3 ms·

Just to be fair - it is less friction than a typing captcha. I still think the security of it is pretty weak. Possible vulnerabilities include: * Moving the sl

by mikle 14y ago

Just to be fair - it is less friction than a typing captcha. I still think the security of it is pretty weak. Possible vulnerabilities include: * Moving the slider bit by bit and OCRing will solve 90% of the images I've seen. * If the image selection is small you could just build a DB of all slider positions and just teach it how it is supposed to look once. * It's not only easier for the users. It is also easier for captcha solvers in India, China, etc. This will improve their productivity immensely and free up their other hand.

huhtenberg 14y ago
Actually moving slider bit by bit and simply submitting the form after every move would something to try first. More generally speaking - it's a very nice idea, but basically there are too few invalid answers to make it practical. You changed an open-ended question of a conventional captcha into a multiple choice.
angry-hacker 14y ago
+ There are only 29 different variations, so bots can easily just try each one of them...
- jerf 14y ago
  They don't even have to do that; a 1/29th chance of success is plenty for the scammers. This is Yet Another Complete Crap CAPTCHA. It isn't solving the problem of prevent real spammers from sending you real spam, it's solving the problem of looking enough like a CAPTCHA to think you're getting somewhere. Or in this case, selling you something. Also, at least the spiral one I got is flat-out solvable; run "find edges", run a search for the characteristic slope relationship of the lines at various points in the images... would probably take a decent computer vision student about four hours, tops. That hardly even qualifies as trying.
- mikle 14y ago
  Yes, I missed the obvious one :) As someone also mentioned it accepts "close enough" solutions so it basically boils down to 1/6 chance which spammer will consider almost perfect.
jere 14y ago
>Moving the slider bit by bit and OCRing will solve 90% of the images I've seen. I'm not sure what you're saying. Good OCR should recognize the text when it's distorted slightly, right? Which would yield false positives, no? As much as I'd like to pick this apart, I think the slide captcha is actually pretty clever. We can nitpick implementation details all day, but most of those can be fixed. I wish I had thought of it.
- mikle 14y ago
  To be honest the only reason I didn't add "yet another misguided captcha attempt" to the title is because of the advertising aspect. We can and should nitpick captchas, even just if it is as an intellectual exercise. About the OCR - what I meant is that most of their images had text meaning I can OCR every step and if I get something with dictionary words I submit. It will work even the OCR is very permissive (recognizes distorted text as you put it) because this implementation accepts not only the perfect straight solution but also "close enough"s.
  - jere 14y ago
    >About the OCR - what I meant is that most of their images had text meaning I can OCR every step and if I get something with dictionary words I submit. It will work even the OCR is very permissive (recognizes distorted text as you put it) because this implementation accepts not only the perfect straight solution but also "close enough"s. Again, fair point on this particular implementation. However, there's no reason to have the fudge factor. It's already plenty easy to get the exact answer. Ignoring that fudge factor, there are at least 6 options on each side of the correct answer that (I would assume) can be OCRed also. So the OCR method only cuts out maybe half of the wrong answers... perhaps better because the correct one will me closer to the middle? I think a more foolproof attack vector would be too look for vertical and horizontal lines, which are only going to show up in the correct image.
    - mikle 14y ago
      I'm not sure it will be more foolproof since images don't really need to have long horizontal or vertical lines, but it is indeed another great attack path.

by mikle 14y ago

huhtenberg 14y ago

Actually moving slider bit by bit and simply submitting the form after every move would something to try first. More generally speaking - it's a very nice idea, but basically there are too few invalid answers to make it practical. You changed an open-ended question of a conventional captcha into a multiple choice.

angry-hacker 14y ago

+ There are only 29 different variations, so bots can easily just try each one of them...

jerf 14y ago
They don't even have to do that; a 1/29th chance of success is plenty for the scammers. This is Yet Another Complete Crap CAPTCHA. It isn't solving the problem of prevent real spammers from sending you real spam, it's solving the problem of looking enough like a CAPTCHA to think you're getting somewhere. Or in this case, selling you something. Also, at least the spiral one I got is flat-out solvable; run "find edges", run a search for the characteristic slope relationship of the lines at various points in the images... would probably take a decent computer vision student about four hours, tops. That hardly even qualifies as trying.
mikle 14y ago
Yes, I missed the obvious one :) As someone also mentioned it accepts "close enough" solutions so it basically boils down to 1/6 chance which spammer will consider almost perfect.

jere 14y ago

>Moving the slider bit by bit and OCRing will solve 90% of the images I've seen. I'm not sure what you're saying. Good OCR should recognize the text when it's distorted slightly, right? Which would yield false positives, no? As much as I'd like to pick this apart, I think the slide captcha is actually pretty clever. We can nitpick implementation details all day, but most of those can be fixed. I wish I had thought of it.

mikle 14y ago
To be honest the only reason I didn't add "yet another misguided captcha attempt" to the title is because of the advertising aspect. We can and should nitpick captchas, even just if it is as an intellectual exercise. About the OCR - what I meant is that most of their images had text meaning I can OCR every step and if I get something with dictionary words I submit. It will work even the OCR is very permissive (recognizes distorted text as you put it) because this implementation accepts not only the perfect straight solution but also "close enough"s.
- jere 14y ago
  >About the OCR - what I meant is that most of their images had text meaning I can OCR every step and if I get something with dictionary words I submit. It will work even the OCR is very permissive (recognizes distorted text as you put it) because this implementation accepts not only the perfect straight solution but also "close enough"s. Again, fair point on this particular implementation. However, there's no reason to have the fudge factor. It's already plenty easy to get the exact answer. Ignoring that fudge factor, there are at least 6 options on each side of the correct answer that (I would assume) can be OCRed also. So the OCR method only cuts out maybe half of the wrong answers... perhaps better because the correct one will me closer to the middle? I think a more foolproof attack vector would be too look for vertical and horizontal lines, which are only going to show up in the correct image.
  - mikle 14y ago
    I'm not sure it will be more foolproof since images don't really need to have long horizontal or vertical lines, but it is indeed another great attack path.