15 ms·

Worst CAPTCHA Ever

346 points by ZeljkoS 14y ago

_ikke_ 14y ago
Well, it is a good way to tell computers and humans apart. Computers can read it, while humans can't. They should reject corectly filled in captchas.
- fosap 14y ago
  That's a great idea. If i was ever to create a product for colorblinds only i'd use that.
  - ihsw 14y ago
    It's not an uncommon strategy (eg: fill up a comment form with hidden but obviously named form fields) and since people won't be filling in those hidden fields then bots will have revealed themselves. This isn't by any means a complete solution however it does catch 90% of drive-by spam.
    - philipDS 14y ago
      Yup, this is also known as the Honeypot Captcha technique: http://haacked.com/archive/2007/09/11/honeypot-captcha.aspx http://haacked.com/archive/2007/09/11/honeypot-captcha.aspx
    - dEnigma 14y ago
      That's an interesting approach, but I guess as soon as it would become mainstream, the bots would adapt without many problems.
      - NickNameNick 14y ago
        Depending on how the fields were hidden, they may need to render and reflow html, css and dom changes by javascript. None of which is all that difficult for a full size browser, but it may be prohibitively resource intensive for a high-volume spam bot.
        Bromskloss 14y ago
        Lynx. :-(
    - eli 14y ago
      Careful! There are legitimate toolbars that will helpfully prefill forms, sometimes even hidden fields. I've been bitten by this in production.
- wyck 14y ago
  Well maybe they are really good and this is a honeypot.
- deleted 14y ago
  [deleted]
- laurent123456 14y ago
  You'd think, but what's so dumb about this captcha is that it's both easy to guess for a computer, but for a human too. If you look at it, the random parts are outside the readable text (which is just white on a gray background). I'd love to know what led to the "decision" of implementing something so dumb.
  - eCa 14y ago
    The text has been selected, hence the single-colour backhround.
  - lutze 14y ago
    You're missing the point bud, it's not that it's easy to guess, it's that the answer is in the bloody HTML as plaintext. No guessing required.
- fakeer 14y ago
  I still loathe reCAPTCHA more than any other captcha out there. I've given up hopes of logging in on many occasions simply because of it. Looks like it's designed for not to be deciphered either by humans or computers.
  - reeses 14y ago
    It started so well, as a tool to harness collective 'intelligence' to digitize text while preventing spam. Now you're right, even the bloody accessible (audio) versions are useless. It's as if a dozen poltergeists are whispering in your ear, and you have to pick out the one that matters.
  - kristofferR 14y ago
    I actually think reCAPTCHA has gotten quite good actually after they switched one of the words to a street address. Just look at the examples in this post, most are pretty easy to decode right away. http://techcrunch.com/2012/03/29/google-now-using-recaptcha-to-decode-street-view-addresses/ http://techcrunch.com/2012/03/29/google-now-using-recaptcha-...
  - senthilnayagam 14y ago
    I totally agree, see this recaptcha which is upside down, how are we supposed to read it http://postimg.org/image/7xgovvhij/ http://postimg.org/image/7xgovvhij/
    - dEnigma 14y ago
      This is a joke, right? Everbody should be able to read upside down text. In any way, only the distorted word counts, so it doesn't matter.
    - dhughes 14y ago
      I saw a mirror image d once.
    - deleted 14y ago
      [deleted]
    - 14y ago
mschuster91 14y ago
D&B?! Aren't these the guys everyone including Apple trusts for their DUNS number?! Are you fucking serious?
- mzahir 14y ago
  Exactly. They're not the people everybody trusts to determine if incoming traffic is human/machine. Your response implies that they are inept at their area of expertise.
  - SoftwareMaven 14y ago
    It's relevant if being able to automate the connection allows you to circumvent the checks Apple, et al, have put in place with the DUNS number. I have no clue, so I can't render an opinion.
  - mschuster91 14y ago
    The shown website development bug does not make me confident about the quality of the rest of their website and data handling in general, so yes, I imply that they are not up to protect the data of their customers - which is the area of expertise of anyone handling massive amount of customer data.
- spikels 14y ago
  D&B has got itself a sweet little monopoly business with these DUNS numbers. They charge $299 if you want "Expedited" service otherwise (according to the FAQ) it will take "a MINIMUM of 30 business days for a new D&B DUNS Number to be processed" (emphasis added). I get the sense they just sit on you app until the 30 days are up and no actual work is being done. They also try to upsell you to one of the many other plans starting at $299. To somewhat soften their touch the basic service is free after all. And the expedited service is free for businesses considering doing government contracting (maybe we should all consider this as we apply to the Apple developer program). https://iupdate.dnb.com/iUpdate/showFaq.htm#Request2 https://iupdate.dnb.com/iUpdate/showFaq.htm#Request2
thomaslutz 14y ago
I thought you meant the reCaptcha Audio-Version (unsolvable for humans after it got broken a few times). This is just hilarious.
codesuela 14y ago
While this captcha is truly a display of ignorance I could imagine that "corporate developers" at D&B aren't web developers. All I am saying is that if you force me to write enterprise software (which I have zero experience with) on a tight schedule I'm probably going to make a stupid mistake or two even though I hope I am not of "lower quality". I imagine someone in management refused to hire web devs because "we've already got developers inhouse". Just a wild guess though.
- rytis 14y ago
  What is this thing that people call "enterprise software"?
  - Semaphor 14y ago
    According to the internet it's badly written, extremely slow and very expensive software that will only get replaced after 20-50 years of use.
    - LeeHunter 14y ago
      On the bright side, most enterprise software projects never actually get put into production.
    - thirsteh 14y ago
      That's actually fairly accurate.
    - dmix 14y ago
      Also written by a massive team with factory-like division of responsibilities.
    - mzahir 14y ago
      Haha, sadly the vast majority doesn't last past 6 years due to EOL on various components and inflexibility to changing business requirements. A more common need is the ability to have a scapegoat / fall-guy for failures of projects that have unrealistic/arbitary requirements and/or deadlines set by an upper management that is no longer in touch with technology.
unlucky 14y ago
Seems almost too simple... I feel like I am being tricked.
ef4 14y ago
A wonderful example of cargo cult programming.
- sabe__ 14y ago
