14 ms·

Sony's Captcha. View source to see why they don't "get" security

211 points by bluesmoon 15y ago

wccrawford 15y ago
I'm horrified every time I see this.
rossriley 15y ago
That cannot be for real? Anyone know where this is used in context?
bbaugh 15y ago
Does anyone have a link to a page where this is actually used? It seems too ignorant (even for Sony) to contain the actual captcha value within the source.
- Leynos 15y ago
  It's used on this page here: http://pro.sony.com/bbsc/ssr/mkt-security/support.form.bbsccms-support-securityaecompsignup.shtml http://pro.sony.com/bbsc/ssr/mkt-security/support.form.bbscc... Which redirects you to a "down for maintenance" notice.
  - lachenmayer 15y ago
    Very ironic that this is on a site for "Sony Security"...
insraq 15y ago
They only disable right click and selection and they think people will never know?
- watmough 15y ago
  "Browser security. It does nothing!"
timmyd 15y ago
For tl;dr - http://i52.tinypic.com/2hpjg5v.jpg http://i52.tinypic.com/2hpjg5v.jpg ;) Edit: Disable right click ? Surely not .... http://i54.tinypic.com/2mzjcl3.jpg http://i54.tinypic.com/2mzjcl3.jpg
- sek 15y ago
  I was thinking these were individual images what would be stupid enough, but this....
  - romland 15y ago
    Heh. I took the advice, went in and checked source expecting to see the captcha string in a hidden form element. I use NoScript and Sony.com is not on my whitelist (read: I could just select/copy the string). This was worse than I imagined.
- cavilling_elite 15y ago
  Someone must have caught wind. No need for right click with Firebug. :)
sek 15y ago
I hope Sony is building a centralized IT division after the PSN outage and all these embarrassing websites will be gone soon. If they don't then their CEO should be fired for ignorance. I would be interested in the internal structure that leads to these incredible unprofessional results, there has to be something fundamentally wrong. I make a guess, because when you think about it, this whole thing is generated with css and html. It is so funny that with all these horizontal lines it looks like a real Captcha but it isn't. This was just built to satisfy some manager who didn't accept/know that their team isn't trained in image generation techniques. There was some deadline who needed to be satisfied and they were forced to do this.
- sesqu 15y ago
  I seem to recall a comment somewhere from a Sony employee about how they already have one, it's just that many websites are built by the individual product teams (often marketing).
deleted 15y ago
[deleted]
singular 15y ago
Right click works in chrome 12.0.742.122 / os x and when you right click on letter x it comes up with an option "Search Google for 'x'"...
slyall 15y ago
The point of the Captcha is to block fraud and bots. If it is good enough to do this then who cares how it is implemented. Obviously it is useless against a bot written to spam the specific sites this is on but I assume it will stop a generic bot (eg forum spamming one).
- emilsedgh 15y ago
  "Come on, thats good enough" is probably the root of most security issues ;) "Sorry. Security is not optional". -- A kde developer whom I cant remember Edit: added the quote.
  - geon 15y ago
    Spam prevention is not a matter of security. It is completely orthogonal.
- piaskal 15y ago
  If it's supposed to stop bots why did they make it harder to read for humans than bots?
greg_gti 15y ago
That's the funniest thing i've seen all week
emilsedgh 15y ago
Why are they disabling right click? I mean, captcha is there to stop bots. Bots have no 'right click'. My guess is that the programmer didnt really know the reason for using a captcha. He has seen captcha's in other places (and how irritating they are) and has tried to copy them. Or am I missing a certain point?
- palish 15y ago
  I was about to complain that Chrome wasn't popping up the context menu on right-click. So the .js file is disabling right click? How exactly do I look at the source without it? Hmm. Aha: "Wrench icon" -> Tools -> View Source
  - gregschlom 15y ago
    Or Ctrl+U :)
    - InclinedPlane 15y ago
      Or wget (url)
      - RyanKearney 15y ago
        Or curl (url) Or telnet to port 80 Are we really going to list every possible method?
        InclinedPlane 15y ago
