47 ms·
Captchas Are Becoming Ridiculous
- chris_wot 14y agoI guess OCR software must be getting really good now!
- andrewmunsell 14y agoWith increased computing power, we are really able to do some amazing things. Unfortunately this also means that spammers also have access to this increased speed and ability to crack OCR based puzzles. But on the bright side, this also allows us to digitize books without humans more accurately (which is one of the primary purposes of reCAPTCHA)
- ChuckMcM 14y agoThey are ridiculous, but they are so because what they are trying to achieve can no longer be easily achieved by solving the "visual acuity" problem. Think of it as an opportunity to create something better. Personally I think shared secret with physical device has longer legs here but it does have a distribution/cost/re-authentication hump that is large. So far that has prevented its adoption but as you can see captcha systems are becoming non-functional.
- andrewmunsell 14y agoI'd be curious to see the ability for a machine to solve picture based captcha systems. For example, given a lineup of 10 pictures of pets, choose the three that are cats. I've seen them before, just not widely implemented.
- ChuckMcM 14y agoWell Google just talked about their code which identified kittens in Youtube videos. (http://www.nytimes.com/2012/06/26/technology/in-a-big-network-of-computers-evidence-of-machine-learning.html?pagewanted=all http://www.nytimes.com/2012/06/26/technology/in-a-big-networ...)
- andrewmunsell 14y agoThat's actually pretty interesting. With time the number of computers/processors required to do these tasks will go down, but for now and based on that experiment, it almost seems more efficient to use picture based captchas.
- ChuckMcM 14y agoI don't think you 'get it' Andrew :-) The folks who bust captchas, 16,000 machines is chump change, they run botnets of hundreds of thousands of machines, they dynamically buy EC2 instances, they make a lot of money. That is the primary reason why I believe that people who use the term 'computationally unfeasible' (you see that a lot in crypto papers) never counted on the kinds of growth we've seen in computers coupled with the ease with which these folks can steal computer power from clueless users. My claim is that you need an independent engine of computation on your side that can prove you are you with a high degree of confidence, and cannot be corrupted economically by a third party. (so local programs on your PC or Smart phone won't cut it)
- comex 14y agoCryptosystems that require 2^128 tries to crack aren't going to be much easier even if you have a billion machines; you really need a theoretical breakthrough. :) Of course that doesn't apply here.
- Locke1689 14y agoExponential CPU growth rates are factored into cryptographic protocols. As long as growth rates don't become super-exponential they're safe.
- Devilboy 14y agoEven just randomly picking 3 images will be successful about 1% of the time which is more than enough for a bot.
- mturmon 14y agoGood point. 10 choose 3 = 120.
- pizza 14y agoIs there a way to report CAPTCHAs for illegibility?
- andrewmunsell 14y agoI wish, but as far as I know, there isn't. I'd love to know if there was!
- rhizome 14y agoThere's a recycle button that will generate a new one.
- andrewmunsell 14y agoI guess the issue is, does Google know when someone recycles a captcha, and if they do, are they doing anything about it? It's useless if the captcha isn't flagged and is just given to another use.
- ceejayoz 14y agoThis is Google, so I'd imagine they keep tallies.
- yaroslavvb 14y agoThe tricky thing is that there are hordes of automated captcha-breakers that will recycle captchas until they get something that's easy to OCR
- re_todd 14y agoYeah, and a couple days ago I had to hit that button about 20 times before I got one I could decipher. I was about 1 or 2 clicks from giving up.
- lazugod 14y agoIsn't that implied by refreshing?
- snprbob86 14y agoAnd they are becoming less and less effective. Since they are so ubiquitous, users don't think twice about completing them. Therefore, infected users are going around unwittingly solving captchas served to them by their associated bot nets.
- andrewmunsell 14y agoWow, I've never heard of that happening before. That would definitely be an issue... Unfortunately I'm not sure how we would end up solving that issue-- there's always going to be the users that don't realize they are being exploited, to solve captchas or otherwise.
- darkstalker 14y agoI've got several times math symbols written in captchas instead of words.. how I'm supposed to write them?
- sn6uv 14y agoAnything you write for them is accepted. In fact of these captchas you only need to get one word correct (the non-maths one). IIRC the other is scanned from a book somewhere and the computer used to scan it couldn't figure out what word it was.
- cjdentra 14y agoSimply put, we need a better way. Some of these are just unintelligible and require multiple attempts. Someone please come up with a model that makes sense!
