5 ms·
This isn't a CAPTCHA flaw, this is about using humans to break systems designed only for humans. So the solution is to differentiate humans from each other. T
by zepolen 18y ago
This isn't a CAPTCHA flaw, this is about using humans to break systems designed only for humans.
So the solution is to differentiate humans from each other.
The only thing a real user and a spammer can be differentiated on is _time_.
A human labour captcha breaker won't want to spend more than x seconds per spam as they work on a volume basis, whereas a real user will only do the registration once, and since they want to use your service, they are more willing to spend a couple extra minutes to do so.
However, that annoys new users who don't really want to go through a huge ordeal just to register on your site.
So the solution is to allow users to register without any captcha but disable their privileges on the site that could be abused for spam until either:
a) they gain enough credibility (like with karma on hacker news to unlock features)
b) they go through the actual signup form which would take about 5 minutes to fill (maybe having to identify 50 photographs, copying a passage of text etc.)
That would deter spammers, because it automatically limits them to x captchas to break per day.
- twopoint718 18y agoI had a similar idea once. The key is that you need to add a cost to signing up on a site. If you make the cost be paid in time that will tend to deter normal users. The correct deterrent, I feel, is CPU cycles. Light browsers/users have plenty of them, a spammer needs all he can get. The idea would be to pair a CAPTCHA test that a human can do well on with a compute-intensive task that really only a computer can do (like solving a big discrete log). An implementation would be to have the user type in the specific values (which are given in CAPTCHA form) into an on-page javascript calculator. This will then take some time to solve the equation (which can be easily adjusted by the size of the discrete log). If a spammer uses humans to bypass the image recognition task, they'll still have to spend CPU time to solve the equation. Likewise, cracking the CAPTCHA with OCR will not circumvent the computation. If too many successful spam logins are still occurring the difficulty of the compute task and or the OCR task can be adjusted.
- furyg3 18y ago... or ... How to annoy me with visual tasks, hang my browser, and ensure that I don't go back to your site. It also doesn't solve the mechanical-turk / porn-capatcha-redirection issues (since the spammers are using other people's cycles anyway). Your site exists, presumably, to make it easier for users to do whatever it is they do on your site. It seems silly to work the other direction... The arms race is between you and the spammers. Don't let your sites users be the casualty.
- ahoyhere 18y agoThe arms race is between you and the spammers. Don't let your sites users be the casualty. This is totally GI Joe (~knowing is half the battle!~) but I'm totally stealing it.
- blasdel 18y agoThe correct deterrent, I feel, is CPU cycles That's the stupidest thing I've read all day -- you think spammers don't have access to hundreds of thousands of computers?