        Well no, the point is that there are many, it's trivial to get the source of a web page. "Disabling" the context menu on a web page is nothing more than a giant billboard shouting to the world that you are childish, ignorant, and unsophisticated.
rimantas 15y ago
No, submitters don't get neither security nor what captcha is for. codinghorror.com (iirc) was using "captcha" which never changed, you just had to enter "orange". Or was it tbray.org? Anyway, Atwood claims, that naive approach was 99.9% effective: http://www.codinghorror.com/blog/2006/10/captcha-effectiveness.html http://www.codinghorror.com/blog/2006/10/captcha-effectivene... My position is that ANY form of captcha which requires some action by visitor is broken by design and should not be used at all. Simple captcha like this will stop most of the automattic not targeted attacs. And if someone decides to write CAPTHCA breaker specifically for this site, nothing can help—then you either degrade to the level than even humans cannot say what characters are on the screen or it is cheeper to hire Mechanical Turk to do the job.
- endgame 15y ago
  "orange" was codinghorror's.
- seanalltogether 15y ago
  My blog simply fills in a hidden value using javascript when you press the submit button, it has stopped 99% of all spam for me. You're right, captchas aren't supposed to be difficult, they're just supposed to prevent automation.
  - hdkvdnvxwgj 15y ago
    ...as well as anyone using NoScript, who get to spend all that time writing a comment only for it to be thrown out because of an invisible field Your "clever" system may keep bots away, but it also annoys the absolute shit out of legitimate users. Fail.
  - hdkvdnvxwgj 15y ago
    (And on a related note, this comment form is damn near unusable on Android in portrait mode. I had to make this a separate comment because the box wouldn't scroll to show what I was typing...)
  - InclinedPlane 15y ago
extension 15y ago
Or just cut and paste: D F T L F And they use a goofy font that is hard for humans to read but would be trivial for a machine to recognize, if it actually had to. Too funny.
wccrawford 15y ago
Just for fun, I decided to see how hard it would be to solve this catpcha with jQuery. It's worse than I thought. answer = $("#captchdiv span b").text(); ... OMG.
- AltIvan 15y ago
  you dont even need jquery: document.getElementsByTagName("tbody")[1].innerText.replace(/\s/gi,"")
deleted 15y ago
[deleted]
biot 15y ago
Previous discussion: http://news.ycombinator.com/item?id=2755716 http://news.ycombinator.com/item?id=2755716
xentronium 15y ago
On the bright side, users with terminal browsers, like Lynx, can enter the captcha text :)
canadaduane 15y ago
I wonder if this is the result of divvying up the work and outsourcing to various groups? i.e. no individual group knows what is going on, they just have certain objectives they must do in order to get paid. Such as, "Create a web page with 5 random letters that a person needs to type in order to get to the next page..." Perhaps "CAPTCHA" wasn't even in the design description?
- JoeCortopassi 15y ago
  No reason for this to be downvoted
clord 15y ago
This is an excellent example of cargo cult thinking. If we build the airports and control towers that look right, the cargo will flow!
alz 15y ago
wow... that is really bad
reve 15y ago
They just don't get the right people to do this kind of things, I used to work for Japanese company, for me it's seems like they don't consider skilled IT worker is important.
senthilnayagam 15y ago
IBM Software Development Platform, what development tool they use?
NSMeta 15y ago
It's funny because this captcha probably required more work (disable right clicks, render tables, etc.) in contrast to a proper one, i.e. assuming they were allowed to use an image generation library.
rch 15y ago
How about a version that asks users to enter highlighted text out of a short paragraph? The portion of text that would be perceived as highlighted would be subjective enough to avoid non-specific, casual attacks, but wouldn't sacrifice readability or ctrl-c-ctrl-v. e.g. red adjacent magenta vs. magenta adjacent blue
cfontes 15y ago
Yeah Lame... now I get why that guy alone could hack the PS3 unhackable lock.
dlikhten 15y ago
