7 ms·

It's easy to criticize captchas. That's why there are so many articles like this, which we all knowingly nod along to as we read. It's much harder to provide p

It's easy to criticize captchas. That's why there are so many articles like this, which we all knowingly nod along to as we read. It's much harder to provide productive criticism that leads to an actual improvement over the status quo. (Although it is easy to suggest bad alternatives to captchas, which is why they appear in every comment thread about captchas on Hacker News, including this one.)

jdale27 14y ago
I don't disagree, but what is your point? That one should never say "X is broken" without inventing a Y that is better than X?
- streptomycin 14y ago
  It's fine to say "X is broken", but I doubt you can find anyone on Hacker News who didn't read an article like this years ago and thus already knows X is broken. This article is beating a dead horse. The fact remains, captchas are the worst technique to prevent bots from filling out a form, except for all the other ones.
  - seandougall 14y ago
    Yes, though, to be fair, this particular horse does seem to find a way to get deader as the years go on.
    - streptomycin 14y ago
      When a horse dies, it doesn't stay in a constant preserved state forever, it slowly decays :)
- rickdale 14y ago
  Right now I think the best solution is no captcha. HN doesnt use one for the sign up form. Yes, the HN community is flooded, but for the most part I dont think a captcha would change that.
  - asto 14y ago
    HN is a (largely) community moderated content aggregation site. What if you don't have the benefit of a community to moderate? If you're an email service and want to stop bots from signing up and spamming the world at large, how would you do that?
jrockway 14y ago
The best anyone else has come up with is, "You've typed your password wrong one time. Your account is now disabled, please call a customer service representative at 1-900-TIME-WASTE between the hours of 10:30 AM and 3:30 PM Indian Standard Time. Please note that we are closed on Monday, Tuesday, Wednesday, Thursday, and Sunday, and that we have lunch between 11:00 AM and 3:00 PM."
- derefr 14y ago
  What about just "You've typed your password wrong N times; you must now wait 2^N seconds before trying again"?
  - chubot 14y ago
    Well, how do you prevent someone from locking you out of your account?
    - obilgic 14y ago
      Account gets locked just for that computer.
      - Jach 14y ago
        Oh, you mean just for that IP? Torify. Cookies? Bots don't need to accept them. Do you have something better?
        raverbashing 14y ago
        Having to wait 1s between attempts (per user) could be enough to prevent brute force attacks Of course, if one ip is making too many requests, it gets blocked or captchaed
        morsch 14y ago
        That prevents brute force attacks against one specific account, but not against an attack against all users of a site. If you have the capability to make, say, 10k login attempts per second (no idea if that's realistic), you don't slow down to 1 attempt/second, you just attack 10k different accounts once every second. IP blocks can be countered in other ways (botnets, tor, etc). I'm not saying it's a bad idea though, there doesn't seem to be any downside apart from the book-keeping required. You could probably start with a higher delay (5 to 10 seconds seems very reasonable) and increase it to several minutes. But please don't make it 24 hours after 3 failed attempts, which happened to me when I tried to order train tickets online and forced me to make a trip to a physical ticket vending machine.
tjpaxton 14y ago
Take a look at our product at areyouahuman.com We launched in January and are using games to make them easier for people. Some of our early testing showed captchas can decrease signups by up to 25% and we're able to recover almost all of that. We also monitor how you play the game (like mouse movement) so we can ramp up our security without having to make the task more difficult for people. Read more here http://areyouahuman.com/how-playthru-stops-the-bots http://areyouahuman.com/how-playthru-stops-the-bots
- 1337biz 14y ago
  This is a neat idea, but these game captchas have some high level of similarity with in-banner-games (at least to me). Not sure if theses "catch the monkey" banners are still around but they were extremely annoying. I hope you are doing some testing to make absolutely sure that this great idea is not mistakenly experienced as some form of banner ad.
  - tjpaxton 14y ago
    Thanks. We certainly don't want to become the equivalent of 'catch the monkey' We constantly do UX testing. Early on it was an issue that people thought we were just and ad on the page, but we updated our start screen and design. By default, we also show our games in a modal window after people click submit, so they know they have to do it. With these two things we saw registrations increase by 40% over recaptcha. We're also getting ready to roll out an update to our API that will allow you to hide/disable the submit button until the game is played. Our testing showed this helped increase submission rates even more. Finally, we are also trying different styles of games to see what people respond to best.
- bhickey 14y ago
  Do you have any response to claims that your product is easily broken? http://news.ycombinator.com/item?id=4025791 http://news.ycombinator.com/item?id=4025791 I'm skeptical of your efforts to distinguish humans from bots by mouse movements and other inputs. Anything you can infer can be modeled. It's unreasonable to expect a smart captcha cracker to resemble a zero reaction time Counter Strike aimbot.
andrewfelix 14y ago
Why not pose questions with answers that are obvious to humans but difficult for ai. Eg. 'What's 4 times four?' or 'How many times does the word four appear within this sentence?'
- sigkill 14y ago
  An even more outrageous but possible solution has already been implemented here. http://random.irb.hr/signup.php http://random.irb.hr/signup.php
  - repsilat 14y ago
    That one is actually pretty easy to beat - the OCR is easy enough, and you can refresh the page until you get an easy question. Some of them are very simple integer arithmetic exercises. As for the harder questions, Wolfram Alpha is better able to do them than the average human.
    - sigkill 14y ago
      I'm not sure about which OCR you're talking about but I've tried ABBYY and because of the fractions ie top and bottom halves the thing craps out. Granted, if you get a single line problem it could easily be solved. Definitely there's the problem of application as well. Since this is a quantum bit service Site, you can expect people to know a minimum of integration. But I don't expect Facebook login to have anything even close to 8th grade mathematics.
      - repsilat 14y ago
        I always seem to strike it lucky with that site. I can remember it coming up twice on HN (once now, once a while ago - http://news.ycombinator.com/item?id=2290466 http://news.ycombinator.com/item?id=2290466), and both times I got a one-line equation. I didn't save the equation I got this time, but it was maybe five terms long and most of the atoms were zeros.
- nsns 14y ago
rimantas 14y ago
No, it is easy just to throw in a CAPTCHA instead of trying to solve the problem without abusing your users. I've always said that captchas were a wrong idea and should not be there at all.
majmun 14y ago
timeouts of few seconds are decent alternative to captcha. they can't be beaten.