- jvrossb 14y agoI had just noticed that captchas were getting worse. I always thought sites should just make the user perform an operation. Display a hard to read but still legible "type the second letter of the third word". 'e' would be the correct response. There's got to be a reason this isn't done already, does someone know why?
- Kilimanjaro 14y agoBots would spam your site once every 26 tries.
- jvrossb 14y agoI was going to say don't most modern sites limit multiple attempts in succession? Then I realized that spammers have thousands of computers at their disposal so the successive attempts would not come from the same IP. Shoot this is a hard problem...
- Devilboy 14y agoSpammers have thousands of machines.
- bbrtyth 14y agoMore than that, since they would guess one of {e,t,o,i,n}.
- psykotic 14y agoParsing and responding to a question like that isn't difficult when the questions are algorithmically generated from a finite number of human-designed types.
- olog-hai 14y agoIt assumes that the user reads English fluently.
- human_error 14y agoOr how about short stories, something like; "Brian came home very late. He couldn't find Mr. Hat. While he was thinking where his cat might be, he noticed the window was wide opened." What's the name of the cat? I don't know if it's hard or easy to guess it algorithmically.
- learc83 14y agoI just thought it was me. There's hardly ever a captcha now, that I can get on the first try. I loathe captchas.
- mmuro 14y agoI'm a big fan of logic captchas. Not only are they way more accessible than image captchas, but the frustration factor is not nearly as high.
- huhtenberg 14y agoDo give an example.
- excuse-me 14y agoWhich would you prefer: a properly formatted data file or a kitten ?
- mmuro 14y agohttp://textcaptcha.com/demo http://textcaptcha.com/demo
- Devilboy 14y agoRandomly returning a word from the question will get my bot in about 3% of the time which is plenty.
- csense 14y agoSeems like it would be fairly easy to parse many of these questions automatically. The only reason they work is probably that they're not widely used enough for spammers to care about.
- sanchitg94 14y agoSame. Very easy to identify human vs. non human.
- lgeek 14y agoWolfram Alpha does solve some of them. It seems easy to detect the type of question and manually implement a way to parse each. Here's an example that I got while trying to register an API account: https://www.wolframalpha.com/input/?i=One+%2B+3+equals+%3F https://www.wolframalpha.com/input/?i=One+%2B+3+equals+%3F
- lkbm 14y agoWith ReCAPTCHA, you only have to get one of the two words right. I've never had it be the illegible word (or my terrible guesses match the "correct" answer), as one might expect given the one you need is necessarily the one for which they have the answer.
- chickenhead 14y agoThe hard part about captcha is making it accessible to users with disabilities.
- festivusr 14y agoThere was an interesting talk that mentioned CAPTCHA by one of its creators, Luis von Ahn, at the AAAI-12 conference on AI and robotics this past week. In ReCAPTCHA, the two-word CAPTCHA version, one of the two words is taken from a scanned book. That (unknown) word was one that failed OCR for that book. The other word is one that captcha already knows the answer to. The assumption is if you get the known captcha correct, then you probably got the other one correct as well (if it was possible to read it). The answer to the unknown word supplements the OCR of the book. The captchas are put in random order, and you only have to get one of them right. Luis's thought was that people are wasting all this time doing captcha - why not use that time to do something useful, like help digitize books. As an aside, he's also one of the principal people behind duolingo, which is a quite awesome language learning / human-assisted translation engine.
- twelvechairs 14y agoYeah. The actual problem as I see it is that people have been trained that you have to get captcha's "right", where with these recaptchas all you really need is a reasonable guess because there is no 'right' (and nowhere does it say that). The assumption behind recaptcha was a novel one, but it seems pretty obvious that the OCR is really just about as good as humans anyway - the 'difficult words' that usually get served are most commonly either non-existant words (printing/writing errors) or scanning/cropping errors.
- nathancahill 14y agoLuis von Ahn is one of the very few tech entrepreneurs from Guatemala. He's killing it.
- streptomycin 14y agoIt's easy to criticize captchas. That's why there are so many articles like this, which we all knowingly nod along to as we read. It's much harder to provide productive criticism that leads to an actual improvement over the status quo. (Although it is easy to suggest bad alternatives to captchas, which is why they appear in every comment thread about captchas on Hacker News, including this one.)
- jdale27 14y agoI don't disagree, but what is your point? That one should never say "X is broken" without inventing a Y that is better than X?
