Slashdot Mirror
Research Unveils Improved Method To Let Computers Know You Are Human
An anonymous reader writes CAPTCHA services that require users to recognize and type in static distorted characters may be a method of the past, according to studies published by researchers at the University of Alabama at Birmingham. Researchers focused on a broad form of gamelike CAPTCHAs, called dynamic cognitive game, or DCG, CAPTCHAs, which challenge the user to perform a gamelike cognitive task interacting with a series of dynamic images. For example, in a "ship parking" DCG challenge, the user is required to identify the boat from a set of moving objects and drag-and-drop it to the available "dock" location. The puzzle is easy for the human user to solve, but may be difficult for a computer program to figure out. The game-like nature may make the process more engaging for the user compared to conventional text-based CAPTCHAs.
There are a couple research papers available: "A Three-Way Investigation of a Game-CAPTCHA:
Automated Attacks, Relay Attacks and Usability" and "Dynamic Cognitive Game CAPTCHA Usability and
Detection of Streaming-Based Farming."
I generally just close the page whenever I see one of those awful text based captcha, where you have to squint at the screen to even be able to tell 10% of the time what is written on those awful blurry squiggles. Whatever you're selling, unless I can read it and type it easily/quickly, it ain't worth my time.
you sound like the helpless baby boomers that bug the staff and ask questions when the answer to those questions is right in front of them. dont you have a homeowners association to run, a voting booth to visit, or a AARP magazine to read?
And then never have to do it again?
Not hard for Indonesians paid pennies a day.
to solve a reverse Turing test. Totally new idea.
Man if these start showing up, They're going to look exactly like those "hit the target 3 times to win" flash-based advertisements. I'll probably glaze over them multiple times trying to submit a form before I notice that a 'completing the game' captcha is what's preventing me from leaving my incredible razor wit splattered all over someone's comments section.
Looks like this is based on a fixed set of games and images. Just teach the bot all of them, and you are done. If this is self contained software I can install on my site, all the info you need to feed the bot is already packaged up in the source.
For things like this to defeat bots they have to rely on hard to invert functions, like rendering randomly warped things. Picking a few items from a lookup table is easily inverted by a bot.
Resisting replay attacks is cute, but it can't resist basic forwarding attacks (inherently impossible to prevent you from sending it to someone else to solve live: trivial proof, RDP exists.) and it is trivially solved by a bot. I see nothing useful here.
The nice thing about current text-based CAPTCHAs is that they can be applied to any website, whether large or small, and require very little input or tinkering from individual web administrators. The other nice thing about this is that they have an infinite number of possible variations, what with the different ways you can transform text.
This new idea would work great for a small site that will never be a target of a directed attack, but we already have hundreds of different CAPTCHA variations that can be used for that sort of thing. I use a simpler but similar idea on one of my sites, where I have new registrants drag words into matching categories that I set up. I've had zero bot registrations since I set it up a few years back, and a number of comments from actual users that love the system.
But if you apply something like what I use or this new idea to a site like Google, the folks trying to break in will inevitably code up algorithms to handle each of the finite number of minigames they set up with their finite number of items in them, rendering the whole thing pretty useless. The only way to get infinite variation out of it is to start applying image transformation to the items being used so that they can't be as easily identified, and if you start doing that, you're right back where we are now.
I am an ant! :P
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
The problem is that you can really only come up with a finite number of these, and once an attacker has a large enough sample of them (say, 10%), he can simply write a bit of code to 'solve' each one.
The thing about CAPTCHAs that makes them great is that you can randomly generate a huge bunch of them.
Anyway, the headline so completely misrepresents this research that it basically says the opposite of what the researchers are saying. The researchers, in fact, created an automated system to solve DCGs! Their contribution was a system that detects 'crowd-sourcing' attacks - attacks where shady companies pay volunteers pennies to solve CAPTCHAs by hand. The researchers said they are going to work on improved DCGs that can't be solved automatically, but nothing of the sort is being unveiled here.
A fool and his hard drive are soon parted.
I haven't read the article, but I do wonder... why about those with disability? Like poor vision, poor hand-eye coordination, etc.?
Proving I'm human just subjects me to more ads I don't want to see.
Time is what keeps everything from happening all at once.
When he comes back, I'll hit him with a paradox.
Im sure such a simple game could be done in html5 ...
Those games may be "engaging" when you want to play a game. When I want to do something different in the Internet, I feel more like annoyed.
...I'll threaten to shove its chips up its fanhole if it doesn't let me in.
Table-ized A.I.
