7 ms·

Why you should never use a CAPTCHA

16 points by joshfraser 16y ago

nollidge 16y ago
Site's down for me. Here's the text-only Google cache: http://webcache.googleusercontent.com/search?q=cache:http://www.onlineaspect.com/2010/07/02/why-you-should-never-use-a-captcha/&hl=en&strip=1 http://webcache.googleusercontent.com/search?q=cache:http://...
- joshfraser 16y ago
  sorry, my server is having memory issues. i'm looking into it now.
sliverstorm 16y ago
They are like 5 seconds of annoyance. I fill them out all the time, and I still don't particularly care. (perhaps because when it's a recaptcha, I am too busy gleefully wondering which word is the test and which is the text) If I wrote this article, it would go... Why you should never use CPATCHA: Because reCAPTCHA exists. You should be using that instead.
- dennisgorelik 16y ago
  Why use reCAPTCHA if there are plenty of less obtrusive alternatives? http://postjobfree.blogspot.com/2009/06/postjobfree-automoderator.html http://postjobfree.blogspot.com/2009/06/postjobfree-automode...
  - pavel_lishin 16y ago
    I like how that post had absolutely no relevant information, except for some vague description of an apparently in house alternative.
waivej 16y ago
OK, I like the idea to use a "hidden" captcha to block automated spam bots. However, I don't think a hidden blank field is enough. Maybe you could use javascript to set a value in that hidden field. Or make sure the client loaded the empty form page first? Anyone have better tests?
- joshfraser 16y ago
  remember that spam bots can be designed to work just like a browser and so they can execute javascript too.
- pavel_lishin 16y ago
  For any programmatic way of checking to see if the user is a human, without them interacting with the system, there's a programmatic way of faking it.
  - dennisgorelik 16y ago
    If you not only block problematic comment, but also block abusing IP address from for next couple of months -- it would be pretty hard to figure out what exactly your anti-abuse system checks for. Especially if your system check for several red flags.
- iaskwhy 16y ago
  Site is down for me at the moment so I'm not sure I understand what you mean by "hidden blank field" but I have a niche social network with around 150k pageviews/month and a simple css hidden input field on the signup form has been enough to keep all the spam away.
- honopu 16y ago
  Well, one way is to have a form input hidden by css, that is like spam catching 101. I actually found a fairly interesting sort of captcha I am using for signing of rental agreements using jsignature which draws a canvas that people can sign using their mouse. This updates a hidden form element with mouse x/y data to draw the signature again if you need to. You could potentially use something like this, but reCaptcha is incredibly easy to integrate.
pavel_lishin 16y ago
That sliding solution is great if you don't care about accessibility, but then I suppose visual-only captchas don't really work very well for the blind, either. Wonder how it works if you have javascript disabled, or are using a text-only browser, or have NoScript installed.
Jach 16y ago
I've used something like: Please join these two "words" together (without spaces): hitgzwhv and iprmagfg A little copy pasting required, but I discovered an older simple math one was vulnerable. Also changing the comment submission link seemed to have helped on its own. What I don't believe in is a captcha after the registration process. But in any case, wouldn't the idealized solution be a Bayesian spam filter? Is there an open source well-trained one out there that's easy to bolt onto anything?
- snissn 16y ago
  ..maybe pg knows of a few?
- vicaya 16y ago
  The strength of Bayesian filters is that they tailor to individuals, i.e., everyone can have a different model. An open source "well-trained" one is trivial to subvert.
Jun8 16y ago
What he doesn't get is this: Yes, they are easy to crack, especially using crowdsourcing, against which there's no defense. However, that still is a threshold against automated attacks, however small. The argument is the same as a free product vs. one that costs 2 cents, having a price, however small, changes the category. Or, you can think of it this way: Most simple home locks can be picked in less than 30 seconds, but you still lock your door, although it's a nuisance (find your keyes, etc.), knowing full well that this won't stop a determined attacker.
- joshfraser 16y ago
  great point
jamesshamenski 16y ago
It is funny that we are still using these old systems in CAPTCHA and reCAPTCHA. This week, NuCaptcha launched a video captcha offering. They have solved the readability and sweat labor issues that have come about. It's a true security offering that also improves input accuracy to 99%. http://Nucaptcha.com http://Nucaptcha.com Disclosure: I've advised with NuCaptcha on a pro bono basis.
- itjitj 16y ago
  Quick! Someone register "catpchaclassic.com"
- epochwolf 16y ago
  Booo advertising a non-yc funded company. (And the obligatory: Hooray unspecified chemically laced beverage!)
  - jamesshamenski 16y ago
    NuCaptcha solves the exact problems that the article outlines.
    - deleted 16y ago
      [deleted]
    - epochwolf 16y ago
      But you didn't say that. You said -> It's a true security offering that also improves input accuracy to 99%. !!!1!11ONE! If you want to plug something on HN, first you need to disclose that you are doing some advertising. (kudos, you did this) And second, you need to explain, without weasel words, how and why it's a good solution for the problem. Example of me plugging mongodb despite it only being marginally to the topic: http://news.ycombinator.com/item?id=1471516 http://news.ycombinator.com/item?id=1471516 [Deleted previous comment because I misremembered the thread I was replying to when I wrote it]
- Groxx 16y ago
  That's an interesting technique, but it seems like the human-detection is based more around it being a flash-based solution than any sort of obfuscation. e.g., if the text is always red, and always the same font (judging from the examples only), a screen capture of this would be far easier to decode than a regular captcha™. A flash-running bot should have a pretty easy time breaking it. Granted, the current state of the captchas™ is kinda bad.
cliffchang 16y ago
Why not use both anti-spam technology and CAPTCHAs?
- sstrudeau 16y ago
  To quote the article: "We live in a world where spammers are a real problem and must be addressed, but CAPTCHAs are not the answer. You simply can not afford the friction. By using a CAPTCHA you are making the internet a whole lot less fun for all of us."
edanm 16y ago
My local theater's site allows you to purchase tickets online. However, in the final ordering form, in which you enter your credit card details, there's a CAPTCHA. What are they protecting against? Automated bots sending them more and more money?
- ktsmith 16y ago
  The price of a single ticket is probably relatively small and so they may be protecting themselves from chargebacks. It is extremely common for those with stolen credit cards to test them using small value purchases. If you can find a site that doesn't rate limit your purchases in any way you can test a lot of cards at once, determine which cards are valid/active, and saddle the merchant account holder with tons of chargebacks and their associated fees.
  - edanm 16y ago
    I'd be very surprised to learn it was this complicated, but this is a very interesting take on it. Do people tend to have such a bulk of credit cards/credit card numbers that they'd test them in such a fashion? And also, wouldn't it be very risky (detection/police wise)?
    - ktsmith 16y ago
      I can't speak to anything but my own experience. Having helped on a few ecommerce sites for very small merchants, the amount of fraudulent purchases that came through was staggering. One of those companies has been open for about six months now and is only breaking even in large part due to the expense of dealing with chargebacks. What they have observed is that a significant number of cards were tested through what appears to have been a rented botnet. Those went away with the addition of a captcha. The remaining fraud that looks like card testing (only purchases of low value items, with IP's far away from the billing address and similar peculiarities) are often done from Tor exit nodes. Small merchants have very little support in this area. Local authorities often don't care or have the man power to deal with these types of issues. The banks and visa/mastercard also don't care since they just force the merchant to eat the costs and still collect all their fees. It would be very difficult to tie these transactions back to any one person in most cases as the tester is going to be using a valid card, valid billing/shipping address. Once they know the card works they can just have a mule go get a cash advance from an ATM or start having big ticket items shipped to various places for pickup. Or they just resell the card info as verified which increases the value significantly.