- streptomycin 14y agoIt's fine to say "X is broken", but I doubt you can find anyone on Hacker News who didn't read an article like this years ago and thus already knows X is broken. This article is beating a dead horse. The fact remains, captchas are the worst technique to prevent bots from filling out a form, except for all the other ones.
- seandougall 14y agoYes, though, to be fair, this particular horse does seem to find a way to get deader as the years go on.
- streptomycin 14y agoWhen a horse dies, it doesn't stay in a constant preserved state forever, it slowly decays :)
- rickdale 14y agoRight now I think the best solution is no captcha. HN doesnt use one for the sign up form. Yes, the HN community is flooded, but for the most part I dont think a captcha would change that.
- Kilimanjaro 14y agoFilters are coming to CSS so I guess it will be possible to show an image with hidden numbers (or words) and let the user pick a color filter that applied to the image will show the numbers and submit the color and the number to the server for verification. Like color blindness tests. How about that for a captcha?
- cbr 14y agoWhat about that sounds hard to automate?
- deleted 14y ago[deleted]
- encoderer 14y agoIt's funny that we are advancing the science of OCR and computer vision by funneling grey/blackmarket dollars into the field to break captchas. Makes me wonder what sort of social engineering opportunity this creates. What other fields could be advanced in a similar way.
- neotek 14y agoCAPTCHA seems relatively pointless at stopping spammers since there are dozens of online services that use human labour to solve them for a dollar per thousand. In tests on my own sites I've found that introducing reCAPTCHA during the registration process leads to a significant increase in people abandoning their registration when they fail at recognising the text the first time, without putting a significant dent in spammer registration at all. I've found it far more effective to do things like randomising form field names (instead of using names like 'username' and 'password') so the spammer has to scrape the site to figure out which fields he needs to submit for each and every account he registers, silently dumping registrations that don't use the correct field names, and then applying various heuristics to successful registrations to detect patterns common to spammers. For instance, one particular spammer always seemed to use the same user agent string and didn't ever trigger any of the AJAX calls on the page. It was trivial to detect registrations coming from that one spammer and silently dump new accounts when he created them.
- coderdude 14y agoRandomizing the field names is a great idea but as you said they would just need to scrape the HTML each time they wanted to register. Have you considered sprinkling in random bits of markup to throw off the people using regex and other lazy parsing methods? That might make it a real pain to scrape your forms depending on how the spammer parses your page.
- prophetjohn 14y agoOne way to avoid this issue might be to plop a hidden input box on the page if this input has text in it when it's submitted, you silently drop the registration.
- neotek 14y agoI still have 'username', 'email', and 'password' fields in the form but I hide those elements with CSS, which no scraper is going to bother parsing. When the registration form is submitted the account is essentially hellbanned, they can 'activate' the account via the normal email confirmation process but anything they post disappears into the ether. I'm catching about 100 spam accounts a day with this technique[1] and the ones that I miss are fairly easy to detect through analysis once they start using their account. [1] http://i.imgur.com/kdp7Q.png http://i.imgur.com/kdp7Q.png
- ricardobeat 14y agoIsn't that a result of the massive deployment of reCaptcha? It appears that all the easy words have already been solved with enough confidence, so there's only garbled scans left. Add more books? That said, there are plenty of alternative solutions with good success rates (and far lower abandonment rates), like requiring the answer to a simple question (not math), photo captchas, randomizing inputs, using javascript techniques and honeypot forms. Captchas are so popular because they are easy to implement.
- sesqu 14y agoThat's what I was thinking. Originally reCAPTCHA had the control word be a scan as well, which meant that an attacker had to beat their OCR. Now that the control word is computer generated, the system has devolved into a regular CAPTCHA that further asks humans for recognition task work. This version no longer advances OCR algorithms, but does provide cheap exception handling. I don't know when or why the change was made, but obsolescence is at the top of my mind. Either they've ran out of unrecognized words, or adversaries have beaten their OCR. Either way, it seems we're back to 2005. edit: That said, Luis von Ahn mentioned that Google is experimenting with other image processing tasks, so there's hope yet.