  It's like all these sites that requires you to enter your current password before you can change it, but deleting the entire account is just ticking a check box (at least twitter and dribbble worked this way back when I had accounts there). Some things we been doing for so long that we forget why we do them at all.
  - nostrademons 14y ago
    Or ones that make you confirm an e-mail address by entering it twice. The reason you confirm a password is because you can't see the password, and so you never know if you mistyped it. Confirming an e-mail address, in a normal text field, is just stupid busywork.
    - improv32 14y ago
      Or when you enter bad login info, and the site doesn't tell you if it was your email or your password. But on the reset password form it tells you when you put a bad email in.
      - nostrademons 14y ago
        Well, that's usually a security feature so that hackers can't harvest valid accounts by trying e-mail addresses and seeing what the error message is. It's stupid if they can do that anyway via the password reset form, though (although presumably, if you get the password reset e-mail you'll have an idea that someone else is trying to access your account).
        goldfeld 14y ago
        Or the reset password form can simply say an email has been sent to the relevant address, regardless of whether said address actually exists in their database. I've always suspected this is how most of them work.
natemcguire 14y ago
After the D&B signup process, well, I am not surprised.
ricardoz17 14y ago
Twitter does something similar with 3rd-party authentication. The user puts in their name and password but then the rest of the process can be done by a bot. 1. click on a button to confirm granting access 2. provide the code in an image to he App but the HTML for the code hass the following: Next, return to TrainerLists and enter this PIN to complete the authorization process: <kbd aria-labelledby="code-desc"><code>7996044</code>
iambibhas 14y ago
Somebody is gonna get fired.
nelse 14y ago
That reminded me the captcha I got some time ago: http://24.media.tumblr.com/tumblr_lvy7sl13MV1r839zio1_500.png http://24.media.tumblr.com/tumblr_lvy7sl13MV1r839zio1_500.pn...
jmorton 14y ago
But wait, how else would you make the automated tests pass?
- geoffroy 14y ago
  lol
- tomjen3 14y ago
  Stub the captcha generator with one that returns a known value...
d23 14y ago
Funny coincidence, I ran into this on another website yesterday. And if it weren't bad enough that it was printed in plain text in the source code, it was only checked client side with javascript. Seriously?
- kevin_p 14y ago
  Just because something is checked client-side doesn't mean it's only checked client-side. I've used JS checking on anti-bot questions[1] quite deliberately: it doesn't have any effect on 99%+ of bots, but it stops posts by humans from accidentally being flagged as spam. [1] admittedly questions like "type someword in this box to prove you're not a spambot"[2] rather than actual captchas, which I agree would be rather silly. [2] if this is what you meant by a "printed in plain text in the source code" question, remember that most spambots aren't customised to an individual site, they just roam the internet submitting their crap to anything that looks like a comment form. Sure, it's trivial to write a script to parse the page and find the answer to the question - but nobody's actually going to do that for a typical company's "Contact Us" form. Adding this sort of check cuts down on spam enormously (from hundreds a day to zero), and is way easier for humans than solving a captcha.
  - __david__ 14y ago
    > admittedly questions like "type someword in this box to prove you're not a spambot" rather than actual captchas, which I agree would be rather silly. This is not silly. This works extremely well for the low traffic forum I run. Since there are a huge number of phpbb3 forums out there, spammers have made spam bots specifically targeting the platform. If you make your forum epsilon different from the default then the bots don't work without manual intervention. That's enough to keep you off of autospam lists for very, very long periods of time. And when someone inevitably adds your extra form element to their spam bot (it's happened to me 2 or 3 times over about 6 years) then you just change the answer and it stops working (and they might not even notice since it's a bot).
    - wilfra 14y ago
      Same! I was getting 50+ spambots a day registering to my vbulletin forum, even with a really hard captcha. I changed it to a question any eight year old could answer and I instantly went to less than one spambot per week getting through. Easier for users and nearly eliminated my spam problem, win-win.
GuriK 14y ago
Have a fun guys ... http://pro.sony.com/bbsc/jsp/forms/generateCaptcha.jsp http://pro.sony.com/bbsc/jsp/forms/generateCaptcha.jsp
- metaphorm 14y ago
 too easy. try again.  <div id="captchdiv" style="position:absolute; left:10; top:15;"> <TABLE BORDER="0" CELLSPACING="0" WIDTH="170" height="30"> <tr> <td width="34" align="center" valign="top"> L</td> <td width="34" align="center" valign="bottom"> K</td> <td width="34" align="center" valign="top"> T</td> <td width="34" align="center" valign="bottom"> F</td> <td width="34" align="center"> B</td> </tr> </table></div>
- dEnigma 14y ago
 Oh no! I can't rightclick so how can I possibly look at the source code xD
qntmfred 14y ago
see also: http://i.imgur.com/G8fV1IV.jpg http://i.imgur.com/G8fV1IV.jpg
robbyking 14y ago
I've worked for managers who would've ask for features like this; they just wanted it to look like it functioned so our non-technical audience would think it was impressive.
niggler 14y ago
How do audio captchas compare to the visual ones? Is it harder or easier for a computer to crack / people to understand ?
- dEnigma 14y ago
  Audio captchas are pretty hard to solve for me personally, much harder than even almost unreadable Captchas. But maybe that's just me. Still can't imagine a bot solving the audio captchas I've heard though. Edit: Just listen to it: https://www.google.com/recaptcha/demo/ https://www.google.com/recaptcha/demo/
  - niggler 14y ago
    That is awful. In most of the triplets, the middle sound is completely drowned out by the noise
    - krapp 14y ago
      That may have to do with it having been hacked before: http://arstechnica.com/security/2012/05/google-recaptcha-brought-to-its-knees/ http://arstechnica.com/security/2012/05/google-recaptcha-bro...
    - codesuela 14y ago
      Wow yes I agree first time I hear reCAPTCHA. I am seriously wondering whether ANYBODY is able to solve this. I know it was broken before but now it seems reCaptchaing something means straight up denying it to visually impaired people.
6ren 14y ago
Every expense was spared to give the impression that no expense had been spared. It's a credit report site; they want you to think they are secure.
- dornab 14y ago
  Exactly. It probably increases conversion because it looks secure. Credit card forms are sometimes used that way too, they get a lot of extra information because if they don't, people feel that they're scammy.
