3 ms·
The trouble with CAPTCHAs is two-fold: First, that even a small success rate (say, 10%) renders them ineffective to someone with enough bandwidth. Second, and p
by alttag 15y ago
The trouble with CAPTCHAs is two-fold: First, that even a small success rate (say, 10%) renders them ineffective to someone with enough bandwidth. Second, and perhaps more importantly, it doesn't matter how good recognition algorithms get! The easiest way to get around a CAPTCHA is have a secondary system that farms out CAPTCHAs to low-wage workers (Amazon turk?) or as games or as a mild inconvenience in the way hedonic pleasure-seeking (pr0n). If a porn sit and a hacker combine, the hacker can have the CAPTCHAs solved manually by the porn site's users for free. No need to write a fancy recognition algorithm (although the success rates for most public decoders are already sufficiently high).
In short, CAPTCHAs are bothersome because they only deter, not prevent access, and are thus only slightly more effective than a "No trespassing" sign or robots.txt file.
- showerst 15y agoI think that depends on the value of the service that they're blocking. I have a trivially breakable CAPTCHA on my web blog, but it cut automated contact form/reply spam down from dozens per day to zero. They definitely have a place, just not for anything super high value.
- pilom 15y agoI feel in that case, a honeypot field is a better technique. It has approximately the same spam-rejection rate and doesn't hinder your real human users.
- alttag 15y agoBad behavior and Akismet combine to do the same thing (WP). The trouble is, you've made life more difficult for your users. On blogs, non-image "CAPTCHAs" are trivial. (e.g., "Put 42 in this box -->"), so long as your site is low enough traffic that no one cares to write a bot targeting you.