- freditup 14y agoI feel like the author of this article is still slightly misunderstanding the reCaptcha. Not to criticize him, but it's almost immediately clear which word you are actually being tested on, because it's has the same general 'look' to it each time. Take the first one: 'Secretary' is clearly out of some book. The other thing is the real test. Now, reCaptcha never gives you real words as a test, so he shouldn't be surprised that it isn't a real word. The third captcha complained about is actually incredibly easy. The first thing is clearly the word form a book, so you can just type a short bit of nonsense there. The second thing is 'ndaaar'. It's pretty legible and easy to enter. Other 'impossible' ones are pretty easy also. Again, not trying to pick on the author, but hopefully someone will have an easier time after reading this comment. And while Captchas are annoying, I don't really feel they are impossible. Edit: To the commenter below - I have no idea what green names mean here, so I don't know how that influences people. What do they represent?
- dereferenced2 14y agoThe author's blog post is retarded; "herp derp I don't know how recaptcha works and it's too hard for me." He has a pretty blog and a green name on HN, so everyone upvotes it. Pretty sad IMO.
- wcoenen 14y agoGreen names mean the opposite of what you think they mean. It's for accounts which are less than 5 days old.
- georgemcbay 14y agoI feel like you didn't read the article, because the author already addresses what you said and had you read the article you'd realize you made incorrect assumptions that, again, he already addressed.
- freditup 14y agoI disagree: "The capatchas were not only difficult for a computer to read, but impossible for a human." He goes on to quote that computers can guess capatchas at 10%. My point is that if you understand capatchas, you can get them right almost all of the time. (Not talking about the audio ones here, since the visual ones seemed to be the focus of the article.)
- iamgopal 14y agoreCaptchas are very good for small sites which can be easily affected by spamming. Even if hackable, the hacker will need strong reward for hacking such site with captcha. For bigger sites, there are better methods to prevent hacking. and with reCaptcha you are allow to be almost right.
- rorrr 14y agoI see two possible long-term solutions to the captcha problem 1) Ask user to do a relatively expensive computation. This can be done in the background while the user is typing his post. 2) Request a small amount of money (10c) per comment. Good websites will return the money to non-spam commenters, will keep spammer's money. This however requires working microtransactions.
- dchichkov 14y ago1) Asking a computer to do a computation is not such a great idea. Low powered devices (think iPads) running javascript would be at a great disadvantage to highly efficient botnet clusters that spammers own. 2) Requesting a small amount of money may work. Alternatively requesting a user to do some useful task (like Amazon Turk HIT) to get some funds.
- emiliobumachar 14y agoSome computations just cannot be parallelized. (Yet. I'd be ironic if spammers advanced the field of parallel computing) The speed difference for single processors remain, but that's a single order of magnitude, except in extreme cases.
- tripzilch 14y agoBut you can always parallelize the spamming itself.
- anonymoushn 14y agoThe known word is the one that is bent. This is the only word you have to type. You can enter "dogman" or "foo" for the cut-off (scanned) word and it will let you through.
- zhoutong 14y agoI can't seem to understand the "Onightsl secretary" CAPTCHA. We all know that the first word is extremely hard to identify, and according to the author "secretary" wasn't the control word. This means that reCAPTCHA knows the first word. Identified by OCR? Not possible unless reCAPTCHA deliberately distorted the image. Identified by N other people? Not possible to determine such a word with confidence either. Or am I missing something?
- zhoutong 14y agoAlso it seems that there is exactly one distorted word and exactly one "proper" word. I would assume the distorted word is the control word. I should try a few reCAPTCHAs to see if this is a correct assumption. EDIT: Confirmed. The "proper" word is taken directly from book scans and I can type anything to pass the CAPTCHA. It seems that the control word is very Google-style.
- prophetjohn 14y ago> unless reCAPTCHA deliberately distorted the image. Isn't it obvious that this is the case? There is one word in every image that is distorted in the same way and another image that might appear in some other way that Google wants to know what the word is.
- jmilkbal 14y agoThe paranoid, tin foil hat wearing part of me has always put post Google acquisition Recaptcha in the must-be-part-of-the-long-arm-of-Google-tracking category of services encouraging me to do my very best to avoid allowing it to run in my normal browser session.
- bherms 14y agoI do agree they are becoming ridiculous.. I often have a hard time figuring them out. The real question is what the next step will be. Where do we go from here? What experiments are out there for new captchas? And, slightly related, one of my favorite lighthearted sites: http://www.captchacomics.com/ http://www.captchacomics.com/
- joshfraser 14y agoMy personal rant on this topic: http://www.onlineaspect.com/2010/07/02/why-you-should-never-use-a-captcha/ http://www.onlineaspect.com/2010/07/02/why-you-should-never-...
