5 ms·

Last week, I was going to register a new web service (forgot which one) and after the third captcha I couldn't get right, I just quit and decided to use a compe

by DavidPP 18y ago

Last week, I was going to register a new web service (forgot which one) and after the third captcha I couldn't get right, I just quit and decided to use a competitor instead. What I'm trying to say is that ideally you shouldn't use a solution that is less user friendly and possibly infuriating for your future customers/users.

rarrrrrr 18y ago
Indeed. It's a balance. Three failures is way too hard. Ours is a fairly simple captcha -- 5 letters/numbers, and our logs show that somewhere around 94% of attempts are correct, and we see few abandoned signups during the captcha answering phase. We could probably improve that further, though. The primary defense against OCR is to make the segmentation attack hard -- pushing the characters together somewhat. With more tweaking we could probably get closer to a sweet spot of just enough overlap. Not even all of the characters would have to overlap to be effective.
- axod 18y ago
  But it's a moot point, since anyone who really wants to defeat captchas en masse, can just go mechanical turk, or even better just setup their own 'porn/warez' sites etc to show your captchas and have random internet users solve it for them. There's no defense against that... Which makes captchas just a big irritating bag of fail.
  - irrelative 18y ago
    Indeed! In my experience, the best captcha is asking for a credit card number.
    - cdr 18y ago
      In the same vein, the best captcha is not letting anyone sign up at all.
  - rarrrrrr 18y ago
    I think of it as similar to a home security system. Of course there are ways around it. Chances are that the effort involved means that a burglar will go rob a neighbor's house instead though. Perhaps captchas make more sense in capital intensive industries with clear avenues for abuse. In the case of SpiderOak, we'd prefer to avoid making the free backup accounts an attractive prospect for warez distribution. YMMV.
apollo 18y ago
Are you sure you're human?
- jonursenbach 18y ago
  I for one, welcome our CAPTCHA-weilding overlords.

by DavidPP 18y ago

rarrrrrr 18y ago

Indeed. It's a balance. Three failures is way too hard. Ours is a fairly simple captcha -- 5 letters/numbers, and our logs show that somewhere around 94% of attempts are correct, and we see few abandoned signups during the captcha answering phase. We could probably improve that further, though. The primary defense against OCR is to make the segmentation attack hard -- pushing the characters together somewhat. With more tweaking we could probably get closer to a sweet spot of just enough overlap. Not even all of the characters would have to overlap to be effective.

axod 18y ago
But it's a moot point, since anyone who really wants to defeat captchas en masse, can just go mechanical turk, or even better just setup their own 'porn/warez' sites etc to show your captchas and have random internet users solve it for them. There's no defense against that... Which makes captchas just a big irritating bag of fail.
- irrelative 18y ago
  Indeed! In my experience, the best captcha is asking for a credit card number.
  - cdr 18y ago
    In the same vein, the best captcha is not letting anyone sign up at all.
- rarrrrrr 18y ago
  I think of it as similar to a home security system. Of course there are ways around it. Chances are that the effort involved means that a burglar will go rob a neighbor's house instead though. Perhaps captchas make more sense in capital intensive industries with clear avenues for abuse. In the case of SpiderOak, we'd prefer to avoid making the free backup accounts an attractive prospect for warez distribution. YMMV.

apollo 18y ago

Are you sure you're human?

jonursenbach 18y ago
I for one, welcome our CAPTCHA-weilding overlords.