Heres the problem with sony's captcha. If you are dealing with a small site that nobody gives a shit about, asking users to answer "what is one plus two" and ALWAYS accept an answer of 3 is enough. If you are sony, you need better because there are many visitors and thus its an issue. I implemented a honeypot/time analysis/js assembly tool in a few hrs, im sure sony engineers can do better in a day. But I guess not since sony is not exactly known for its good web developers.
gpambrozio 15y ago
It even has comments on the code so we don't have to really think about where the catcha is..... I've seen some stupid security in some bank's websites I had to analyze for my job but this it incredible...
vhackish 15y ago
I like the 13.2pt font - 12 or 16 would just be too obvious. But 13.2? Now that is security!
btraut 15y ago
So this is why PSN was hacked? Were the user passwords also served to users in plain-text and evaluated in Javascript?
prasunsen 15y ago
I use captchas that set a hidden field value through javascript (the user does not enter anything). It takes a second to view source and figure out what should you enter. Despites this, the captcha works 100% and spam stops. Unless spammers target your own site manually, such a solution is good enough.
alimoeeny 15y ago
Unbelievable!
d0ne 15y ago
All CAPTCHA's are nothing more than a cat and mouse game where the mice are /always/ faster than the cats. The point CAPTCHA developers always seems to miss is that you must render the visual to the screen, or the audio to the speakers, so that the end user can process the information and pass the test. These tests, by design, are finite in the case of human generation or algorithmic in the case of random text / pictures. No matter the case, automation developers have more available options to pass the tests than the CAPTCHA developers have to generate. Why? Because an automation developer who deems an applications data valuable enough to acquire will not rely on technology alone to solve the problem. If they are unable to develop an efficient and reliable technology to pass the test for the intended application they will employ a semi-automated approach that involves real live humans. If the automation developer outsources this semi-automated component there exist services who employ hundreds of individuals per shift to do nothing but solve CAPTCHA challenges through an API with the automation developer's system. These services cost less than $2 per 1,000 /solved/ CAPTCHAs. If the automation developer is of any stature they will have their own facility and the price comes down to $1.50 or less per 1,000 /solved/ CAPTCHAs. The feedback loop for CAPTCHA developer is plain broken. The security mechanism is designed to validate that the request is from a real human and the automation developer, when presented with a technical challenge not worth technically innovating around, will just employ low cost real humans.
- meow 15y ago
  Though the semi-automated systems using humans can break CAPTCHAs, there are still scenarios where using it makes sense. For example, to prevent DoS attacks, a CAPTCHA might be employed to route visitors from one part of the site to another. Even if humans are involved in this loop, the delay introduced in solving the CAPTCHA can slow down the attack.
  - d0ne 15y ago
    In certain circumstances CAPTCHAs can be effective for preventing DoS attacks. I will concede this point. However, I will stand by my opinion that the majority of CAPTCHA implementations, no matter how sophisticated, are generally ineffective at preventing what they were implemented to prevent.
pueblo 15y ago
You bunch of elitists! Sony is looking out for lynx users! Haha
rbanffy 15y ago
I once encountered a <img src="captcha.cgi?v=ABCDEF"> I laughed a lot.
bugsy 15y ago
This is not really a security issue, it's an anti-spam issue.
LiroXIV 15y ago
The fact that it uses Comic Sans doesn't help matters either.
draftable 15y ago
Didn't someone already share this like 2 weeks ago?
VonGuard 15y ago
Pure fucking gold: <td width="34" align="center" valign="top"> P</td> <td width="34" align="center" valign="bottom"> U</td> <td width="34" align="center" valign="top"> W</td> <td width="34" align="center" valign="bottom"> W</td> <td width="34" align="center"> Q</td>
- deleted 15y ago
 [deleted]