- grandalf 14y agoI find recaptcha so frustrating that I will always abandon the account unless it's something that I really really care about. If I have trouble with recaptcha, I can't imagine a non-programmer over 60 years old having any remote hope of figuring it out. Also, the way it's typically implemented, if you solve the recaptcha once and there is some other server side validation error, you have to fix that and then solve a new recaptcha before proceeding. It is just so punishing I am always at a loss when I encounter it.
- f0untain 14y agoHow about calling the web services in a good old fashioned way to create accounts ? Its slow but very reliable. It can also create jobs.
- borplk 14y agoGiven that any type of human-solvable captcha can be easily outsourced for cheap, I think the next best alternative is some computationally expensive operation per form submission.
- aneudecker 14y agoFor an interesting alternative to traditional captcha check out Solve Media - they monetize your captcha for you by making you input brand messages (that are retained better than just seeing a banner ad). I thought it was an interesting idea when I met the founder Max & team (although I was just slightly skeptical of the level of security provided). They seem great though, so it's worth checking out.
- nacs 14y agoI have tried Solve media's service and its a good idea in theory but execution is poor. Problems with Solve's captchas: * Requires Flash plugin * Contains sound (not critical to solving a captcha but not great when your laptop suddenly plays ad audio in a library) * Payout rates are horrible. You earn a few cents for every couple thousand video captchas solved. Successful solved percentage rates are also poor
- ifix 14y ago"Understandably, I forgot my password" That's not understandable, that's stupid.
- deleted 14y ago[deleted]
- brigade 14y agoOne nice thing about recaptcha is that you know those cut off words don't matter (badly OCR'd) and can just enter gibberish for them. But it has gotten to the point that about half of the control words are unintelligible by a human.
- rotskoff 14y agoSure, but you shouldn't undermine the mission of successfully recording words that can't be identified. It's a pretty noble goal, actually.
- danilocampos 14y agoTheir goal isn't more important than my goal of resetting my password or logging in.
- slowpoke 14y agoI, for one, refuse to be used as the source of free labor by Google just because I want to sign up for a website.
- praxulus 14y agoThat's ridiculous. reCAPTCHA isn't making you do more work, it's just making work you have to do anyway useful. The benefit Google gets from the OCR work is microscopic, and the world gets old books and New York Times articles.
- slowpoke 14y agoSee, I would have much less of a problem with this if Google actually told this to everyone. Instead, they silently use you for free labor. That's dishonest. I'm all in for crowdsourcing if you tell me about it and nicely ask me to participate. Not when I am forced to do it.
- quarterto 14y ago
- anonymous 14y agoHe seems a bit ignorant on how reCaptcha works nowadays. You are presented with two strings - a potential word scanned from a book and a random mash of letters. You only need to enter the random letters correctly, you can write whatever you want for the word from the book. Meaning, if one of the two is obviously a bug in OCR software (or is non-latin characters you can't type), just write your favourite curse word -- I go with captcha -- and it will work. As for the "unreadable mash of letters" problem, I could read them in all his examples. Though I have seen some cases when they are really unintelligible. If you must use reCaptcha on your website, do it like 4chan -- when you mess up the captcha, you are automatically given a new image to try, without being sent away or having to enter what you just typed again. Which just means you'll only limit the rate at which bots register -- the article mentions something like 10% success rate of current-generation bots guessing reCaptcha.
- nacs 14y agoThis is common knowledge for people like you and I (that only one of the two words only counts) but the vast majority of "average" visitors do not know this and will be unable to solve the captcha.
- iaskwhy 14y agoFrom the article: "t’s important to note the way reCAPTCHA works. Each user (or bot) is presented with a control word, and a word unrecognized by OCR. This control word is already known to Google (who runs reCAPTCHA). If you get this first word right, it is assumed that you get the second word correct as well. So, in reality, you only need to guess the key word correctly. I decided to just guess the first word and hope “secretary” was the control. It wasn’t." How is that being ignorant?
- morsch 14y agoIt's ignorant because he then goes on to refresh recaptchas that are "impossible" to solve where the OCR word was gibberish (cut-off, etc.) but the key word was discernible.
- 0x09 14y ago
- dchichkov 14y agoI see a possible solution that may work in a short term: Instead of displaying a static captcha, display a dynamic one, with letters going through elastic transformations. Humans are pretty good with video sequences. Computers are not. As a side effect this may help pushing computer vision algorithms to working with videos, rather than static images :)
- adrianN 14y agoDo OCR on every frame, perform majority voting on the result. You just made the spammer's task easier.
