4 ms·

Death to Captchas

10 points by DanielRibeiro 16y ago

gchucky 16y ago
I'm sorry, I have a hard time with articles that complain but offer no solutions (and the one line at the end about Akismet doesn't really cut it for me.) I've seen some captchas that have you do simple math problems or other basic questions, which seemed to be a better alternative. I also remember seeing prototypes of a captcha that showed nine pictures and told users to select the three that were cats. Not sure why that never caught on, though.
- mike-cardwell 16y ago
  The trouble is, those sorts of captchas are trivial to bypass. They're good against an automated fly-by attack, but completely pointless against a targetted attacker. Not even a good targetted attacker, just somebody who knows how to write a script which submits a form. I could probably get away with using the cat captcha on my blog, but Facebook or Google wouldn't be able to use it. But the thing is, for a site like my blog, I don't even need to use a cat captcha. I just need to make sure dumb bots can't submit anything, eg using hidden fields: https://secure.grepular.com/Blocking_Comment_Spam_Using_ModSecurity_and_Hidden_Fields https://secure.grepular.com/Blocking_Comment_Spam_Using_ModS... So where do these image captchas have a place? Not on big sites, and not on small sites...
  - nollidge 16y ago
    I'm getting a certificate error from your link: secure.grepular.com uses an invalid security certificate. The certificate is not trusted because the issuer certificate is unknown. (Error code: sec_error_unknown_issuer) Edit: On both FF 3.6.6 and IE8 on Win7
    - mike-cardwell 16y ago
      Yep. The certificate is signed by cacert.org and their root doesn't exist isn't in your os/browser combination. I don't really want to turn this into a thread about my SSL setup so I will just say that if you want an explanation, you should read: https://secure.grepular.com/Why_Does_this_Website_Generate_SSL_Warnings https://secure.grepular.com/Why_Does_this_Website_Generate_S... Yes, I realise the irony about the explanation being behind the same certificate.
  - Vivtek 16y ago
    The problem with only screening for dumb bots is that it won't screen for the 25-cent-an-hour Ukrainian or African hired to submit spam with a human-driven browser.
    - mike-cardwell 16y ago
      That is a problem with all captchas
- StavrosK 16y ago
  My thoughts exactly. This post has nothing constructive to offer. The simple truth is that CAPTCHAs are a very good initial defence to spammers. We've been trying to find a problem to replace CAPTCHAs, but we haven't been able to find one that satisfies all these properties: 1. It has to be easy for a computer to create. 2. It has to be easy for a computer to verify. 3. The problem space has to be very large to thwart precalculation attacks. 4. It has to be easy for a human to solve. 5. It has to be hard for a computer to solve. Your math example fails #4, and the cats example fails #3. EDIT: How do we make lists in HN markdown?
- 9ec4c12949a4f3 16y ago
  What I had a really hard time with was this line here: >I suspect that since then captchas have probably gotten a bit better, but spam bots probably have as well. He uses conjecture as if it's good enough to strongly support his stance. He can't even dedicate the effort to do some fact-checking into something relevant to 2011. Meanwhile, I've always been a strong advocate of monitoring user actions and profiling on 'suspicion levels' which is significantly more complex than a captcha, but it gives you a set of eyes on someone at all times and can lock them out for spamming hundreds of emails about Viagra. That being said, we're right back at square one with users getting annoyed if the monitoring/blocking system isn't 'good enough.'
maeon3 16y ago
The next captchas will likely be "choose the animal" from a 2D picture. given the small images across the screen, choose the dogs. The people working to get through security measures will always be there, we might as well put them to good use. Get them to build innovative AI software to bypass security. The code to identify the animal in the picture will eventually find its way into the public and be put to good use.
njharman 16y ago
It's a 2 of 3 problem; We want three things 1) access to stuff 2) that access to be secure 3) no effort/time/delay for access. But in reality you only get two of those. In general things of "value" can't be both secure and fast/easy. If it's fast/easy it can(and will) be brute forced and/or Amazon Turked.
jamesshamenski 16y ago
http://www.nucaptcha.com/ http://www.nucaptcha.com/ Offers a solution in video captchas. Moving letters are way easier to read and if fraudulent activity is detected the videos slow down to a rate which becomes uneconomical to solve.
Vivtek 16y ago
Weird for somebody to complain about visual accessibility and have a site design that's so poorly readable. I mean, OK, I only got 2.5 hours of sleep last night and so I'm more sensitive than normal, but my eyes are still jangling from reading that.
eli 16y ago
I recently tried turning off our CAPTCHA for a few weeks and instead just blocking all comments with links. I was still getting hammered by 10% of junk comments that don't have a link. Many of them were gibberish; my guess is it's a bot cataloging which sites accept comments in the first place. Solving a CAPTCHA sucks for the person submitting the comment, but having a page full of Viagara spam burying any legit comments sucks for everyone. What scares me is the noticeable rise in spam comments being submitted by actual humans apparently in India and China. I set up a ModSecurity rule to block inbound hits coming from a Google search that includes the phrase "post a new comment" but that's only going to work for so long.
nopal 16y ago
>A far more elegant solution is to use some sort of filtering system (like Akismet). Such a system can run behind the scenes and work without complicating the user experience. I disagree. An automated system that calculates the probability that user data is invalid will inevitability report false positives, leading to blocked or deleted content. Try explaining that to a user.
noahc 16y ago
He gets it slightly wrong on how it works. One is not verified by a computer and one verified by a user. Here's a quote from http://www.google.com/recaptcha/learnmore http://www.google.com/recaptcha/learnmore """But if a computer can't read such a CAPTCHA, how does the system know the correct answer to the puzzle? Here's how: Each new word that cannot be read correctly by OCR is given to a user in conjunction with another word for which the answer is already known. The user is then asked to read both words. If they solve the one for which the answer is known, the system assumes their answer is correct for the new one. The system then gives the new image to a number of other people to determine, with higher confidence, whether the original answer was correct."""
bengtan 16y ago
If you can afford to require registration for comments, then using the blacklist at www.stopforumspam.com works quite well. I've cut down my number of spambot-induced accounts by about 90% for a couple of forums I manage.
drdaeman 16y ago
Does anyone have any experience with HashCash or alikes? http://en.wikipedia.org/wiki/Hashcash http://en.wikipedia.org/wiki/Hashcash Obvious problem is that in case of directed attacks spammers (or other malicious persons) would use native code or even GPUs to perform computations, while ordinary users would be limited by slower JavaScript implementations. It would help (but not solve the problem completely), though, if someone would show us some non-trivial code, that performs computation in background (without any noticeable impact on page interactivity), that'll finish in some minimal time required to write a meaningful comment or fill out a form.

