3 ms·

>Wave distortion is the most effective The swirly, almost-melding-into-each-other effect that Google uses in its captchas is very hard to segment and recognize.

>Wave distortion is the most effective The swirly, almost-melding-into-each-other effect that Google uses in its captchas is very hard to segment and recognize. I'd argue that it is nearly as effective at preventing human readers from correctly interpreting the CAPTCHA as well. I am not proud of my success rate on Google's CAPTCHAs. It would seem the better route for CAPTCHA makers would be to figure out what makes recaptcha work so well, without having to resort to such levels of swirly distortion.

showerst 15y ago
I wonder if there's enough demand for someone to start a service that provides those visual-style captchas "Click the two puppies in this 3x3 grid of kitten pictures", but with a large enough sample size / solid enough presentation to make it useful. Granted, that approach takes up more screen real estate by definition, but is very hard to break, and can be made to look more professional than kitties and puppies.
- cbr 15y ago
  The article claims that a 1% failure rate is considered too high. Random guessing gets you over 1% success on your example. Making it larger helps, but makes it harder too. The bigger problem is: where do you get a giant source of kitten and puppy pictures that the spammers don't also have access to? It needs to be large enough that it's not worth it for the spammers to sit down and manually categorize them. It needs to be difficult to replicate because if you're just taking 10K pictures of each from an image search, the spammers can do that too.
  - jakubw 15y ago
    Well, a few months ago I had my go at a service that would use data from people working on machine learning systems so I guess that part is not a big deal. The bigger problem is people are accustomed to typical 'write down the word' CAPTCHAs and yet, they're fed up with them, so anything different would only be more annoying and hardly more secure. It's also hard to think of a challenge type that would have enough combinations for blind guessing to be ineffective and not be of the text-based type we all know. You'd need dozens of kitten and puppy pictures in one challenge to have a reasonable failure rate and no one will be interested in solving those.
  - Meai 15y ago
    http://research.microsoft.com/en-us/um/redmond/projects/asirra/ http://research.microsoft.com/en-us/um/redmond/projects/asir...
- jerf 15y ago
  In addition to being easier for a human to solve than a computer, a CAPTCHA should also be cheaper for the person creating it than the spammer. It is far, far cheaper for the spammer to classify one picture than it is for you to obtain it, validate it, and classify it. Counterintuitively, with every source picture you add to the system you're actually giving the spammer incrementally more advantage over you. (Trying to mangle the picture on the way out just adds a constant, and you'll start having trouble with humans; is a color-rotated-to-puke-green wave-distorted kitten still "cute"?) We commonly phrase the CAPTCHA requirement as being easier for humans than computers, but if you're really set on designing a system you need to think in terms of costs, not ease, and you really ought to think of them like security algorithms, where we simply stipulate that an attacker is assumed to have everything constant about your system, its algorithm and its data sources, in hand. You need to create a system where you have a huge cost advantage over the spammers even in that case. And not make the mistake of assuming the spammers are dumb or lack resources.

showerst 15y ago

I wonder if there's enough demand for someone to start a service that provides those visual-style captchas "Click the two puppies in this 3x3 grid of kitten pictures", but with a large enough sample size / solid enough presentation to make it useful. Granted, that approach takes up more screen real estate by definition, but is very hard to break, and can be made to look more professional than kitties and puppies.

cbr 15y ago
The article claims that a 1% failure rate is considered too high. Random guessing gets you over 1% success on your example. Making it larger helps, but makes it harder too. The bigger problem is: where do you get a giant source of kitten and puppy pictures that the spammers don't also have access to? It needs to be large enough that it's not worth it for the spammers to sit down and manually categorize them. It needs to be difficult to replicate because if you're just taking 10K pictures of each from an image search, the spammers can do that too.
- jakubw 15y ago
  Well, a few months ago I had my go at a service that would use data from people working on machine learning systems so I guess that part is not a big deal. The bigger problem is people are accustomed to typical 'write down the word' CAPTCHAs and yet, they're fed up with them, so anything different would only be more annoying and hardly more secure. It's also hard to think of a challenge type that would have enough combinations for blind guessing to be ineffective and not be of the text-based type we all know. You'd need dozens of kitten and puppy pictures in one challenge to have a reasonable failure rate and no one will be interested in solving those.
- Meai 15y ago
  http://research.microsoft.com/en-us/um/redmond/projects/asirra/ http://research.microsoft.com/en-us/um/redmond/projects/asir...
jerf 15y ago
In addition to being easier for a human to solve than a computer, a CAPTCHA should also be cheaper for the person creating it than the spammer. It is far, far cheaper for the spammer to classify one picture than it is for you to obtain it, validate it, and classify it. Counterintuitively, with every source picture you add to the system you're actually giving the spammer incrementally more advantage over you. (Trying to mangle the picture on the way out just adds a constant, and you'll start having trouble with humans; is a color-rotated-to-puke-green wave-distorted kitten still "cute"?) We commonly phrase the CAPTCHA requirement as being easier for humans than computers, but if you're really set on designing a system you need to think in terms of costs, not ease, and you really ought to think of them like security algorithms, where we simply stipulate that an attacker is assumed to have everything constant about your system, its algorithm and its data sources, in hand. You need to create a system where you have a huge cost advantage over the spammers even in that case. And not make the mistake of assuming the spammers are dumb or lack resources.