- dchichkov 14y agoHere is an example of a problem that would be hard for computer to solve: http://www.youtube.com/watch?v=4G4y79ZbaBs http://www.youtube.com/watch?v=4G4y79ZbaBs
- Raticide 14y agoYou just diff each frame and keep the parts that don't change much. Very simple to solve.
- dchichkov 14y agoJust move letters slightly. And make them morph a bit. Would still be obvious to a human, but a computer trying to average anything would fail miserably. This is an unsolved computer vision problem.
- muyuu 14y agoHow so? the fixed part can be easily extracted. If it also moved (while morphing) then I guess it would be hard, but fixed dots in a moving background would take just a few frames for a computer to solve.
- odin1415 14y agowhich pixels stay black in all frames?
- dinkumthinkum 14y agoGoogle's captchas actually give me a headache looking at them, there's just too much curliness going on there.
- Shenglong 14y agoI have no expertise in this area, but how about patterns? Since we're already parsing so much text, why not take strings of legible text (with a minor visual distortion), and strip a connecting word such as a preposition? The user is then prompted to enter the connecting word. Synonyms could be matched. For example: "I can't stand all ____ your lies" (of) or: "This is all too ____ for me to handle!" (much) Sure, some strings would be hard to solve, but I feel like I'd be improved over time. Plus, captchas already take a few tries to solve anyway. I suppose it may impose on foreigners though.
- wvs 14y agoFinding dropped words in coherent sentences is trivially easy given a large enough corpus of the language. Just looking at the occurrence probabilities of the surrounding words would be enough for most cases.
- pjscott 14y agoWhat stops captchabots from just brute-forcing it with common words? Or, if they wanted to get fancy, something like a Markov model of English text could really help narrow down the likely missing words.
- monsterix 14y agoTweaking that a bit, I think Captchas really need to change. But not with cut-off of grammar, which can be probabilistically (brute-force) broken. One can instead start asking simple questions presented over an image. For example, "how many blue dots on this pattern?" or "what animal is this?"(with a photo of camel or something). That's certainly going to be more manageable for humans and prevent us from behaving more like bots, and them like us. Of course, until the bots evolve a little more to circumvent this. It is so true that one often meets destiny on the path taken to avoid it. TLDR; Use image based 'A for Apple, B for Boy' aka the 'Kindergarten training' to filter out bots from humans. Ask questions that are human, to figure out humans in other words.
- IvoDankolov 14y agoWell, surprisingly, that would only be as strong as doing OCR to get the words. Why is that? Well, if you deliberately remove words that are easy to put back into the sentence, it's an easy task not because we humans are incredible at "out of the box" thinking, but because one or two word choices are orders of magnitude more likely than all the rest. And when it comes to statistical guessing, computers are very good at that. Get a large enough corpus of the English language, and I can assure you that the probability distribution of the missing word, given that it's preceded by "I can't stand all" and followed by "your lies" is overwhelmingly in favor of "of". Calculating these conditional probabilities is not a very hard task to program at all, though it does require quite some computational power and memory for longer chains.
- nekitamo 14y agoI wrote an OCR for the previous generation of recaptcha (the one that preceded this one) that cracked it with a 92% success rate. The same day I finished the OCR, I watched my 50 year old mom try to input recaptcha for the registration of some website to view family photos. She eventually gave up, and that website lost another potential user. I remember shaking my head at the absurdity of it all. I'm glad I'm not the only one.
- kingsley_20 14y agoHandwritten captchas? I'm sure they can be crowdsourced.
- john_flintstone 14y agoA forum I run in Ireland doesn't have a need for Captchas. The forum is very regional and niche - no genuine foreign visitors - so we blocked every country apart from Ireland and the UK from posting comments. Result - no spam. This wouldn't work for many forums, but if it's local, you really don't need to open it to the world.
- Fando 14y agothat's great
- josscrowcroft 14y agoWow - such a nice and simple approach, bet this would work for many similar small forums..
- icebraining 14y agoSo, if I was an Irish guy travelling (or even an emigrant), I'd be blocked? That seems unfortunate. On my forum I just added a question about Portuguese history. Anyone who understands the languages can find the answer in a couple of minutes, but bots really aren't that clever.
