5 ms·
3-D CAPTCHA: A way to fix the broken CAPTCHAs?
- josefresco 18y agoHoly usability nightmare Batman!
- Hexstream 18y agoI'd happily take this over mass obnoxious in-your-face spamming any day.
- jacobbijani 18y agoYou know, a lot of users don't even realize its spam. That's kind of the idea. Some of them seem to enjoy it, even. I'm relieved that the comments on this are mostly against it. I was sort of worried. A captcha is a very delicate balance between not pissing off the good users and keeping the bad users out. And let's not forget what seems to be the most effective method of cracking a captcha, to just proxy it to an actual user who thinks they are verifying themselves for some other site (porn). This doesn't address that at all.
- thwarted 18y agoToday I was told, via spam email subject lines, that Elton John died in a rocket crash and James Brown died of a heart attack. Almost fell for it.
- Hexstream 18y agoAnd I was told I was "caught naked in the shower". How humiliating it would be if everyone learned I take my shower without clothes!
- darjen 18y agoGmail does such a good job at filtering spam that I hardly worry about it anymore.
- Hexstream 18y agoEmail is only one of the many avenues for spam. Try running a search, using Craigslist, reading a popular blog's comment or reading Youtube comments...
- aasarava 18y agoI'm with you on this one. It's way too complicated. We know that Web users have little patience for forms with too many fields, pages that take a second too long to load, text that runs more than a couple sentences, and so on. Try to make them do a complex dance just to get past the bouncer at the door and they're likely to give up and go to a different club.
- jcl 18y agoAgreed... The idea isn't bad, but this particular implementation is. If the challenge of your captcha is parsing 3D images, there's no need to make the label letters a tiny unreadable magenta. In fact, you don't need letters at all -- this is merely an artifact of the "enter text for an image" structure of current captchas. It would be far better to have clickable target squares in the image, and just use JavaScript to ask the user to click on several targets in succession -- which is maybe even easier than text-based captchas. Using JavaScript has the additional advantage that it won't fit as well within existing captcha-forwarding spammer frameworks.
- snorkel 18y agoThe example is awkward but could be simplified as "click on the walking man's left arm", and if there were five images 150x150 side by side and only one image had the walking figure the spambot would have to choose the correct image and the correct 15x15 pixel range in that image, so a 1/500 chance of being right.
- jordyhoyt 18y agoImagine what cracking this will do for the world of image processing! :)
- kimboslice 18y agoHysterical: "A bot attempting to brute force a solution to the above example will need to work its way through (26)(25)(24) = 15,600 possible combinations. Asking for the identification of four unique features gives 358,800 possible combinations while 5 unique features will render 7,893,600 possible combinations"
- zepolen 18y agoWhy?
- deleted 18y ago[deleted]
- jrockway 18y agoThese numbers don't mean much, but it's "hilarious" because you could simply generate every image and compare them to the one on the site in about a second of CPU time. This is actually not a meaningful way to attack current CAPTCHAs, so now that I think about it... this 3D CAPTCHA would probably be less secure than the current ones that rely on OCR.
- sratner 18y agoIt is a meaningful way to attack many of the current captchas, if the alphabet and the space of transformations applied to it is sufficiently small. It is being done right now, in fact.
- zepolen 18y agoThe final image is rendered based on random variables /each time/ - Even just moving the light source would result in an entirely (from a bitmap point of view) different image. So even if you could get your hands on the 3D source file used for rendering, generating all possible images is impossible. The numbers don't refer to brute force since the answer changes on each try. If you used the same answer 'ABC' each time you'd take (assuming perfect random distribution) 15,600 tries before getting it right. I don't know about you, but after getting 15 thousand failed requests in a row from the same IP, I'd assume they were a bot ;)
- jrockway 18y agoConsidering we have image recognition algorithms that can control cars driving on the road, I doubt this would be that difficult to break. It would, however, be very difficult for anyone to correctly guess ;)
- sratner 18y agoI have a captcha idea: lets make users watch a 90-minute movie and summarize the plot in 6 words. Oh, and serve ads over it while they are watching, just to recover the bandwidth costs.
