3 ms·

All CAPTCHA's are nothing more than a cat and mouse game where the mice are /always/ faster than the cats. The point CAPTCHA developers always seems to miss is

by d0ne 15y ago

All CAPTCHA's are nothing more than a cat and mouse game where the mice are /always/ faster than the cats. The point CAPTCHA developers always seems to miss is that you must render the visual to the screen, or the audio to the speakers, so that the end user can process the information and pass the test. These tests, by design, are finite in the case of human generation or algorithmic in the case of random text / pictures. No matter the case, automation developers have more available options to pass the tests than the CAPTCHA developers have to generate. Why? Because an automation developer who deems an applications data valuable enough to acquire will not rely on technology alone to solve the problem. If they are unable to develop an efficient and reliable technology to pass the test for the intended application they will employ a semi-automated approach that involves real live humans. If the automation developer outsources this semi-automated component there exist services who employ hundreds of individuals per shift to do nothing but solve CAPTCHA challenges through an API with the automation developer's system. These services cost less than $2 per 1,000 /solved/ CAPTCHAs. If the automation developer is of any stature they will have their own facility and the price comes down to $1.50 or less per 1,000 /solved/ CAPTCHAs. The feedback loop for CAPTCHA developer is plain broken. The security mechanism is designed to validate that the request is from a real human and the automation developer, when presented with a technical challenge not worth technically innovating around, will just employ low cost real humans.

meow 15y ago
Though the semi-automated systems using humans can break CAPTCHAs, there are still scenarios where using it makes sense. For example, to prevent DoS attacks, a CAPTCHA might be employed to route visitors from one part of the site to another. Even if humans are involved in this loop, the delay introduced in solving the CAPTCHA can slow down the attack.
- d0ne 15y ago
  In certain circumstances CAPTCHAs can be effective for preventing DoS attacks. I will concede this point. However, I will stand by my opinion that the majority of CAPTCHA implementations, no matter how sophisticated, are generally ineffective at preventing what they were implemented to prevent.
reso 15y ago
Human labour is thousands of times slower and thousands of times more expensive (even at $2.00 per 1000) than automated solving. The fact that spammers have been forced to use such inefficient solution techniques is proof of the captcha technique's efficacy. Consider if these captcha's were not in place. By the above logic, there would be thousands of times more spam on sites like Google and Facebook.
- d0ne 15y ago
  While I agree that human labor is thousands of times slower and thousands of times more expensive than an all computational solution that is not the point most of the time for automated systems. In the case of messages and wall post on Google or Facebook, once a CAPTCHA is solved you get to send N messages before the next one is popped up. Without the CAPTCHA you could only go so fast anyway due to general rate limits so the impact on spam, for either service, is minimal. In the case of account creation in general the limit for automated systems is more heavily dependent on diversified proxy access more than anything else. Additionally, you can only effectively manage so many accounts at one time depending on your needs and CAPTCHA do not add more than a few % time delay to the overall account creation process.

by d0ne 15y ago

meow 15y ago

Though the semi-automated systems using humans can break CAPTCHAs, there are still scenarios where using it makes sense. For example, to prevent DoS attacks, a CAPTCHA might be employed to route visitors from one part of the site to another. Even if humans are involved in this loop, the delay introduced in solving the CAPTCHA can slow down the attack.

d0ne 15y ago
In certain circumstances CAPTCHAs can be effective for preventing DoS attacks. I will concede this point. However, I will stand by my opinion that the majority of CAPTCHA implementations, no matter how sophisticated, are generally ineffective at preventing what they were implemented to prevent.

reso 15y ago

Human labour is thousands of times slower and thousands of times more expensive (even at $2.00 per 1000) than automated solving. The fact that spammers have been forced to use such inefficient solution techniques is proof of the captcha technique's efficacy. Consider if these captcha's were not in place. By the above logic, there would be thousands of times more spam on sites like Google and Facebook.

d0ne 15y ago
While I agree that human labor is thousands of times slower and thousands of times more expensive than an all computational solution that is not the point most of the time for automated systems. In the case of messages and wall post on Google or Facebook, once a CAPTCHA is solved you get to send N messages before the next one is popped up. Without the CAPTCHA you could only go so fast anyway due to general rate limits so the impact on spam, for either service, is minimal. In the case of account creation in general the limit for automated systems is more heavily dependent on diversified proxy access more than anything else. Additionally, you can only effectively manage so many accounts at one time depending on your needs and CAPTCHA do not add more than a few % time delay to the overall account creation process.