211 points by bluesmoon 15y ago

wccrawford 15y ago

I'm horrified every time I see this.

rossriley 15y ago

That cannot be for real? Anyone know where this is used in context?

bbaugh 15y ago

Does anyone have a link to a page where this is actually used? It seems too ignorant (even for Sony) to contain the actual captcha value within the source.

Leynos 15y ago
It's used on this page here: http://pro.sony.com/bbsc/ssr/mkt-security/support.form.bbsccms-support-securityaecompsignup.shtml http://pro.sony.com/bbsc/ssr/mkt-security/support.form.bbscc... Which redirects you to a "down for maintenance" notice.
- lachenmayer 15y ago
  Very ironic that this is on a site for "Sony Security"...

insraq 15y ago

They only disable right click and selection and they think people will never know?

watmough 15y ago
"Browser security. It does nothing!"

timmyd 15y ago

For tl;dr - http://i52.tinypic.com/2hpjg5v.jpg http://i52.tinypic.com/2hpjg5v.jpg ;) Edit: Disable right click ? Surely not .... http://i54.tinypic.com/2mzjcl3.jpg http://i54.tinypic.com/2mzjcl3.jpg

sek 15y ago
I was thinking these were individual images what would be stupid enough, but this....
- romland 15y ago
  Heh. I took the advice, went in and checked source expecting to see the captcha string in a hidden form element. I use NoScript and Sony.com is not on my whitelist (read: I could just select/copy the string). This was worse than I imagined.
cavilling_elite 15y ago
Someone must have caught wind. No need for right click with Firebug. :)

sek 15y ago

I hope Sony is building a centralized IT division after the PSN outage and all these embarrassing websites will be gone soon. If they don't then their CEO should be fired for ignorance. I would be interested in the internal structure that leads to these incredible unprofessional results, there has to be something fundamentally wrong. I make a guess, because when you think about it, this whole thing is generated with css and html. It is so funny that with all these horizontal lines it looks like a real Captcha but it isn't. This was just built to satisfy some manager who didn't accept/know that their team isn't trained in image generation techniques. There was some deadline who needed to be satisfied and they were forced to do this.

sesqu 15y ago
I seem to recall a comment somewhere from a Sony employee about how they already have one, it's just that many websites are built by the individual product teams (often marketing).

deleted 15y ago

[deleted]

singular 15y ago

Right click works in chrome 12.0.742.122 / os x and when you right click on letter x it comes up with an option "Search Google for 'x'"...

slyall 15y ago

The point of the Captcha is to block fraud and bots. If it is good enough to do this then who cares how it is implemented. Obviously it is useless against a bot written to spam the specific sites this is on but I assume it will stop a generic bot (eg forum spamming one).

emilsedgh 15y ago
"Come on, thats good enough" is probably the root of most security issues ;) "Sorry. Security is not optional". -- A kde developer whom I cant remember Edit: added the quote.
- geon 15y ago
  Spam prevention is not a matter of security. It is completely orthogonal.
piaskal 15y ago
If it's supposed to stop bots why did they make it harder to read for humans than bots?

greg_gti 15y ago

That's the funniest thing i've seen all week

emilsedgh 15y ago

Why are they disabling right click? I mean, captcha is there to stop bots. Bots have no 'right click'. My guess is that the programmer didnt really know the reason for using a captcha. He has seen captcha's in other places (and how irritating they are) and has tried to copy them. Or am I missing a certain point?

palish 15y ago
I was about to complain that Chrome wasn't popping up the context menu on right-click. So the .js file is disabling right click? How exactly do I look at the source without it? Hmm. Aha: "Wrench icon" -> Tools -> View Source
- gregschlom 15y ago
  Or Ctrl+U :)
  - InclinedPlane 15y ago
    Or wget (url)
    - RyanKearney 15y ago
      Or curl (url) Or telnet to port 80 Are we really going to list every possible method?
      - InclinedPlane 15y ago
        Well no, the point is that there are many, it's trivial to get the source of a web page. "Disabling" the context menu on a web page is nothing more than a giant billboard shouting to the world that you are childish, ignorant, and unsophisticated.