And mentaly disabled ones too...
I think you will find that was Dell and Amstrad. Microsoft are the ones that made the appallingly inconsistent software that routinely leaks your data to criminals, and crashes with a BSOD.
Sent from my ASR33 using ASCII
While I mostly agree with you, and have seen more than one CAPTCHA that I can't solve no matter how many times I refresh, I have to disagree with you on the homeowners' association. While I agree that community is a good thing, and am in favor of community leagues that actually focus on community issues instead of rules about paint colors and whether basketball goals are allowed, almost every homeowner's association I've seen has been a way for the couple of people with the time and desire for control to override individual's property rights. Two homes ago, we were not allowed to use anything besides standard white mini-blinds in our houses, and at my last place there were only two colors that shutters and doors were allowed to be painted, and my landlord (an individual homeowner, not a complex) had to strip and restain his deck because at some point after he originally stained it they decided the previously allowed colors were no longer allowed.
HTML5? You don't need HTML5 to animate a few divs moving around, hell it'd be easy enough to make something that works as far back as IE6.
More to the point the web site needs to comply with disability legislation. In the UK blind/partially-sighted people must, by law, be able to use the web site. This is one of the advantages of CSS - you can keep the site clean so that it works well with a screen reader. In theory a web site (owner) can be prosecuted for disciminating against people who have sight problems, in practice this does not happen very often.
So: all the bot would need to do is to claim to be blind and so avoid the game playing CAPTCHA.
There are many different types of disabilities. Some people can't watch a moving picture, but otherwise are still perfectly functional. Having friends who have some disabilities, it is very wrong to pidgin-hole someone, because while they may be disabled in one area, they may be genious in another. Look at Stephen Hawking, for example. One of the smartest people alive, and can't move anything. Any sort of moving captca will totally eliminate him.
Yes, but is it accessible by disabled people, i.e., blind users that need screen readers..?
-Myke
..that the first truly successful AI will be developed by spammers and phishers to defeat this?
Mission: To provide products that consume time and energy as entertainingly as permitted by the laws of thermodynamics.
"For example, in a "ship parking" DCG challenge, the user is required to identify the boat from a set of moving objects and drag-and-drop it to the available "dock" location." This is worse than CAPTCHA
at some point after he originally stained it they decided the previously allowed colors were no longer allowed.
Homeowners associations have very little actual power. I would have told the home owner's association to take a hike.
You can't make a law after the fact. If this is true there is no way this would have held up in court. I've heard rumors of
crazy homeowner's associations demanding crazy stuff but to actually enforce it is expensive as you have to take
them to court to enforce it and many times the court will still decide in the actual homeowner's favor.
Visiting voting booths should not be an old people stereotype.
I can't remember where, but I've seen this in use this past week. When I saw it, first thing I thought was that this was one of those annoying ads disguised as a game that are out there. Still, once recognized for what it was, it was simple, much less a pain in the a$$ than the text based CAPCHAs.
09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
Since when are insults "informative?"
I'm with the O.P. I can't make out a large percentage of captchas.
-- sudon't
Air-ride Equipped
Off topic, but, are you kidding? These homeowners associations are in the news all the time for the egregious stuff they perpetrate. Just one memorable example: They took the paid-for home of a soldier who missed some assessment because he was busy fighting in Iraq or Afghanistan. He only got it back when the media caught on to it, and his congressman stepped in. Do you really think that contract you signed isn't enforceable?
-- sudon't
Air-ride Equipped
The only news story I've ever seen was one in florida where an old person's neighborhood was attempting to evict someone
because they had a "no children" policy. The media was as usual making a big deal about it but the homeowner's association
had spent months trying to evict her. Yes, the contracts are enforceble and if you're in the wrong then you can be found guilty
in court but it's a long drawn out process for both sides. Where I'm from (middle of missouri), there are all kinds of crazy
clauses like how many bushes you are suppose to have but most people take them as suggestions instead of rules and you
can go through any neighborhood and see dozens of violations. Which by the way is how it plays out in court. If you can
show that the rule is selectively enforced (for instance your neighbor already has a fence) then the court will throw out the
rule.
Speed Bump
And how will even the best, most fool-proof Capcha protect you from a spam bot system that passes that game, or other capcha, to some people farm in a foreign country? Or just to visitors to some other website that gets high enough traffic for the spammers to post sufficient volume of spam?
This, by itself, cannot solve the issue.
The issue is not "Prove that there is a human there".
The issue is "Prove that you, right there, right now, are a human, and not being passed to someone else, elsewhere".