16 points by joshfraser 16y ago

Site's down for me. Here's the text-only Google cache: http://webcache.googleusercontent.com/search?q=cache:http://www.onlineaspect.com/2010/07/02/why-you-should-never-use-a-captcha/&hl=en&strip=1 http://webcache.googleusercontent.com/search?q=cache:http://...

joshfraser 16y ago
sorry, my server is having memory issues. i'm looking into it now.

sliverstorm 16y ago

They are like 5 seconds of annoyance. I fill them out all the time, and I still don't particularly care. (perhaps because when it's a recaptcha, I am too busy gleefully wondering which word is the test and which is the text) If I wrote this article, it would go... Why you should never use CPATCHA: Because reCAPTCHA exists. You should be using that instead.

dennisgorelik 16y ago
Why use reCAPTCHA if there are plenty of less obtrusive alternatives? http://postjobfree.blogspot.com/2009/06/postjobfree-automoderator.html http://postjobfree.blogspot.com/2009/06/postjobfree-automode...
- pavel_lishin 16y ago
  I like how that post had absolutely no relevant information, except for some vague description of an apparently in house alternative.

waivej 16y ago

OK, I like the idea to use a "hidden" captcha to block automated spam bots. However, I don't think a hidden blank field is enough. Maybe you could use javascript to set a value in that hidden field. Or make sure the client loaded the empty form page first? Anyone have better tests?

joshfraser 16y ago
remember that spam bots can be designed to work just like a browser and so they can execute javascript too.
pavel_lishin 16y ago
For any programmatic way of checking to see if the user is a human, without them interacting with the system, there's a programmatic way of faking it.
- dennisgorelik 16y ago
  If you not only block problematic comment, but also block abusing IP address from for next couple of months -- it would be pretty hard to figure out what exactly your anti-abuse system checks for. Especially if your system check for several red flags.
iaskwhy 16y ago
Site is down for me at the moment so I'm not sure I understand what you mean by "hidden blank field" but I have a niche social network with around 150k pageviews/month and a simple css hidden input field on the signup form has been enough to keep all the spam away.
honopu 16y ago
Well, one way is to have a form input hidden by css, that is like spam catching 101. I actually found a fairly interesting sort of captcha I am using for signing of rental agreements using jsignature which draws a canvas that people can sign using their mouse. This updates a hidden form element with mouse x/y data to draw the signature again if you need to. You could potentially use something like this, but reCaptcha is incredibly easy to integrate.

pavel_lishin 16y ago

That sliding solution is great if you don't care about accessibility, but then I suppose visual-only captchas don't really work very well for the blind, either. Wonder how it works if you have javascript disabled, or are using a text-only browser, or have NoScript installed.

