3 ms·
I worked on CAPTCHAs at Microsoft Research in a past life, and I can tell you, most original forms won't work. In the case of the one you described, I as an att
by tylermenezes 14y ago
I worked on CAPTCHAs at Microsoft Research in a past life, and I can tell you, most original forms won't work. In the case of the one you described, I as an attacker can just put it through Tin Eye to find the original, and then do some semantic analysis on the page containing the image, or event just the URL, to figure it out. I have working code for this as a proof of concept for Microsoft's Kitten Auth.
- thebigshane 14y agoIf that is the best attack on my idea, then I'd say that's pretty good! A spammer would have to target the site specifically (for tailor-made script) and parse an animated gif into individual images, then send every image into Tin Eye (which is awesome but the API isn't free right?). That said, I am a complete amateur at captcha design. Cool research though and I bet a lot of HN'ers would be interested in your PoC if you haven't already submitted it.