  - krapp 14y ago
    But surely a working captcha would increase conversion as well and have the added benefit of being a captcha?
    - just2n 14y ago
      And you really have to wonder, because the last time I had to implement a CAPTCHA (around 5 years ago), it was about 5 minutes of work. Google query, found a library, downloaded the library, copied the example into a form, and I was done. I can't imagine coming up with your own clever hacked-together bogus CAPTCHA would be simpler than that. So they actually did it the hard way?
- Draco6slayer 14y ago
  That's a Douglass Adams quote, isn't it?
d0m 14y ago
There are different levels of "captcha". Some bots just fill any forms on any sites with their spam.. a simple client-side question goes a long way to mitigate this. It obviously is a very different story if it's a script created especially for this form.
Eliezer 14y ago
Wow. That's... we're lucky Homo sapiens didn't get its intelligent species license revoked for this.
- krapp 14y ago
  The notice of our species' Sapience Rating revocation has been on display at our local planning department on Alpha Centauri for 50 years now....
lucb1e 14y ago
I've seen some company's code that generated captchas too. It were the first 5 characters of md5 output of rand(1,1000)...
davidroberts 14y ago
D&B executive's spouse: You've really got to help my little brother. He hasn't had a job since he got fired from McDonald's two years ago. Executive: What can he do? Spouse: He's really good at programming. He took a class in it in high school five years ago, and I'm pretty sure he didn't fail. He even has his own web page. Executive: Hmmmmm. I think we have something he can work on....
superdude 14y ago
One of my buddies worked in the accounting department at our state government. He needed to get a bunch of documents from another agency (like hundreds every month) to process claims. Well this other agency requires everyone to go through their website and download each document one at a time. They said it was to prevent abuse. For some reason they couldn't just send a batch of them to us, even a fellow state agency. So I made a scraper to download an entire month at a time. I figure it was a webforms site because it was filled with postbacks and viewstates which made it a bit of a pain, but the ridiculous thing was the CAPTCHA code: <input name="actualSpoofValue" type="hidden" id="actualSpoofValue" value="TFU3P"> and TFU3P was the CAPTCHA code!
- pavel_lishin 14y ago
 Isn't that one ambitious DA away from being a felony these days?
 - civilian 14y ago
 Batman: You either die a hero or live long enough to see yourself become the villain. I can do those things. Because I'm not a hero, not like Dent. I killed those people. That's what I can be. Lt. James Gordon: No, no, you can't! You're not! Batman: I'm whatever Gotham needs me to be. [cut to Gordon at Dent's funeral] Lt. James Gordon: A hero. Not the hero we deserved but the hero we needed. Nothing less than a knight. Shining. [Gordon is shown on top of Gotham Central. An axe is in his hand. He is being watched by an assortment of reporters and police officers. The next lines are heard in voiceover] Lt. James Gordon: They'll hunt you. Batman: You'll hunt me. You'll condemn me. Set the dogs on me.
 - superdude 14y ago
 No, it was publicly accessible information from a public-facing website.
 - ivix 14y ago
 Since when was that a defence? You circumvented COMPUTER SECURITY on a GOVERNMENT WEBSITE. This is how the judge will see it.
dreamfactory 14y ago
I like the fact that it is case-sensitive and yet instructs to be typed in ALL CAPS :)
rsobers 14y ago
I love the use of the and tags, too.
- stan_rogers 14y ago
 is valid in HTML, and different from . It's actually being used correctly here.
 - saraid216 14y ago
 It's valid, but it's one of those things that shows they're not a web developer. We don't use or anymore. That's what CSS is for.
 - zopticity 14y ago
 Nope, you're wrong. is actually still being used to differentiate between . is used for accessibility reasons (making the words enunciate with emphasis, while just makes the words bold by default). If you want to bold a part of the sentence without having emphasis, you'll need to use .
 - Evbn 14y ago
 What's the difference between and . Em is for emphasis.
 stan_rogers 14y ago
 is for intonational emphasis, the way you'd give a little extra stress on a word when you are speaking. is an indicator of importance, and may not correspond to intonational emphasis in spoken language. As for the older tags, they were deprecated in XHTML, but have been redeemed in HTML 5. is used for elements that are traditionally set it italics but are neither emphasized nor citations. Often that will be foreign words (where one ought to use a lang attribute). Similarly is used to indicate elements that are traditionally set in bold face, but which do not indicate importance (as headings or in running text would do). Both are better than the semantically-meaningless tag, and vastly better than misusing the , <cite> and tags for their presentation effects.
ericz 14y ago
You know, maybe it's because they just wanted to slow down legitimate users for some reason, and spam wasn't a big problem. Ok I'm just trying to be optimistic.
bjoe_lewis 14y ago
D&B. Trolled.
dmazin 14y ago
Speaking of, has anyone else noticed that captchas (especially recaptcha) have gotten a lot harder over the last year?
- nlh 14y ago
  I have indeed. Anyone have more details? At one point I recall (re)CAPTCHAs being about helping OCR slightly less-readable words from book scans. But they were actual words. They seem to be gibberish words now.
  - SolarNet 14y ago
    Maybe they ran out of non-gibberish readable things to OCR?
  - deleted 14y ago
    [deleted]
- malandrew 14y ago
  I've noticed that they occasionally have characters that are available in unicode, but are not part of the characters that are available on a 105-key keyboard with or without the shift key. THe most common one I see is the integral symbol that used to be used as an S. On very rare occasions I see characters like: ¡™£¢∞§¶•ªº–≠œ∑®†¥øπ«åß∂ƒ©˙∆˚¬…æΩ≈ç√∫˜µ≤≥÷⁄€‹›ﬁﬂ‡°·‚—±Œ„´‰ˇÁ¨ˆØ∏»ÅÍÎÏ˝ÓÔÒÚÆ¸˛Ç◊ı˜Â¯˘¿
  - codesuela 14y ago
    Those are the ones googles OCR couldn't decipher. Only one word (the random characters with a asymmetric background and maybe a line through them) matter. Once you know that you stop typing the part that doesn't matter. I usually just type asd (actual captcha)
JoaquinRoca 14y ago
This is hilariously awful. Thanks for sharing. I recently moved all my CAPTCHAs to games with AreYouAHuman.com and I love it.
polskibus 14y ago
this should be submitted to thedailywtf.com
brevityness 14y ago
One odd quirk I've noticed with CAPTCHA's is that requesting a new one almost always returns one that is far more legible to discern. Is this by design?
don_draper 14y ago