jdale27 14y ago

I don't disagree, but what is your point? That one should never say "X is broken" without inventing a Y that is better than X?

streptomycin 14y ago
It's fine to say "X is broken", but I doubt you can find anyone on Hacker News who didn't read an article like this years ago and thus already knows X is broken. This article is beating a dead horse. The fact remains, captchas are the worst technique to prevent bots from filling out a form, except for all the other ones.
- seandougall 14y ago
  Yes, though, to be fair, this particular horse does seem to find a way to get deader as the years go on.
  - streptomycin 14y ago
    When a horse dies, it doesn't stay in a constant preserved state forever, it slowly decays :)
rickdale 14y ago
Right now I think the best solution is no captcha. HN doesnt use one for the sign up form. Yes, the HN community is flooded, but for the most part I dont think a captcha would change that.
- asto 14y ago
  HN is a (largely) community moderated content aggregation site. What if you don't have the benefit of a community to moderate? If you're an email service and want to stop bots from signing up and spamming the world at large, how would you do that?

jrockway 14y ago

The best anyone else has come up with is, "You've typed your password wrong one time. Your account is now disabled, please call a customer service representative at 1-900-TIME-WASTE between the hours of 10:30 AM and 3:30 PM Indian Standard Time. Please note that we are closed on Monday, Tuesday, Wednesday, Thursday, and Sunday, and that we have lunch between 11:00 AM and 3:00 PM."