- ScottWhigham 18y agorofl - best idea I've heard yet!
- silentbicycle 18y agoOr maybe just four? :) http://www.fwfr.com/ http://www.fwfr.com/
- bprater 18y agoNot sure how this is entirely different that using a library of images that are tagged with common words. Is it a cat? dog? frog? giraffe?
- jcl 18y agoThe 3D captcha generates new images rather than using a library, so a captcha breaker needs to use a more sophisticated approach than comparing the current captcha image to previously seen images. The difficulty of the image library captcha depends on the size of its library, while the difficulty of the 3D captcha depends on the fact that it's much easier for a computer to go from a 3D model to a 2D image rather than the other way around.
- dkasper 18y agoSeems like it definitely violates Krug's "Don't make me think" principle, but if it's the best we've got then I guess it's ok for now.
- adnam 18y ago> Object recognition is a completely unsolved computer vision problem. Awesome, let's hand the problem over to the spammers and it will be solved within 1 year.
- silentbicycle 18y agoEither way, we win!
- lbrandy 18y ago> > Object recognition is a completely unsolved computer vision problem. It's funny you quoted that part. I can't tell you how many "next-gen" captchas I've broken trivially with the object recognition software our company has developed (http://demo.pittpatt.com http://demo.pittpatt.com). Granted, our software is useless against this type of Captcha, but many aren't. Captchas have become a really interesting area of research for us because it's essentially the opposite problem that we are trying to solve. What's really curious about this is object recognition people seem keenly aware of the advancements in Captcha design and Captcha designers seem blissfully ignorant of the advances in object recognition. I've seen so many proposed "next-gen" captchas that I could break before I finished reading their powerpoint slides.
- boredguy8 18y agohttp://img.timeinc.net/time/time100/2007/images/time100landingimage.jpg http://img.timeinc.net/time/time100/2007/images/time100landi... - misses Obama. (It's good software, was just funny to me.)
- axod 18y agoStill fails to address the proxying of captcha's off to be solved by unsuspecting people. * setup porn/warez site * proxy captcha's from the target site to the porn/warez site * let real users solve the captchas for you.
- dominik 18y agoI harbor a strong distaste for CAPTCHAs. At best, they're annoying. At worst, they're infuriating, such as when I simply can't see the letters or when I stumble into a cross-site hosted CAPTCHA that requires JavaScript -- which I have disabled -- and then loses the post I was going to make when I press the back button to try again with JavaScript enabled. I see CAPTCHA as a bandaid and I can understand why people turn to it: spam has reached epidemic proportions. That said, any form of CAPTCHA, either the existing form or the proposed 3-D form of this article suffers from two fundamental flaws: 1. It annoys users and makes it harder for people to contribute 2. Spammers will get around it eventually, and once one spammer gets around it, they all will CAPTCHA bears similarities to copy protection schemes in these two flaws: both annoy users and merely are road bumps to the undesirables (spammers and crackers). I think the solution is three fold: 1. Make it easy to post so real humans contribute 2. Filter spam aggressively 3. Incorporate trust mechanisms Making it easy so real humans contribute removes obstacles (such as CAPTCHAs, registration, etc.) that get in the way of people posting. Every obstacle means less people will post. With community contributors at about 1% of visitors, there's a lot of room to grow by making it easier to contribute. Spam filtering works because spam is fundamentally different from a valid post, and always will be. Bayesian schemes such as pg described long ago work well. Gmail, for example, does an amazing job of filtering spam. The few posts that get through are easily dealt with. Trust mechanisms take advantage of the fundamental weakness spammers have: they aren't members of the community. A simple trust mechanism is don't auto-link links from posters with less than 10 comments. Since most spam contains links of some sort and most comments don't, spam will be predominantly affected by this. Once a posters get to 10 posts (or 10 karma), their comments retroactively get auto-linked. This is simple to implement, but reduces the impact of spammers significantly since their spam isn't accessible unless someone goes to the trouble of copy-pasting it, preventing accidental clicks by users. At the same time it doesn't punish new users, since their valid links will still be accessible and will become on equal footing once they grow into the community.