4 ms·

Spammers are lazy. They like to target lots of sites at once. A post of mine from a few years ago explains the rationale behind one off schemes such as this: h

by wooster 16y ago

Spammers are lazy. They like to target lots of sites at once. A post of mine from a few years ago explains the rationale behind one off schemes such as this: http://www.nextthing.org/archives/2005/07/16/a-few-upgrades http://www.nextthing.org/archives/2005/07/16/a-few-upgrades My own has worked fairly well for me since then.

deleted 16y ago
[deleted]
Gnolfo 16y ago
"Spammers are lazy" does kinda work for the multitudes of small-traffic sites out there. Put together some unique or custom validation to keep out spambots and odds are that's all you'll ever need. The thing is, for big sites like Google or Yahoo that won't work. If Google implemented the slider I'd bet a month's salary that it would be flooded with spammers overnight. The CAPTCHA's they use have been put through the ringer and are proven to work against spammers who are focused and resourceful. By lining the two up like that, the post tries to equivocate big site CAPTCHAs with user-friendly client-side-only validation, but the latter is not even in the same league, much less an alternative. It works for the same reasons "Enter the sum of 3 and 5: ____" would work.
- wooster 16y ago
  The CAPTCHA's they use have been put through the ringer and are proven to work against spammers who are focused and resourceful. Not really: - http://securitylabs.websense.com/content/Blogs/2919.aspx http://securitylabs.websense.com/content/Blogs/2919.aspx - http://www.cs.sfu.ca/~mori/research/gimpy/ http://www.cs.sfu.ca/~mori/research/gimpy/ - http://www.zdnet.co.uk/news/security-management/2004/05/06/spammers-use-free-porn-to-bypass-hotmail-protection-39153933/ http://www.zdnet.co.uk/news/security-management/2004/05/06/s... - http://caca.zoy.org/wiki/PWNtcha http://caca.zoy.org/wiki/PWNtcha etc. Most of those articles are from several years ago. The state of the art has improved since then.
  - Gnolfo 16y ago
    Sorry, I should have been clearer on what I meant. Google/etc CAPTCHAs don't work 100% against anti-CAPTCHA. As those articles suggest it's a fluctuating 80% or so, and obviously an ongoing arms race. My point was more to the fact that the slider solution wouldn't retain anywhere near the same stats if it were put up against the same level of effort and sophistication spent towards breaking it. It would get solved and then bypassed completely.
Devilboy 16y ago
If you can automate it then by definition it's not a CAPTCHA
- wooster 16y ago
  I hate to break it to you, but I don't know of any image-based CAPTCHAs which haven't been broken/automated.
  - Devilboy 16y ago
    Simulating a click and slide is nowhere near as hard as automating, for example, decoding of Google's CAPTCHA. The whole point of a CAPTCHA is to make the automation as hard as possible without making it too hard for a human.

by wooster 16y ago

deleted 16y ago

[deleted]

Gnolfo 16y ago

"Spammers are lazy" does kinda work for the multitudes of small-traffic sites out there. Put together some unique or custom validation to keep out spambots and odds are that's all you'll ever need. The thing is, for big sites like Google or Yahoo that won't work. If Google implemented the slider I'd bet a month's salary that it would be flooded with spammers overnight. The CAPTCHA's they use have been put through the ringer and are proven to work against spammers who are focused and resourceful. By lining the two up like that, the post tries to equivocate big site CAPTCHAs with user-friendly client-side-only validation, but the latter is not even in the same league, much less an alternative. It works for the same reasons "Enter the sum of 3 and 5: ____" would work.

wooster 16y ago
The CAPTCHA's they use have been put through the ringer and are proven to work against spammers who are focused and resourceful. Not really: - http://securitylabs.websense.com/content/Blogs/2919.aspx http://securitylabs.websense.com/content/Blogs/2919.aspx - http://www.cs.sfu.ca/~mori/research/gimpy/ http://www.cs.sfu.ca/~mori/research/gimpy/ - http://www.zdnet.co.uk/news/security-management/2004/05/06/spammers-use-free-porn-to-bypass-hotmail-protection-39153933/ http://www.zdnet.co.uk/news/security-management/2004/05/06/s... - http://caca.zoy.org/wiki/PWNtcha http://caca.zoy.org/wiki/PWNtcha etc. Most of those articles are from several years ago. The state of the art has improved since then.
- Gnolfo 16y ago
  Sorry, I should have been clearer on what I meant. Google/etc CAPTCHAs don't work 100% against anti-CAPTCHA. As those articles suggest it's a fluctuating 80% or so, and obviously an ongoing arms race. My point was more to the fact that the slider solution wouldn't retain anywhere near the same stats if it were put up against the same level of effort and sophistication spent towards breaking it. It would get solved and then bypassed completely.

Devilboy 16y ago

If you can automate it then by definition it's not a CAPTCHA

wooster 16y ago
I hate to break it to you, but I don't know of any image-based CAPTCHAs which haven't been broken/automated.
- Devilboy 16y ago
  Simulating a click and slide is nowhere near as hard as automating, for example, decoding of Google's CAPTCHA. The whole point of a CAPTCHA is to make the automation as hard as possible without making it too hard for a human.