3 ms·

I'm sorry, I have a hard time with articles that complain but offer no solutions (and the one line at the end about Akismet doesn't really cut it for me.) I've

by gchucky 16y ago

I'm sorry, I have a hard time with articles that complain but offer no solutions (and the one line at the end about Akismet doesn't really cut it for me.) I've seen some captchas that have you do simple math problems or other basic questions, which seemed to be a better alternative. I also remember seeing prototypes of a captcha that showed nine pictures and told users to select the three that were cats. Not sure why that never caught on, though.

mike-cardwell 16y ago
The trouble is, those sorts of captchas are trivial to bypass. They're good against an automated fly-by attack, but completely pointless against a targetted attacker. Not even a good targetted attacker, just somebody who knows how to write a script which submits a form. I could probably get away with using the cat captcha on my blog, but Facebook or Google wouldn't be able to use it. But the thing is, for a site like my blog, I don't even need to use a cat captcha. I just need to make sure dumb bots can't submit anything, eg using hidden fields: https://secure.grepular.com/Blocking_Comment_Spam_Using_ModSecurity_and_Hidden_Fields https://secure.grepular.com/Blocking_Comment_Spam_Using_ModS... So where do these image captchas have a place? Not on big sites, and not on small sites...
- nollidge 16y ago
  I'm getting a certificate error from your link: secure.grepular.com uses an invalid security certificate. The certificate is not trusted because the issuer certificate is unknown. (Error code: sec_error_unknown_issuer) Edit: On both FF 3.6.6 and IE8 on Win7
  - mike-cardwell 16y ago
    Yep. The certificate is signed by cacert.org and their root doesn't exist isn't in your os/browser combination. I don't really want to turn this into a thread about my SSL setup so I will just say that if you want an explanation, you should read: https://secure.grepular.com/Why_Does_this_Website_Generate_SSL_Warnings https://secure.grepular.com/Why_Does_this_Website_Generate_S... Yes, I realise the irony about the explanation being behind the same certificate.
- Vivtek 16y ago
  The problem with only screening for dumb bots is that it won't screen for the 25-cent-an-hour Ukrainian or African hired to submit spam with a human-driven browser.
  - mike-cardwell 16y ago
    That is a problem with all captchas
StavrosK 16y ago
My thoughts exactly. This post has nothing constructive to offer. The simple truth is that CAPTCHAs are a very good initial defence to spammers. We've been trying to find a problem to replace CAPTCHAs, but we haven't been able to find one that satisfies all these properties: 1. It has to be easy for a computer to create. 2. It has to be easy for a computer to verify. 3. The problem space has to be very large to thwart precalculation attacks. 4. It has to be easy for a human to solve. 5. It has to be hard for a computer to solve. Your math example fails #4, and the cats example fails #3. EDIT: How do we make lists in HN markdown?
9ec4c12949a4f3 16y ago
What I had a really hard time with was this line here: >I suspect that since then captchas have probably gotten a bit better, but spam bots probably have as well. He uses conjecture as if it's good enough to strongly support his stance. He can't even dedicate the effort to do some fact-checking into something relevant to 2011. Meanwhile, I've always been a strong advocate of monitoring user actions and profiling on 'suspicion levels' which is significantly more complex than a captcha, but it gives you a set of eyes on someone at all times and can lock them out for spamming hundreds of emails about Viagra. That being said, we're right back at square one with users getting annoyed if the monitoring/blocking system isn't 'good enough.'

by gchucky 16y ago

mike-cardwell 16y ago

The trouble is, those sorts of captchas are trivial to bypass. They're good against an automated fly-by attack, but completely pointless against a targetted attacker. Not even a good targetted attacker, just somebody who knows how to write a script which submits a form. I could probably get away with using the cat captcha on my blog, but Facebook or Google wouldn't be able to use it. But the thing is, for a site like my blog, I don't even need to use a cat captcha. I just need to make sure dumb bots can't submit anything, eg using hidden fields: https://secure.grepular.com/Blocking_Comment_Spam_Using_ModSecurity_and_Hidden_Fields https://secure.grepular.com/Blocking_Comment_Spam_Using_ModS... So where do these image captchas have a place? Not on big sites, and not on small sites...

nollidge 16y ago
I'm getting a certificate error from your link: secure.grepular.com uses an invalid security certificate. The certificate is not trusted because the issuer certificate is unknown. (Error code: sec_error_unknown_issuer) Edit: On both FF 3.6.6 and IE8 on Win7
- mike-cardwell 16y ago
  Yep. The certificate is signed by cacert.org and their root doesn't exist isn't in your os/browser combination. I don't really want to turn this into a thread about my SSL setup so I will just say that if you want an explanation, you should read: https://secure.grepular.com/Why_Does_this_Website_Generate_SSL_Warnings https://secure.grepular.com/Why_Does_this_Website_Generate_S... Yes, I realise the irony about the explanation being behind the same certificate.
Vivtek 16y ago
The problem with only screening for dumb bots is that it won't screen for the 25-cent-an-hour Ukrainian or African hired to submit spam with a human-driven browser.
- mike-cardwell 16y ago
  That is a problem with all captchas

StavrosK 16y ago

My thoughts exactly. This post has nothing constructive to offer. The simple truth is that CAPTCHAs are a very good initial defence to spammers. We've been trying to find a problem to replace CAPTCHAs, but we haven't been able to find one that satisfies all these properties: 1. It has to be easy for a computer to create. 2. It has to be easy for a computer to verify. 3. The problem space has to be very large to thwart precalculation attacks. 4. It has to be easy for a human to solve. 5. It has to be hard for a computer to solve. Your math example fails #4, and the cats example fails #3. EDIT: How do we make lists in HN markdown?

9ec4c12949a4f3 16y ago

What I had a really hard time with was this line here: >I suspect that since then captchas have probably gotten a bit better, but spam bots probably have as well. He uses conjecture as if it's good enough to strongly support his stance. He can't even dedicate the effort to do some fact-checking into something relevant to 2011. Meanwhile, I've always been a strong advocate of monitoring user actions and profiling on 'suspicion levels' which is significantly more complex than a captcha, but it gives you a set of eyes on someone at all times and can lock them out for spamming hundreds of emails about Viagra. That being said, we're right back at square one with users getting annoyed if the monitoring/blocking system isn't 'good enough.'