Hey D&B developer here. I'm excited to see so much interest in my work. If the captcha is correct we categorize it as a bot and don't let it through. If the captcha is incorrect then it must be a human and we let them through. Good news: we're hiring! We have day long meetings Mondays and Wednesdays, but other than that it's great.
- aprescott 14y ago
  I don't really understand this approach. Won't the false positive rate be close to 100%? Humans are going to get the captcha right every time. If it's supposed to be a honeypot system, the input should be hidden from human users to avoid that problem.
  - bjxrn 14y ago
    Pssst. I don't think that was seriously a post from a D&B developer.
    - aprescott 14y ago
      Damn you, Poe! :(
  - Groxx 14y ago
    The last "I" and "I" are swapped with CSS. Bots don't realize this, but humans do.
1bitwonder 14y ago
I've seen one where it was always: "What is 2+4?"
- Jeremy1026 14y ago
  I put a super basic human authentication system on my wedding website in the online guestbook. It was just a simple form that was getting hit with spammers, so I added a super quick "What is the groom's name?" field to the form for authentication. Spam stopped completely. Sometimes, depending on the website, a super secure captcha isn't needed.
njbooher 14y ago
Wrong. The worst CAPTCHA ever is http://www.solvemedia.com/ http://www.solvemedia.com/
jpdoctor 14y ago
LOL. So someone is doing automated lookups on the D&B site, they noticed, and then they put a broken captcha on the site. Really, the only thing wrong with this picture is that they got called out on HN, so now whoever is doing the automated lookups won't be able to kill off D&B by releasing their information.
smegel 14y ago
Security by "no one would be that stupid"
meistro 14y ago
Two years ago I had to deal D&B's flagship product, which came packaged in a Java applet. I remember one day I upgraded to the latest version of Java(a security patch) and it broke their tool. After contacting them they said the only solution was to downgrade to the Java version with a known security hole...
pkulak 14y ago
I find it hard to believe that you could be smart enough to build something like this, while also being dense enough to think that it's actually a CAPTCHA. My guess is that some pointy-haired boss really wanted a CAPTCHA and the developer didn't think it was needed. Everyone's happy. Of course, the developer could have also just slapped RECAPTCHA on there and been done in even less time...
L0j1k 14y ago
This should give you a really good idea what it's like trying to get a DUNS number (a requirement for doing contract work with the government as a business). Their entire business is basically the front-end to a scam. Somebody pulled a network contact to wedge their company in between businesses and the federal government. You are guaranteed to get scammy-sounding emails and phone calls from D&B after signing up. Emails with subjects like "Your business is in danger!" or messages like "Your business credit report has some big issues!" and you find out that in order to get "protection" or to find out what these "issues" are, you have to pay Dun and Bradstreet a shitload of money. That company is a SCAM and a perfect example of how completely retarded/bought-and-paid-for the United States government is.
- dsl 14y ago
  They have the same slimy up sell tactics as every other credit reporting agency, but the core business is far from a scam. The startup crowd doesn't see it much, but D&B is a critical component of how non-technical medium to large businesses vet each other and prevent fraud. They are effectively the Better Business Bureau for B2B.
- harryh 14y ago
  It's not just contract work with the government. Once you are a business of sufficient size it's almost inevitable that you'll run into some random thing where you're required to have a DUNS number before proceeding (and it's always unclear why this is a requirement). So dumb.
ed2417 14y ago
Your data will be safe with us!
cefarix 14y ago
My company got a couple of emails from a "credit advisor" Stacy at D&B with no subject. Then in the third email, from the same person... the email was typed out in the subject and there was no body. facepalm
rhapsodyv 14y ago
https://gist.github.com/rhapsodyv/5279369/raw/88af15fdba655b01db0cfe896a5376d033511fd2/gistfile1.txt https://gist.github.com/rhapsodyv/5279369/raw/88af15fdba655b... This is a cpf (something like social security number in brazil) validator from this site: http://via7solucoes.com.br/curriculos/cadastro.asp http://via7solucoes.com.br/curriculos/cadastro.asp
drakaal 14y ago
D&B is in the business of selling your corporate data to marketing companies. They claim that they never share their data base in an automated way, and to protect this information, so that it is only human readable but it is in their best interest to let companies have access. Likely this is there to allow miners, not specifically because they are incompetent, but because they are dishonest.
jmotion 14y ago
Thing is, this will actually stop most contact form spam software.
exodust 14y ago
I don't see the problem. It's easy for people to see the word and type it in. Lightweight but not insignificant measure of protection. Compared with no protection, this form will receive less spam. There is no impact on the user except a better user experience. The corporate developer may have looked at the spam levels and decided that a basic measure would be fine considering the exposure to the page, or other reasons. CAPTCHA is anti-people. It's a step back to the dark ages every time a website asks you to type in a fuzzy word, often just a jumbled string making it even worse for reading. Surprised some comments are taking aim at the developer, who at least isn't using the stupidly backwards, barely visible full version of captcha. Check en.wikipedia.org/wiki/CAPTCHA it's a joke that the examples posted there seem so much easier than the overly-abstract usual suspects out there in reality. That wikipedia article needs a new section, something like 'criticisms' or 'UX Fail'. D&B's 'captcha' is whack? So is Google's.
- WatchDog 14y ago
  Why even bother adding the background image if you are just trying to stop dumb spam crawlers.
  - exodust 14y ago
    Very true, why indeed. A misunderstanding of how spam crawlers work? Btw, how do spam crawlers work? People must prove they are people. And spam crawlers don't need to prove anything. Turing wouldn't have liked his name associated with a test that humans fail often (needing to refresh the captcha), and a test that machines must fail in order to be effective.
petercoolz 14y ago
I hate hate hate D&B. so scammy and spammy and worthless. I think their corporate structure reflects the scam... One company issues the DUNS # but another is the telemarketing spammy one that calls you for years afterward.
heroic 14y ago
Beats this! http://www.hmv-news.co.uk/register.php http://www.hmv-news.co.uk/register.php
aragot 14y ago
That's an April Fools! ...or isn't it?

