4 ms·
Clickcha - click the biggest/smallest number for CAPTCHA
- warp 16y agoThat doesn't look at all impressive. It seems easy to write a solver for it. Especially considering most spam bots are quite happy with relatively low rates of succeeding, they can just brute-force until they find one they can solve.
- est 16y agoI think they use javascript to record the coordinate (x, y) where you clicked it on one scenario you 'll select a 24x24 square out of a 200x100 pixel picture, the success rate is 2.8%
- zebra 16y agoBots will be happy by any success rate above 0%
- oscardelben 16y agoI'd like to combine this with akismet. Bots will be happy with a 2% rate but I'll be more happy than them with 98% less comments to check in the spam folder
- est 16y agoa five digit case-ignore number/letter success rate is 1/(36^5), it's very small but still above 0%
- iDope 16y agoHi, I am the developer of clickcha. Appreciate the input, but you seem to be forgetting that bruteforcing can be avoided by temporarily banning the IP for some time after certain number of incorrect attempts.
- zebra 16y agoDon't forget that spammers exploit botnets with tens of thousands zombie computers each one with unique IP. 2.8% from 10000 zombies = 280 first try successful breaches.
- niklas 16y agoThat's why they use botnets for this. Each attempt will be from a fresh ip.
- timelinex 16y agoDon't give up though, you are on to something. If you can make the permutation higher then yea you can definitely make it big.
- stoney 16y agoYou could make it much harder for bots by asking the user to click on two numbers (e.g. highest and lowest). I don't think that would be too much extra work for the user as most of the effort is in scanning through all of the numbers.
- timelinex 16y agoI think it's higher than that. I think we can atleast use some kinda of processing to detect where the circle/square/retangles are. So, it is more like 1/9. So in 6 tries there is a 50% chance of success.
- patio11 16y agoWhy would I pick a pixel at random when I could pick a black pixel and have better than 10% chance of getting it right regardless of the question with less than 10 lines of code?
- Groxx 16y agoClickcha is more secure than traditional text based CAPTCHAs which can be read via OCR software. Because... circled numbers can't be read by OCR software? Without some visual obfuscation, I fail to see how this is an improvement against bots. Simple OCR + location of match = 100% success rate (just click the middle). Improvement for users, perhaps, especially due to its simplicity... but I don't know if that's worth it.
- est 16y ago> Simple OCR + location of match = 100% success rate Sometimes it ask you to choose the biggest square, not only biggest/smallest questions. The challenge varies all the time. For example, I can ask you to choose the biggest triangle out of some boxes, circles and stars, and the question sentence can be displayed using a line of traditional CAPTCHA
- retube 16y agook sure, but how many permutations of different questions are there? Once you have these, it is trivial to OCR the numbers/shapes and pick the appropriate one per the question.
- Groxx 16y agoAnd then you fall into the same problem with a race between captcha/clickcha programmers (who MUST maintain ease for human-use) and spam programmers (who can click randomly and still sometimes succeed, so they only seek to boost their chances). I'll give them two guesses who will win most of the time.
- iDope 16y ago> how many permutations of different questions are there? Infinite! Just this of the possibilities with that kind of system. You could keep adding different questions (just minor variations) and it won't be difficult to keep ahead of spammers. Plus there is always a trade off between security and ease of use. I think the ease of use with clickcha is well worth the slight loss of security.
- oscardelben 16y agoI written to the website owner offering to do a port for ruby on rails. I think this clickcha will also cause curiosity in people and increase comments. Edit: what's wrong with this?
- ars 16y agoIs English your first language? Because if not you'll have a hard time understanding what I'm saying. (And if it is you have no excuse for the bad grammar.) Basically you come across as (you sound like) a "cheerleader". You want him to hire you, so you are praising his software. But your praise is false, and doesn't add anything to the discussion. Telling the whole world you want to do a ruby on rails port doesn't add anything to the discussion either.
- oscardelben 16y agoEnglish is not my first language, but I understand your point. I thought it was something nice after having read this page on his website: http://clickcha.com/faqs/ http://clickcha.com/faqs/ Thanks for the clarification, it indirectly helps me to understand both the culture and idioms of the english language.
- patio11 16y agoOn the plus side, this is going to cost the first motivated spammer who runs into it about $50 ~ $100 to get it broken by an Eastern European programmer who is better at OCR than probably anyone on HN. On the minus side, it is then totally useless aside from hassling actual users.
- timelinex 16y agoI think he is onto something, and just needs to think it through. I think creativity should be encouraged.
- wglb 16y agoOn the part of clickcha or on the part of the eastern european programmer?
- iDope 16y agoHow does this hassle users more than regular captchas? The only additional effort it adds is a bit of thinking (too much to ask these days?). You don't have to type anything and it replaces the "Submit" button so not even any extra clicks.
- mooism2 16y agoIt replaces the [Submit] button, so I can't tab to it and press space to submit, I have to move my hand from the keyboard to use the mouse. Ordinary captchas exclude blind and other visually-impaired people. Audio captchas exclude deaf and hard-of-hearing people. Clickcha excludes people with muscle-control disabilities.
- iDope 16y agoMost people click. But still, isn't it better than having to figure out characters and typing them? Of course, there would be alternatives for people with disabilities.
- mooism2 16y agoWhatever happened to the idea of filtering out comments that looked spammy, or that linked to spammy web pages? E-mail spam filtering has come a long way, without captchas to hide behind.