". Vary the wording, vary the answers, vary the correct answer position, vary the position of the question on your sign up screen, and randomize the field name. It will stop robots until someone specifically targets your site.

Better, don't vary anything until you need to. Let the spammers do the work first of adapting to you. They might ignore your site unless you're really worth it to them as a target. Then vary one thing, and see if they "chase" you with a round of fixes. If they continually adapt their robots, (or pay for smarter laborers), then you need to do something else. If not, you've saved yourself a lot of work, and you still have fewer spammers.

It's an annoyance to completely-sighted people too

[neminem]

I've seen quite a number of CAPTCHAs that were so distorted they were completely impossible to deduce any actual Latin characters out of them at all. (Or the occasional CAPTCHA that actually very clearly had characters that were *not* Latin characters. Those are fun.)

I've found the best way to get rid of spambots without wonky captchas, is to have a free-form textbox field that requires the person trying to create an account to answer a simple question. For smaller sites, it can even be a static question like "what's the answer to this question: 5+6 = ?". For larger sites it can make sense to have a rotating or frequently-updated question about the site itself, something a spammer, even a non-bot spammer, wouldn't know without researching, but that someone who came to the site because they were interested in the subject would.

Re:Pissing and Moaning

[stewsters]

Perhaps you would need to have a certified account to report people. When you get decertified it will tell you what account banned you.

I would just make that stewsters guy (who obviously is a spammer) pay again to re-enable his account and take even more money. He would then report whoever reported him, producing a chain of cash that will only be broken when the spammer or the reporters are out of money. I would hope there are more people interested in removing spammers than there are spammers willing to pay money. Eventually, the spammers will realize that they have wasted to much cash and that the system is too costly to spam. Then I take that money, give a significant portion of it to charity, and use the rest to buy a sweet Maserati.

Its no more of a scam than ssl certificate authorities. Well, maybe a bit, but not much more of a scam.

Re:stupid

[lsatenstein]

If taking a couple seconds to answer a CAPTCHA is too much effort, I probably don't really care what you have to say in the comment section.

Or a couple of minutes considering most capchas are illegible.

This!

More and more, captchas take two or three attempts.
(Disclaimer: IMHO, I'm not senile, dyslexic, a horrible typist. blind. Your opinion may vary).

I suspect some sites are intentionally forcing a fail once or twice, at least occasionally, especially when you enter the word
in a timely interval. Bots probably give up after two failures, and they probably answer quickly.

So implementers make it more and more restrictive and throw in bogus failures.

I have a 13 inch diagnal laptop screen, and a 22 inch desktop screen, and theses distorted captchas are the pits. If they could be as good as the ones from /. I would not mind them. But for some site, the programmer, if you get the captcha wrong, wipes all your input.

Regarding multiple entries, "yahoo.com" always forces me to enter the password twice. That is at least better than clearing the form and starting from the beginning

Wonderful... NOT

[whitroth]

So, have some of the racists idiots with zero tech skills, and too much time on their hands, posted to this thread yet? I've already seen two stories - I think the last was on Beezos buying the post, that had a long, incoherent rant by some asshole, with nothing to do with anything other than their desire to masturbate in public.

                  mark

Simple solution to stop all the registration spam

[davidorourke]

The best and most simpler solution to stop all registration bot spam is make your registration double optin. If the bot cannot click a link in a confirmation email then the registration never succeeds. Even harder would be make the link in the email unclickable and make them copy and paste it into the browser to complete the registration. That is mission accomplished.

Re:stupid

[uninformedLuddite]

You did what? You know what you are talking about? You know you are on /. right?

Re:stupid

[uninformedLuddite]

You have to look at the intention of the law. In the US the percentage of legally blind people is 0.03%. People with disabilities should just accept that there are things that they wont be able to do. I know that isn't very PC and I will get hate for saying i. Shit someone has to don't they?. This is about forcing people to register their real identity when the first log on and that data being available everywhere they go online automatically. It is to make anonymity online as close to impossible as they can.

Re:stupid

[uninformedLuddite]

I wish /. had an edit feature. At least until I had had my second cup of coffee.

Re:stupid

[DirtyLiar]

What's wrong with the audio option that is offered by every CAPTCHA service *I* know of?

Including the one that /. uses for AC posts.

Re:stupid

[Garridan]

Per image, it's a one-dimensional search space. If you expect a human to solve it, they have to be able to know if they're moving in the right direction once they get close. That means an binary search (probably 10-ary) will do the job. This problem is computationally trivial. If this gets used on a single interesting site or a large number of uninteresting sites (e.g. wordpress or phpBB), you'll soon be spending more time making keys than you would spend filtering spam.

Re:stupid

[noh8rz10]

IIf this gets used on a single interesting site or a large number of uninteresting sites (e.g. wordpress or phpBB)

Ooooh BURNNN on Wordpress!

Re:stupid

[samdutton]

The Ryan Air site now makes you watch an advertisement before viewing their CAPTCHA.

Jehovah's Witnesses

[tepples]

and start knocking on doors

I thought the Watch Tower Bible and Tract Society had the patent on this. :p

Re:Jehovah's Witnesses

[bratwiz]

Its the Scientologists and Republicans though that worry me. They both got Ray Guns.

Learning disabilities

[theysay]

Also make it harder for you to solve CAPTCHAs. And there's nothing worse than CAPTCHAs on mobile.

Re:stupid

[mysidia]

So, scaring users away with wall of text and (more) complex instructions (than usual) while making it easy for the bots

No... only a few questions need to be asked. There are already a lot of questions on a signup form.

- they only have to know answer to few questions and refresh the page until three of those come up.

What makes you think they can refresh the page and get more questions?

I would limit signups to 1 signup per IP address per 2 hours, and use a hash of a timestamp with a 60 minute resolution concatenated with their IP address to uniquely select questions.

If they refresh the page; they will get the same questions.

Re:stupid

[dacaldar]

+1000 !

I am an intelligent person (probably like most people here), and also extremely observant by anyone's standards, and I find that the majority of the time, at least one character of the captcha is so hard to read that I have a 50% chance at best of getting it right.

Re:stupid

[mpeskett]

We have NLP that can parse sentence structure from syntax/grammar, and there's only one question in the entirety of what you posted. Hell, for that specific example I could isolate the relevant bit with a regex looking vaguely like /.*[,\.]([\w\d ]+\?).*/ (and yes, I know that would be defeated by scattering random question marks around the place, but I still think it's damning for your approach).

Besides that, I'll give you a dollar if you can put up a site that uses that system without the response from the registering public being "WTF how is log in formed?"

Re:stupid

[pla]

and there's only one question in the entirety of what you posted

Then I suppose you have, accidentally, shown my proposal as too complex - Because the "one question" counts as a red herring and gives you the wrong answer (thus my final statement of auto-banning anything that answers 50.858).

FWIW, the real "question" appeared as "He noted the blood, ignored the rest".