- tripzilch 14y agoSimilarly, if you run the forum on a LAN instead of the Internet, you also don't get any spam! :-/
- aapl 14y agoI frequent a couple of niche forums where the rule is that you have to write an introductory post of at least X sentences (or come up with original witty answers to a list of questions etc.) before you are allowed to post anything else. All introductions are read by admins or volunteers and approved if as long as they seem written by a human. No spammers and very few trolls.
- josscrowcroft 14y agoEvery time I read something like this I pine for never having the opportunity to turn MotionCAPTCHA[0] into a real (secure) system. Everyone said it couldn't be done, but I know it can! [0] http://www.josscrowcroft.com/demos/motioncaptcha/ http://www.josscrowcroft.com/demos/motioncaptcha/
- doc4t 14y agoClever. Not knowing the details of how computers beat CAPTCHAa can you explain why it would be difficult to create a program to trace the path?
- StavrosK 14y agoI don't think it would, really...
- barik 14y agoI've done some research in this area with examining user input mechanics. This particular example would be solvable using B-spines [1], as one possible approach. The "path CAPTCHA" even provides some great computational hints, by indicating the starting point as a circle! http://mathworld.wolfram.com/B-Spline.html http://mathworld.wolfram.com/B-Spline.html
- tripzilch 14y agoMotionCAPTCHA doesn't actually solve the CAPTCHA problem, it just adds a hurdle for human users to your submission form. There is nothing in your "roadmap" that prevents bot spammers from trivially circumventing this hurdle. The only "protection" it offers is that, as long as MotionCAPTCHA does not become very popular, it won't be worth the effort for a bot spammer to write the circumventing code. However, you can get exactly the same amount of protection without inconveniencing your users by obfuscating field names and doing the same JavaScript form action replacing trick you already do. The simple problem is this: The challenge to properly submitting the form is tied to the fact whether your plugin has replaced the form action url to contain the right value. But this is not tied in any way to the user actually having solved the motion captcha. Which means that any bot-stopping power it possesses can also be achieved equally well without forcing the user to pass the motioncaptcha test. And while the motion captcha looks really neat and fun, it is still always a better user experience if they can submit a form without having to jump through a hoop at all.
- Fando 14y agoYour article's title should be: Captchas are sometimes so ridiculous, that they take 1 second longer to solve because you need to refresh them which is besides the point that is that we are due for a new way of thinking about authenticating human presence on the web.
- ballooney 14y agoCatchy.
- voltagex_ 14y agoI've noticed a steep rise in the difficulty of reCaptcha captcha's too. There isn't anyone I can contact about it, is there?
- brudgers 14y agoReCaptcha is free from Google. I would hazard to guess that it is free because the value of the data Google collects is greater than the cost of providing the service. What I notice is that user convenience and blocking bots don't directly enter into the value Google derives, they are only marketing points - i.e. what matters to Google is that the perception of ReCaptcha is suffiently positive that a stream of relevant data is provided. It would seem to me that having data on an individual's ability to solve Captcha's might provide some correlation with educational, economic, and social characteristics which is potentially useful to advertisers. I just can't really buy into the idea that Google is offering ReCaptcha as charity.
- StavrosK 14y agoYou know they use it to digitize books, yes?
- brudgers 14y agoYes of course (and it is not a charity project, either). The fact that you are linking ReCaptcha to a valuable data stream for Google seems to support the my general claim that Google is deriving value from the data stream. And perhaps the collection of that data almost exclusively at times when a single identity can be correlated with a single datum ( i.e. account creation and management) is merely coincidence. But surely you are not suggesting that Google is ignorant of this fortuitous situation and its implications for their online advertising business.
- StavrosK 14y agoNo, I'm not. From the wording of your question I thought you didn't know they digitized books, which is a revenue stream already. They might use it for other data indeed.
- brudgers 14y agoThere wasn't a question in my post. And the rate of blocking bots doesn't enter into Google's book digitization process.
- level09 14y agoHTML5 should introduce something better than captchas, I wonder why it was not made part of the forms elements ..
- deleted 14y ago[deleted]
- tshadwell 14y agoThough I agree those would be hard captchas if you tried to complete them properly, It's not overly hard to guess which one is the control- the control is always bold, very likely a nonsense word, and never cut off or partially visible, because the control is generated by an algorithm rather than a scanner. The captcha isn't really designed to be regenerated until both words make sense.