10 points by DanielRibeiro 16y ago

I'm sorry, I have a hard time with articles that complain but offer no solutions (and the one line at the end about Akismet doesn't really cut it for me.) I've seen some captchas that have you do simple math problems or other basic questions, which seemed to be a better alternative. I also remember seeing prototypes of a captcha that showed nine pictures and told users to select the three that were cats. Not sure why that never caught on, though.

mike-cardwell 16y ago
The trouble is, those sorts of captchas are trivial to bypass. They're good against an automated fly-by attack, but completely pointless against a targetted attacker. Not even a good targetted attacker, just somebody who knows how to write a script which submits a form. I could probably get away with using the cat captcha on my blog, but Facebook or Google wouldn't be able to use it. But the thing is, for a site like my blog, I don't even need to use a cat captcha. I just need to make sure dumb bots can't submit anything, eg using hidden fields: https://secure.grepular.com/Blocking_Comment_Spam_Using_ModSecurity_and_Hidden_Fields https://secure.grepular.com/Blocking_Comment_Spam_Using_ModS... So where do these image captchas have a place? Not on big sites, and not on small sites...
- nollidge 16y ago
  I'm getting a certificate error from your link: secure.grepular.com uses an invalid security certificate. The certificate is not trusted because the issuer certificate is unknown. (Error code: sec_error_unknown_issuer) Edit: On both FF 3.6.6 and IE8 on Win7
  - mike-cardwell 16y ago
    Yep. The certificate is signed by cacert.org and their root doesn't exist isn't in your os/browser combination. I don't really want to turn this into a thread about my SSL setup so I will just say that if you want an explanation, you should read: https://secure.grepular.com/Why_Does_this_Website_Generate_SSL_Warnings https://secure.grepular.com/Why_Does_this_Website_Generate_S... Yes, I realise the irony about the explanation being behind the same certificate.
- Vivtek 16y ago
  The problem with only screening for dumb bots is that it won't screen for the 25-cent-an-hour Ukrainian or African hired to submit spam with a human-driven browser.
  - mike-cardwell 16y ago
    That is a problem with all captchas
StavrosK 16y ago
My thoughts exactly. This post has nothing constructive to offer. The simple truth is that CAPTCHAs are a very good initial defence to spammers. We've been trying to find a problem to replace CAPTCHAs, but we haven't been able to find one that satisfies all these properties: 1. It has to be easy for a computer to create. 2. It has to be easy for a computer to verify. 3. The problem space has to be very large to thwart precalculation attacks. 4. It has to be easy for a human to solve. 5. It has to be hard for a computer to solve. Your math example fails #4, and the cats example fails #3. EDIT: How do we make lists in HN markdown?
9ec4c12949a4f3 16y ago
What I had a really hard time with was this line here: >I suspect that since then captchas have probably gotten a bit better, but spam bots probably have as well. He uses conjecture as if it's good enough to strongly support his stance. He can't even dedicate the effort to do some fact-checking into something relevant to 2011. Meanwhile, I've always been a strong advocate of monitoring user actions and profiling on 'suspicion levels' which is significantly more complex than a captcha, but it gives you a set of eyes on someone at all times and can lock them out for spamming hundreds of emails about Viagra. That being said, we're right back at square one with users getting annoyed if the monitoring/blocking system isn't 'good enough.'