rimantas 15y ago

No, submitters don't get neither security nor what captcha is for. codinghorror.com (iirc) was using "captcha" which never changed, you just had to enter "orange". Or was it tbray.org? Anyway, Atwood claims, that naive approach was 99.9% effective: http://www.codinghorror.com/blog/2006/10/captcha-effectiveness.html http://www.codinghorror.com/blog/2006/10/captcha-effectivene... My position is that ANY form of captcha which requires some action by visitor is broken by design and should not be used at all. Simple captcha like this will stop most of the automattic not targeted attacs. And if someone decides to write CAPTHCA breaker specifically for this site, nothing can help—then you either degrade to the level than even humans cannot say what characters are on the screen or it is cheeper to hire Mechanical Turk to do the job.

endgame 15y ago
"orange" was codinghorror's.
seanalltogether 15y ago
My blog simply fills in a hidden value using javascript when you press the submit button, it has stopped 99% of all spam for me. You're right, captchas aren't supposed to be difficult, they're just supposed to prevent automation.
- hdkvdnvxwgj 15y ago
  ...as well as anyone using NoScript, who get to spend all that time writing a comment only for it to be thrown out because of an invisible field Your "clever" system may keep bots away, but it also annoys the absolute shit out of legitimate users. Fail.
- hdkvdnvxwgj 15y ago
  (And on a related note, this comment form is damn near unusable on Android in portrait mode. I had to make this a separate comment because the box wouldn't scroll to show what I was typing...)
- InclinedPlane 15y ago

extension 15y ago

Or just cut and paste: D F T L F And they use a goofy font that is hard for humans to read but would be trivial for a machine to recognize, if it actually had to. Too funny.

wccrawford 15y ago

Just for fun, I decided to see how hard it would be to solve this catpcha with jQuery. It's worse than I thought. answer = $("#captchdiv span b").text(); ... OMG.

AltIvan 15y ago
you dont even need jquery: document.getElementsByTagName("tbody")[1].innerText.replace(/\s/gi,"")

deleted 15y ago

[deleted]

biot 15y ago

Previous discussion: http://news.ycombinator.com/item?id=2755716 http://news.ycombinator.com/item?id=2755716

xentronium 15y ago

On the bright side, users with terminal browsers, like Lynx, can enter the captcha text :)

canadaduane 15y ago

I wonder if this is the result of divvying up the work and outsourcing to various groups? i.e. no individual group knows what is going on, they just have certain objectives they must do in order to get paid. Such as, "Create a web page with 5 random letters that a person needs to type in order to get to the next page..." Perhaps "CAPTCHA" wasn't even in the design description?

JoeCortopassi 15y ago
No reason for this to be downvoted

clord 15y ago

This is an excellent example of cargo cult thinking. If we build the airports and control towers that look right, the cargo will flow!

alz 15y ago

wow... that is really bad

reve 15y ago

They just don't get the right people to do this kind of things, I used to work for Japanese company, for me it's seems like they don't consider skilled IT worker is important.

senthilnayagam 15y ago

IBM Software Development Platform, what development tool they use?