- sams99 14y agoMany months into this experiment I barely get 2 spam comments a month on my blog, I totally respect reCAPTCHA, but demanding JavaScript, doing some minimal tests and perhaps an amount of computation (1 sec on iPad) is the FIRST thing we should be doing http://samsaffron.com/archive/2011/10/04/Spam+bacon+sausage+and+blog+spam+a+JavaScript+approach http://samsaffron.com/archive/2011/10/04/Spam+bacon+sausage+...
- mikeash 14y agoAlmost any unique solution will work well for a small site, because it's not worth the effort to program a bot specifically for your system. For the longest time, my blog's comments were protected by a "captcha" that simply asked the user to type the word "elbow" into a text box. The word never changed and was not obscured in any way. Worked pretty well. Such solutions do not scale to larger web sites, though.
- jsilence 14y agoThe captcha 'arms race' will continue until reCapcha can not distinguish any more between the bot and a human. Turing test passed. ;-)
- antirez 14y agoThere is no stupid "hey I've an idea!" comment in this thread, so I'll offer one. An alternative (probably already proposed?) could be the following, if you have a large set of human tagged images or videos you could show this images to users and, like, eight set of tags, and ask: what set of tags better apply to the image above (of course only one set is really about the image, other sets are random)? This are three bits per image, do this a few times and the probability of a computer random guessing is very low. Every time you show an image you may crop + rotate it a bit and apply a filter, so that manually building a table is hard, but if you have a big set of images like google could have maybe this is not needed.
- tpinto 14y agoOnce I found a nice captcha replacement (can't remember where it was, tho). It worked like this: at the end of the form, there were 6 to 9 playing cards and the text "Click on the seven of spades". This fitted the theme of website which had something to do with poker or magic tricks (can't really remember what it was) but this can be done with a lot of other stuff that is well known by people and not by robots (e.g. 6 photos of animals and the question "Click on the dog", etc.)
- benmanns 14y agoI think that the problem that we will always run into, is that any human-performable task will either be cracked by someone writing a bot, or made trivially inexpensive by apps that charge as little as $0.00139 per solved captcha (see [1]). Microsoft has implemented a tagging-type captcha, ASIRRA (see [2]), for which you can hire out the results for $0.004 per solved captcha[3]. I think the only real solution is to make it cost real money (say $0.25 or $0.10) to perform whatever action you are protecting, so that repeated attempts are prohibitively expensive, but one or two by a legitimate user is not too expensive. Otherwise, financially-driven spammers will always find a way to inexpensively circumvent the protection. [1]: http://www.deathbycaptcha.com/user/order http://www.deathbycaptcha.com/user/order [2]: http://research.microsoft.com/en-us/um/redmond/projects/asirra/ http://research.microsoft.com/en-us/um/redmond/projects/asir... [3]: http://de-captcher.com/ http://de-captcher.com/, no direct link to pricing without registering
- 14y ago
- ajasmin 14y agoPeople interested in capchas may also like this episode of the Hacker Medley podcast http://hackermedley.org/humans-only/ http://hackermedley.org/humans-only/ It talks about capchas vs ocr technologies and capchas solving companies in India.
- ajasmin 14y agos/capchas/captchas/
- Tycho 14y agoI also have an idea. Since reCptcha has so much traffic, why not just pair off users and get them to verify each other as fellows humans? Not quite sure how you'd do that but it is one approach that could let you break out of the pattern recognition arms race.
- Lisa2000 14y agoNeat demo last week on alternative to word captchas -- cartoon catcha, eg drag hat on top of head, put eyeglasses on face, from Mitsuo Okada of Osaka University, at Founders Institute, he's at mitsuookada@gmail.com
- WalterBright 14y agoWhy is it that there's all this software that can decode horrifically mangled text, and yet nothing to OCR a handwritten letter?
- apu 14y agoSo back when I was a PhD student, we had an idea for a Captcha system that would be better than the current system and all alternatives by quite a margin, but we talked to some experts in the area, and they said that none of this matters because captchas are normally broken by feeding them to mturkers or people wanting to get into porn sites. Is that no longer true? If so, I should look at reviving our old system.
- stereo 14y agoWhat was your idea?
- nikole9696 14y agoI will say up front that I have no good solution. That said, as a human, I hate captchas or anything else that makes me jump through hoops to do something that should be simple. The industry is punishing people to avoid bots or (whatever they are using them for in the instance), and yet it doesn't even work to accomplish that goal. Eliminate it all. Find something new. I wish I knew what to suggest. But it won't be anything at all like a captcha, stupid game to play, security questions, or anything like that.