derefr 14y ago
What about just "You've typed your password wrong N times; you must now wait 2^N seconds before trying again"?
- chubot 14y ago
  Well, how do you prevent someone from locking you out of your account?
  - obilgic 14y ago
    Account gets locked just for that computer.
    - Jach 14y ago
      Oh, you mean just for that IP? Torify. Cookies? Bots don't need to accept them. Do you have something better?
      - raverbashing 14y ago
        Having to wait 1s between attempts (per user) could be enough to prevent brute force attacks Of course, if one ip is making too many requests, it gets blocked or captchaed
        morsch 14y ago
        That prevents brute force attacks against one specific account, but not against an attack against all users of a site. If you have the capability to make, say, 10k login attempts per second (no idea if that's realistic), you don't slow down to 1 attempt/second, you just attack 10k different accounts once every second. IP blocks can be countered in other ways (botnets, tor, etc). I'm not saying it's a bad idea though, there doesn't seem to be any downside apart from the book-keeping required. You could probably start with a higher delay (5 to 10 seconds seems very reasonable) and increase it to several minutes. But please don't make it 24 hours after 3 failed attempts, which happened to me when I tried to order train tickets online and forced me to make a trip to a physical ticket vending machine.

tjpaxton 14y ago

Take a look at our product at areyouahuman.com We launched in January and are using games to make them easier for people. Some of our early testing showed captchas can decrease signups by up to 25% and we're able to recover almost all of that. We also monitor how you play the game (like mouse movement) so we can ramp up our security without having to make the task more difficult for people. Read more here http://areyouahuman.com/how-playthru-stops-the-bots http://areyouahuman.com/how-playthru-stops-the-bots

1337biz 14y ago
This is a neat idea, but these game captchas have some high level of similarity with in-banner-games (at least to me). Not sure if theses "catch the monkey" banners are still around but they were extremely annoying. I hope you are doing some testing to make absolutely sure that this great idea is not mistakenly experienced as some form of banner ad.
- tjpaxton 14y ago
  Thanks. We certainly don't want to become the equivalent of 'catch the monkey' We constantly do UX testing. Early on it was an issue that people thought we were just and ad on the page, but we updated our start screen and design. By default, we also show our games in a modal window after people click submit, so they know they have to do it. With these two things we saw registrations increase by 40% over recaptcha. We're also getting ready to roll out an update to our API that will allow you to hide/disable the submit button until the game is played. Our testing showed this helped increase submission rates even more. Finally, we are also trying different styles of games to see what people respond to best.
bhickey 14y ago
Do you have any response to claims that your product is easily broken? http://news.ycombinator.com/item?id=4025791 http://news.ycombinator.com/item?id=4025791 I'm skeptical of your efforts to distinguish humans from bots by mouse movements and other inputs. Anything you can infer can be modeled. It's unreasonable to expect a smart captcha cracker to resemble a zero reaction time Counter Strike aimbot.

andrewfelix 14y ago

Why not pose questions with answers that are obvious to humans but difficult for ai. Eg. 'What's 4 times four?' or 'How many times does the word four appear within this sentence?'

sigkill 14y ago
An even more outrageous but possible solution has already been implemented here. http://random.irb.hr/signup.php http://random.irb.hr/signup.php
- repsilat 14y ago
  That one is actually pretty easy to beat - the OCR is easy enough, and you can refresh the page until you get an easy question. Some of them are very simple integer arithmetic exercises. As for the harder questions, Wolfram Alpha is better able to do them than the average human.
  - sigkill 14y ago
    I'm not sure about which OCR you're talking about but I've tried ABBYY and because of the fractions ie top and bottom halves the thing craps out. Granted, if you get a single line problem it could easily be solved. Definitely there's the problem of application as well. Since this is a quantum bit service Site, you can expect people to know a minimum of integration. But I don't expect Facebook login to have anything even close to 8th grade mathematics.
    - repsilat 14y ago
      I always seem to strike it lucky with that site. I can remember it coming up twice on HN (once now, once a while ago - http://news.ycombinator.com/item?id=2290466 http://news.ycombinator.com/item?id=2290466), and both times I got a one-line equation. I didn't save the equation I got this time, but it was maybe five terms long and most of the atoms were zeros.
nsns 14y ago

rimantas 14y ago

No, it is easy just to throw in a CAPTCHA instead of trying to solve the problem without abusing your users. I've always said that captchas were a wrong idea and should not be there at all.

majmun 14y ago

timeouts of few seconds are decent alternative to captcha. they can't be beaten.