346 points by ZeljkoS 14y ago

Well, it is a good way to tell computers and humans apart. Computers can read it, while humans can't. They should reject corectly filled in captchas.

fosap 14y ago
That's a great idea. If i was ever to create a product for colorblinds only i'd use that.
- ihsw 14y ago
  It's not an uncommon strategy (eg: fill up a comment form with hidden but obviously named form fields) and since people won't be filling in those hidden fields then bots will have revealed themselves. This isn't by any means a complete solution however it does catch 90% of drive-by spam.
  - philipDS 14y ago
    Yup, this is also known as the Honeypot Captcha technique: http://haacked.com/archive/2007/09/11/honeypot-captcha.aspx http://haacked.com/archive/2007/09/11/honeypot-captcha.aspx
  - dEnigma 14y ago
    That's an interesting approach, but I guess as soon as it would become mainstream, the bots would adapt without many problems.
    - NickNameNick 14y ago
      Depending on how the fields were hidden, they may need to render and reflow html, css and dom changes by javascript. None of which is all that difficult for a full size browser, but it may be prohibitively resource intensive for a high-volume spam bot.
      - Bromskloss 14y ago
        Lynx. :-(
  - eli 14y ago
    Careful! There are legitimate toolbars that will helpfully prefill forms, sometimes even hidden fields. I've been bitten by this in production.
wyck 14y ago
Well maybe they are really good and this is a honeypot.
deleted 14y ago
[deleted]
laurent123456 14y ago
You'd think, but what's so dumb about this captcha is that it's both easy to guess for a computer, but for a human too. If you look at it, the random parts are outside the readable text (which is just white on a gray background). I'd love to know what led to the "decision" of implementing something so dumb.
- eCa 14y ago
  The text has been selected, hence the single-colour backhround.
- lutze 14y ago
  You're missing the point bud, it's not that it's easy to guess, it's that the answer is in the bloody HTML as plaintext. No guessing required.
fakeer 14y ago
I still loathe reCAPTCHA more than any other captcha out there. I've given up hopes of logging in on many occasions simply because of it. Looks like it's designed for not to be deciphered either by humans or computers.
- reeses 14y ago
  It started so well, as a tool to harness collective 'intelligence' to digitize text while preventing spam. Now you're right, even the bloody accessible (audio) versions are useless. It's as if a dozen poltergeists are whispering in your ear, and you have to pick out the one that matters.
- kristofferR 14y ago
  I actually think reCAPTCHA has gotten quite good actually after they switched one of the words to a street address. Just look at the examples in this post, most are pretty easy to decode right away. http://techcrunch.com/2012/03/29/google-now-using-recaptcha-to-decode-street-view-addresses/ http://techcrunch.com/2012/03/29/google-now-using-recaptcha-...
- senthilnayagam 14y ago
  I totally agree, see this recaptcha which is upside down, how are we supposed to read it http://postimg.org/image/7xgovvhij/ http://postimg.org/image/7xgovvhij/
  - dEnigma 14y ago
    This is a joke, right? Everbody should be able to read upside down text. In any way, only the distorted word counts, so it doesn't matter.
  - dhughes 14y ago
    I saw a mirror image d once.
  - deleted 14y ago
    [deleted]
  - 14y ago

mschuster91 14y ago

D&B?! Aren't these the guys everyone including Apple trusts for their DUNS number?! Are you fucking serious?