Jach 16y ago

I've used something like: Please join these two "words" together (without spaces): hitgzwhv and iprmagfg A little copy pasting required, but I discovered an older simple math one was vulnerable. Also changing the comment submission link seemed to have helped on its own. What I don't believe in is a captcha after the registration process. But in any case, wouldn't the idealized solution be a Bayesian spam filter? Is there an open source well-trained one out there that's easy to bolt onto anything?

snissn 16y ago
..maybe pg knows of a few?
vicaya 16y ago
The strength of Bayesian filters is that they tailor to individuals, i.e., everyone can have a different model. An open source "well-trained" one is trivial to subvert.

Jun8 16y ago

What he doesn't get is this: Yes, they are easy to crack, especially using crowdsourcing, against which there's no defense. However, that still is a threshold against automated attacks, however small. The argument is the same as a free product vs. one that costs 2 cents, having a price, however small, changes the category. Or, you can think of it this way: Most simple home locks can be picked in less than 30 seconds, but you still lock your door, although it's a nuisance (find your keyes, etc.), knowing full well that this won't stop a determined attacker.

joshfraser 16y ago
great point

jamesshamenski 16y ago

It is funny that we are still using these old systems in CAPTCHA and reCAPTCHA. This week, NuCaptcha launched a video captcha offering. They have solved the readability and sweat labor issues that have come about. It's a true security offering that also improves input accuracy to 99%. http://Nucaptcha.com http://Nucaptcha.com Disclosure: I've advised with NuCaptcha on a pro bono basis.

itjitj 16y ago
Quick! Someone register "catpchaclassic.com"
epochwolf 16y ago
Booo advertising a non-yc funded company. (And the obligatory: Hooray unspecified chemically laced beverage!)
- jamesshamenski 16y ago
  NuCaptcha solves the exact problems that the article outlines.
  - deleted 16y ago
    [deleted]
  - epochwolf 16y ago
    But you didn't say that. You said -> It's a true security offering that also improves input accuracy to 99%. !!!1!11ONE! If you want to plug something on HN, first you need to disclose that you are doing some advertising. (kudos, you did this) And second, you need to explain, without weasel words, how and why it's a good solution for the problem. Example of me plugging mongodb despite it only being marginally to the topic: http://news.ycombinator.com/item?id=1471516 http://news.ycombinator.com/item?id=1471516 [Deleted previous comment because I misremembered the thread I was replying to when I wrote it]
Groxx 16y ago
That's an interesting technique, but it seems like the human-detection is based more around it being a flash-based solution than any sort of obfuscation. e.g., if the text is always red, and always the same font (judging from the examples only), a screen capture of this would be far easier to decode than a regular captcha™. A flash-running bot should have a pretty easy time breaking it. Granted, the current state of the captchas™ is kinda bad.

cliffchang 16y ago

Why not use both anti-spam technology and CAPTCHAs?

sstrudeau 16y ago
To quote the article: "We live in a world where spammers are a real problem and must be addressed, but CAPTCHAs are not the answer. You simply can not afford the friction. By using a CAPTCHA you are making the internet a whole lot less fun for all of us."

edanm 16y ago

My local theater's site allows you to purchase tickets online. However, in the final ordering form, in which you enter your credit card details, there's a CAPTCHA. What are they protecting against? Automated bots sending them more and more money?

ktsmith 16y ago
The price of a single ticket is probably relatively small and so they may be protecting themselves from chargebacks. It is extremely common for those with stolen credit cards to test them using small value purchases. If you can find a site that doesn't rate limit your purchases in any way you can test a lot of cards at once, determine which cards are valid/active, and saddle the merchant account holder with tons of chargebacks and their associated fees.
- edanm 16y ago
  I'd be very surprised to learn it was this complicated, but this is a very interesting take on it. Do people tend to have such a bulk of credit cards/credit card numbers that they'd test them in such a fashion? And also, wouldn't it be very risky (detection/police wise)?
  - ktsmith 16y ago
    I can't speak to anything but my own experience. Having helped on a few ecommerce sites for very small merchants, the amount of fraudulent purchases that came through was staggering. One of those companies has been open for about six months now and is only breaking even in large part due to the expense of dealing with chargebacks. What they have observed is that a significant number of cards were tested through what appears to have been a rented botnet. Those went away with the addition of a captcha. The remaining fraud that looks like card testing (only purchases of low value items, with IP's far away from the billing address and similar peculiarities) are often done from Tor exit nodes. Small merchants have very little support in this area. Local authorities often don't care or have the man power to deal with these types of issues. The banks and visa/mastercard also don't care since they just force the merchant to eat the costs and still collect all their fees. It would be very difficult to tie these transactions back to any one person in most cases as the tester is going to be using a valid card, valid billing/shipping address. Once they know the card works they can just have a mule go get a cash advance from an ATM or start having big ticket items shipped to various places for pickup. Or they just resell the card info as verified which increases the value significantly.