NSMeta 15y ago

It's funny because this captcha probably required more work (disable right clicks, render tables, etc.) in contrast to a proper one, i.e. assuming they were allowed to use an image generation library.

rch 15y ago

How about a version that asks users to enter highlighted text out of a short paragraph? The portion of text that would be perceived as highlighted would be subjective enough to avoid non-specific, casual attacks, but wouldn't sacrifice readability or ctrl-c-ctrl-v. e.g. red adjacent magenta vs. magenta adjacent blue

cfontes 15y ago

Yeah Lame... now I get why that guy alone could hack the PS3 unhackable lock.

dlikhten 15y ago

Heres the problem with sony's captcha. If you are dealing with a small site that nobody gives a shit about, asking users to answer "what is one plus two" and ALWAYS accept an answer of 3 is enough. If you are sony, you need better because there are many visitors and thus its an issue. I implemented a honeypot/time analysis/js assembly tool in a few hrs, im sure sony engineers can do better in a day. But I guess not since sony is not exactly known for its good web developers.

gpambrozio 15y ago

It even has comments on the code so we don't have to really think about where the catcha is..... I've seen some stupid security in some bank's websites I had to analyze for my job but this it incredible...

vhackish 15y ago

I like the 13.2pt font - 12 or 16 would just be too obvious. But 13.2? Now that is security!

btraut 15y ago

So this is why PSN was hacked? Were the user passwords also served to users in plain-text and evaluated in Javascript?

prasunsen 15y ago

I use captchas that set a hidden field value through javascript (the user does not enter anything). It takes a second to view source and figure out what should you enter. Despites this, the captcha works 100% and spam stops. Unless spammers target your own site manually, such a solution is good enough.

alimoeeny 15y ago

Unbelievable!

d0ne 15y ago

All CAPTCHA's are nothing more than a cat and mouse game where the mice are /always/ faster than the cats. The point CAPTCHA developers always seems to miss is that you must render the visual to the screen, or the audio to the speakers, so that the end user can process the information and pass the test. These tests, by design, are finite in the case of human generation or algorithmic in the case of random text / pictures. No matter the case, automation developers have more available options to pass the tests than the CAPTCHA developers have to generate. Why? Because an automation developer who deems an applications data valuable enough to acquire will not rely on technology alone to solve the problem. If they are unable to develop an efficient and reliable technology to pass the test for the intended application they will employ a semi-automated approach that involves real live humans. If the automation developer outsources this semi-automated component there exist services who employ hundreds of individuals per shift to do nothing but solve CAPTCHA challenges through an API with the automation developer's system. These services cost less than $2 per 1,000 /solved/ CAPTCHAs. If the automation developer is of any stature they will have their own facility and the price comes down to $1.50 or less per 1,000 /solved/ CAPTCHAs. The feedback loop for CAPTCHA developer is plain broken. The security mechanism is designed to validate that the request is from a real human and the automation developer, when presented with a technical challenge not worth technically innovating around, will just employ low cost real humans.

meow 15y ago
Though the semi-automated systems using humans can break CAPTCHAs, there are still scenarios where using it makes sense. For example, to prevent DoS attacks, a CAPTCHA might be employed to route visitors from one part of the site to another. Even if humans are involved in this loop, the delay introduced in solving the CAPTCHA can slow down the attack.
- d0ne 15y ago
  In certain circumstances CAPTCHAs can be effective for preventing DoS attacks. I will concede this point. However, I will stand by my opinion that the majority of CAPTCHA implementations, no matter how sophisticated, are generally ineffective at preventing what they were implemented to prevent.

pueblo 15y ago

You bunch of elitists! Sony is looking out for lynx users! Haha

rbanffy 15y ago

I once encountered a <img src="captcha.cgi?v=ABCDEF"> I laughed a lot.

bugsy 15y ago

This is not really a security issue, it's an anti-spam issue.

LiroXIV 15y ago

The fact that it uses Comic Sans doesn't help matters either.

draftable 15y ago

Didn't someone already share this like 2 weeks ago?

VonGuard 15y ago

Pure fucking gold: <td width="34" align="center" valign="top"> P</td> <td width="34" align="center" valign="bottom"> U</td> <td width="34" align="center" valign="top"> W</td> <td width="34" align="center" valign="bottom"> W</td> <td width="34" align="center"> Q</td>

deleted 15y ago
[deleted]