mzahir 14y ago
Exactly. They're not the people everybody trusts to determine if incoming traffic is human/machine. Your response implies that they are inept at their area of expertise.
- SoftwareMaven 14y ago
  It's relevant if being able to automate the connection allows you to circumvent the checks Apple, et al, have put in place with the DUNS number. I have no clue, so I can't render an opinion.
- mschuster91 14y ago
  The shown website development bug does not make me confident about the quality of the rest of their website and data handling in general, so yes, I imply that they are not up to protect the data of their customers - which is the area of expertise of anyone handling massive amount of customer data.
spikels 14y ago
D&B has got itself a sweet little monopoly business with these DUNS numbers. They charge $299 if you want "Expedited" service otherwise (according to the FAQ) it will take "a MINIMUM of 30 business days for a new D&B DUNS Number to be processed" (emphasis added). I get the sense they just sit on you app until the 30 days are up and no actual work is being done. They also try to upsell you to one of the many other plans starting at $299. To somewhat soften their touch the basic service is free after all. And the expedited service is free for businesses considering doing government contracting (maybe we should all consider this as we apply to the Apple developer program). https://iupdate.dnb.com/iUpdate/showFaq.htm#Request2 https://iupdate.dnb.com/iUpdate/showFaq.htm#Request2

thomaslutz 14y ago

I thought you meant the reCaptcha Audio-Version (unsolvable for humans after it got broken a few times). This is just hilarious.

codesuela 14y ago

While this captcha is truly a display of ignorance I could imagine that "corporate developers" at D&B aren't web developers. All I am saying is that if you force me to write enterprise software (which I have zero experience with) on a tight schedule I'm probably going to make a stupid mistake or two even though I hope I am not of "lower quality". I imagine someone in management refused to hire web devs because "we've already got developers inhouse". Just a wild guess though.

rytis 14y ago
What is this thing that people call "enterprise software"?
- Semaphor 14y ago
  According to the internet it's badly written, extremely slow and very expensive software that will only get replaced after 20-50 years of use.
  - LeeHunter 14y ago
    On the bright side, most enterprise software projects never actually get put into production.
  - thirsteh 14y ago
    That's actually fairly accurate.
  - dmix 14y ago
    Also written by a massive team with factory-like division of responsibilities.
  - mzahir 14y ago
    Haha, sadly the vast majority doesn't last past 6 years due to EOL on various components and inflexibility to changing business requirements. A more common need is the ability to have a scapegoat / fall-guy for failures of projects that have unrealistic/arbitary requirements and/or deadlines set by an upper management that is no longer in touch with technology.

unlucky 14y ago

Seems almost too simple... I feel like I am being tricked.

ef4 14y ago

A wonderful example of cargo cult programming.

sabe__ 14y ago
It's like all these sites that requires you to enter your current password before you can change it, but deleting the entire account is just ticking a check box (at least twitter and dribbble worked this way back when I had accounts there). Some things we been doing for so long that we forget why we do them at all.
- nostrademons 14y ago
  Or ones that make you confirm an e-mail address by entering it twice. The reason you confirm a password is because you can't see the password, and so you never know if you mistyped it. Confirming an e-mail address, in a normal text field, is just stupid busywork.
  - improv32 14y ago
    Or when you enter bad login info, and the site doesn't tell you if it was your email or your password. But on the reset password form it tells you when you put a bad email in.
    - nostrademons 14y ago
      Well, that's usually a security feature so that hackers can't harvest valid accounts by trying e-mail addresses and seeing what the error message is. It's stupid if they can do that anyway via the password reset form, though (although presumably, if you get the password reset e-mail you'll have an idea that someone else is trying to access your account).
      - goldfeld 14y ago
        Or the reset password form can simply say an email has been sent to the relevant address, regardless of whether said address actually exists in their database. I've always suspected this is how most of them work.

natemcguire 14y ago

After the D&B signup process, well, I am not surprised.

ricardoz17 14y ago

Twitter does something similar with 3rd-party authentication. The user puts in their name and password but then the rest of the process can be done by a bot. 1. click on a button to confirm granting access 2. provide the code in an image to he App but the HTML for the code hass the following: Next, return to TrainerLists and enter this PIN to complete the authorization process: <kbd aria-labelledby="code-desc"><code>7996044</code>

iambibhas 14y ago

Somebody is gonna get fired.

nelse 14y ago

That reminded me the captcha I got some time ago: http://24.media.tumblr.com/tumblr_lvy7sl13MV1r839zio1_500.png http://24.media.tumblr.com/tumblr_lvy7sl13MV1r839zio1_500.pn...

jmorton 14y ago

But wait, how else would you make the automated tests pass?

geoffroy 14y ago
lol
tomjen3 14y ago
Stub the captcha generator with one that returns a known value...

d23 14y ago

Funny coincidence, I ran into this on another website yesterday. And if it weren't bad enough that it was printed in plain text in the source code, it was only checked client side with javascript. Seriously?

kevin_p 14y ago
Just because something is checked client-side doesn't mean it's only checked client-side. I've used JS checking on anti-bot questions[1] quite deliberately: it doesn't have any effect on 99%+ of bots, but it stops posts by humans from accidentally being flagged as spam. [1] admittedly questions like "type someword in this box to prove you're not a spambot"[2] rather than actual captchas, which I agree would be rather silly. [2] if this is what you meant by a "printed in plain text in the source code" question, remember that most spambots aren't customised to an individual site, they just roam the internet submitting their crap to anything that looks like a comment form. Sure, it's trivial to write a script to parse the page and find the answer to the question - but nobody's actually going to do that for a typical company's "Contact Us" form. Adding this sort of check cuts down on spam enormously (from hundreds a day to zero), and is way easier for humans than solving a captcha.
- __david__ 14y ago
  > admittedly questions like "type someword in this box to prove you're not a spambot" rather than actual captchas, which I agree would be rather silly. This is not silly. This works extremely well for the low traffic forum I run. Since there are a huge number of phpbb3 forums out there, spammers have made spam bots specifically targeting the platform. If you make your forum epsilon different from the default then the bots don't work without manual intervention. That's enough to keep you off of autospam lists for very, very long periods of time. And when someone inevitably adds your extra form element to their spam bot (it's happened to me 2 or 3 times over about 6 years) then you just change the answer and it stops working (and they might not even notice since it's a bot).
  - wilfra 14y ago
    Same! I was getting 50+ spambots a day registering to my vbulletin forum, even with a really hard captcha. I changed it to a question any eight year old could answer and I instantly went to less than one spambot per week getting through. Easier for users and nearly eliminated my spam problem, win-win.