maeon3 16y ago

The next captchas will likely be "choose the animal" from a 2D picture. given the small images across the screen, choose the dogs. The people working to get through security measures will always be there, we might as well put them to good use. Get them to build innovative AI software to bypass security. The code to identify the animal in the picture will eventually find its way into the public and be put to good use.

njharman 16y ago

It's a 2 of 3 problem; We want three things 1) access to stuff 2) that access to be secure 3) no effort/time/delay for access. But in reality you only get two of those. In general things of "value" can't be both secure and fast/easy. If it's fast/easy it can(and will) be brute forced and/or Amazon Turked.

jamesshamenski 16y ago

http://www.nucaptcha.com/ http://www.nucaptcha.com/ Offers a solution in video captchas. Moving letters are way easier to read and if fraudulent activity is detected the videos slow down to a rate which becomes uneconomical to solve.

Vivtek 16y ago

Weird for somebody to complain about visual accessibility and have a site design that's so poorly readable. I mean, OK, I only got 2.5 hours of sleep last night and so I'm more sensitive than normal, but my eyes are still jangling from reading that.

eli 16y ago

I recently tried turning off our CAPTCHA for a few weeks and instead just blocking all comments with links. I was still getting hammered by 10% of junk comments that don't have a link. Many of them were gibberish; my guess is it's a bot cataloging which sites accept comments in the first place. Solving a CAPTCHA sucks for the person submitting the comment, but having a page full of Viagara spam burying any legit comments sucks for everyone. What scares me is the noticeable rise in spam comments being submitted by actual humans apparently in India and China. I set up a ModSecurity rule to block inbound hits coming from a Google search that includes the phrase "post a new comment" but that's only going to work for so long.

nopal 16y ago

>A far more elegant solution is to use some sort of filtering system (like Akismet). Such a system can run behind the scenes and work without complicating the user experience. I disagree. An automated system that calculates the probability that user data is invalid will inevitability report false positives, leading to blocked or deleted content. Try explaining that to a user.

noahc 16y ago

He gets it slightly wrong on how it works. One is not verified by a computer and one verified by a user. Here's a quote from http://www.google.com/recaptcha/learnmore http://www.google.com/recaptcha/learnmore """But if a computer can't read such a CAPTCHA, how does the system know the correct answer to the puzzle? Here's how: Each new word that cannot be read correctly by OCR is given to a user in conjunction with another word for which the answer is already known. The user is then asked to read both words. If they solve the one for which the answer is known, the system assumes their answer is correct for the new one. The system then gives the new image to a number of other people to determine, with higher confidence, whether the original answer was correct."""

bengtan 16y ago

If you can afford to require registration for comments, then using the blacklist at www.stopforumspam.com works quite well. I've cut down my number of spambot-induced accounts by about 90% for a couple of forums I manage.

drdaeman 16y ago

Does anyone have any experience with HashCash or alikes? http://en.wikipedia.org/wiki/Hashcash http://en.wikipedia.org/wiki/Hashcash Obvious problem is that in case of directed attacks spammers (or other malicious persons) would use native code or even GPUs to perform computations, while ordinary users would be limited by slower JavaScript implementations. It would help (but not solve the problem completely), though, if someone would show us some non-trivial code, that performs computation in background (without any noticeable impact on page interactivity), that'll finish in some minimal time required to write a meaningful comment or fill out a form.