GuriK 14y ago

Have a fun guys ... http://pro.sony.com/bbsc/jsp/forms/generateCaptcha.jsp http://pro.sony.com/bbsc/jsp/forms/generateCaptcha.jsp

metaphorm 14y ago
too easy. try again.  <div id="captchdiv" style="position:absolute; left:10; top:15;"> <TABLE BORDER="0" CELLSPACING="0" WIDTH="170" height="30"> <tr> <td width="34" align="center" valign="top"> L</td> <td width="34" align="center" valign="bottom"> K</td> <td width="34" align="center" valign="top"> T</td> <td width="34" align="center" valign="bottom"> F</td> <td width="34" align="center"> B</td> </tr> </table></div>
dEnigma 14y ago
Oh no! I can't rightclick so how can I possibly look at the source code xD

qntmfred 14y ago

see also: http://i.imgur.com/G8fV1IV.jpg http://i.imgur.com/G8fV1IV.jpg

robbyking 14y ago

I've worked for managers who would've ask for features like this; they just wanted it to look like it functioned so our non-technical audience would think it was impressive.

niggler 14y ago

How do audio captchas compare to the visual ones? Is it harder or easier for a computer to crack / people to understand ?

dEnigma 14y ago
Audio captchas are pretty hard to solve for me personally, much harder than even almost unreadable Captchas. But maybe that's just me. Still can't imagine a bot solving the audio captchas I've heard though. Edit: Just listen to it: https://www.google.com/recaptcha/demo/ https://www.google.com/recaptcha/demo/
- niggler 14y ago
  That is awful. In most of the triplets, the middle sound is completely drowned out by the noise
  - krapp 14y ago
    That may have to do with it having been hacked before: http://arstechnica.com/security/2012/05/google-recaptcha-brought-to-its-knees/ http://arstechnica.com/security/2012/05/google-recaptcha-bro...
  - codesuela 14y ago
    Wow yes I agree first time I hear reCAPTCHA. I am seriously wondering whether ANYBODY is able to solve this. I know it was broken before but now it seems reCaptchaing something means straight up denying it to visually impaired people.

6ren 14y ago

Every expense was spared to give the impression that no expense had been spared. It's a credit report site; they want you to think they are secure.

dornab 14y ago
Exactly. It probably increases conversion because it looks secure. Credit card forms are sometimes used that way too, they get a lot of extra information because if they don't, people feel that they're scammy.
- krapp 14y ago
  But surely a working captcha would increase conversion as well and have the added benefit of being a captcha?
  - just2n 14y ago
    And you really have to wonder, because the last time I had to implement a CAPTCHA (around 5 years ago), it was about 5 minutes of work. Google query, found a library, downloaded the library, copied the example into a form, and I was done. I can't imagine coming up with your own clever hacked-together bogus CAPTCHA would be simpler than that. So they actually did it the hard way?
Draco6slayer 14y ago
That's a Douglass Adams quote, isn't it?

d0m 14y ago

There are different levels of "captcha". Some bots just fill any forms on any sites with their spam.. a simple client-side question goes a long way to mitigate this. It obviously is a very different story if it's a script created especially for this form.

Eliezer 14y ago

Wow. That's... we're lucky Homo sapiens didn't get its intelligent species license revoked for this.

krapp 14y ago
The notice of our species' Sapience Rating revocation has been on display at our local planning department on Alpha Centauri for 50 years now....

lucb1e 14y ago

I've seen some company's code that generated captchas too. It were the first 5 characters of md5 output of rand(1,1000)...

davidroberts 14y ago

D&B executive's spouse: You've really got to help my little brother. He hasn't had a job since he got fired from McDonald's two years ago. Executive: What can he do? Spouse: He's really good at programming. He took a class in it in high school five years ago, and I'm pretty sure he didn't fail. He even has his own web page. Executive: Hmmmmm. I think we have something he can work on....

superdude 14y ago

One of my buddies worked in the accounting department at our state government. He needed to get a bunch of documents from another agency (like hundreds every month) to process claims. Well this other agency requires everyone to go through their website and download each document one at a time. They said it was to prevent abuse. For some reason they couldn't just send a batch of them to us, even a fellow state agency. So I made a scraper to download an entire month at a time. I figure it was a webforms site because it was filled with postbacks and viewstates which made it a bit of a pain, but the ridiculous thing was the CAPTCHA code: <input name="actualSpoofValue" type="hidden" id="actualSpoofValue" value="TFU3P"> and TFU3P was the CAPTCHA code!

pavel_lishin 14y ago
Isn't that one ambitious DA away from being a felony these days?
- civilian 14y ago
  Batman: You either die a hero or live long enough to see yourself become the villain. I can do those things. Because I'm not a hero, not like Dent. I killed those people. That's what I can be. Lt. James Gordon: No, no, you can't! You're not! Batman: I'm whatever Gotham needs me to be. [cut to Gordon at Dent's funeral] Lt. James Gordon: A hero. Not the hero we deserved but the hero we needed. Nothing less than a knight. Shining. [Gordon is shown on top of Gotham Central. An axe is in his hand. He is being watched by an assortment of reporters and police officers. The next lines are heard in voiceover] Lt. James Gordon: They'll hunt you. Batman: You'll hunt me. You'll condemn me. Set the dogs on me.
- superdude 14y ago
  No, it was publicly accessible information from a public-facing website.
  - ivix 14y ago
    Since when was that a defence? You circumvented COMPUTER SECURITY on a GOVERNMENT WEBSITE. This is how the judge will see it.

dreamfactory 14y ago

I like the fact that it is case-sensitive and yet instructs to be typed in ALL CAPS :)

rsobers 14y ago

I love the use of the and tags, too.

stan_rogers 14y ago
 is valid in HTML, and different from . It's actually being used correctly here.
- saraid216 14y ago
 It's valid, but it's one of those things that shows they're not a web developer. We don't use or anymore. That's what CSS is for.
 - zopticity 14y ago
 Nope, you're wrong. is actually still being used to differentiate between . is used for accessibility reasons (making the words enunciate with emphasis, while just makes the words bold by default). If you want to bold a part of the sentence without having emphasis, you'll need to use .
 - Evbn 14y ago
 What's the difference between and . Em is for emphasis.
 - stan_rogers 14y ago
 is for intonational emphasis, the way you'd give a little extra stress on a word when you are speaking. is an indicator of importance, and may not correspond to intonational emphasis in spoken language. As for the older tags, they were deprecated in XHTML, but have been redeemed in HTML 5. is used for elements that are traditionally set it italics but are neither emphasized nor citations. Often that will be foreign words (where one ought to use a lang attribute). Similarly is used to indicate elements that are traditionally set in bold face, but which do not indicate importance (as headings or in running text would do). Both are better than the semantically-meaningless tag, and vastly better than misusing the , <cite> and tags for their presentation effects.

ericz 14y ago

You know, maybe it's because they just wanted to slow down legitimate users for some reason, and spam wasn't a big problem. Ok I'm just trying to be optimistic.

bjoe_lewis 14y ago

D&B. Trolled.

dmazin 14y ago

Speaking of, has anyone else noticed that captchas (especially recaptcha) have gotten a lot harder over the last year?

nlh 14y ago
I have indeed. Anyone have more details? At one point I recall (re)CAPTCHAs being about helping OCR slightly less-readable words from book scans. But they were actual words. They seem to be gibberish words now.
- SolarNet 14y ago
  Maybe they ran out of non-gibberish readable things to OCR?
- deleted 14y ago
  [deleted]
malandrew 14y ago
I've noticed that they occasionally have characters that are available in unicode, but are not part of the characters that are available on a 105-key keyboard with or without the shift key. THe most common one I see is the integral symbol that used to be used as an S. On very rare occasions I see characters like: ¡™£¢∞§¶•ªº–≠œ∑®†¥øπ«åß∂ƒ©˙∆˚¬…æΩ≈ç√∫˜µ≤≥÷⁄€‹›ﬁﬂ‡°·‚—±Œ„´‰ˇÁ¨ˆØ∏»ÅÍÎÏ˝ÓÔÒÚÆ¸˛Ç◊ı˜Â¯˘¿
- codesuela 14y ago
  Those are the ones googles OCR couldn't decipher. Only one word (the random characters with a asymmetric background and maybe a line through them) matter. Once you know that you stop typing the part that doesn't matter. I usually just type asd (actual captcha)

JoaquinRoca 14y ago

This is hilariously awful. Thanks for sharing. I recently moved all my CAPTCHAs to games with AreYouAHuman.com and I love it.

polskibus 14y ago

this should be submitted to thedailywtf.com

brevityness 14y ago

One odd quirk I've noticed with CAPTCHA's is that requesting a new one almost always returns one that is far more legible to discern. Is this by design?

don_draper 14y ago

Hey D&B developer here. I'm excited to see so much interest in my work. If the captcha is correct we categorize it as a bot and don't let it through. If the captcha is incorrect then it must be a human and we let them through. Good news: we're hiring! We have day long meetings Mondays and Wednesdays, but other than that it's great.

aprescott 14y ago
I don't really understand this approach. Won't the false positive rate be close to 100%? Humans are going to get the captcha right every time. If it's supposed to be a honeypot system, the input should be hidden from human users to avoid that problem.
- bjxrn 14y ago
  Pssst. I don't think that was seriously a post from a D&B developer.
  - aprescott 14y ago
    Damn you, Poe! :(
- Groxx 14y ago
  The last "I" and "I" are swapped with CSS. Bots don't realize this, but humans do.

1bitwonder 14y ago

I've seen one where it was always: "What is 2+4?"

Jeremy1026 14y ago
I put a super basic human authentication system on my wedding website in the online guestbook. It was just a simple form that was getting hit with spammers, so I added a super quick "What is the groom's name?" field to the form for authentication. Spam stopped completely. Sometimes, depending on the website, a super secure captcha isn't needed.

njbooher 14y ago

Wrong. The worst CAPTCHA ever is http://www.solvemedia.com/ http://www.solvemedia.com/

jpdoctor 14y ago

LOL. So someone is doing automated lookups on the D&B site, they noticed, and then they put a broken captcha on the site. Really, the only thing wrong with this picture is that they got called out on HN, so now whoever is doing the automated lookups won't be able to kill off D&B by releasing their information.

smegel 14y ago

Security by "no one would be that stupid"

meistro 14y ago

Two years ago I had to deal D&B's flagship product, which came packaged in a Java applet. I remember one day I upgraded to the latest version of Java(a security patch) and it broke their tool. After contacting them they said the only solution was to downgrade to the Java version with a known security hole...

pkulak 14y ago

I find it hard to believe that you could be smart enough to build something like this, while also being dense enough to think that it's actually a CAPTCHA. My guess is that some pointy-haired boss really wanted a CAPTCHA and the developer didn't think it was needed. Everyone's happy. Of course, the developer could have also just slapped RECAPTCHA on there and been done in even less time...

L0j1k 14y ago

This should give you a really good idea what it's like trying to get a DUNS number (a requirement for doing contract work with the government as a business). Their entire business is basically the front-end to a scam. Somebody pulled a network contact to wedge their company in between businesses and the federal government. You are guaranteed to get scammy-sounding emails and phone calls from D&B after signing up. Emails with subjects like "Your business is in danger!" or messages like "Your business credit report has some big issues!" and you find out that in order to get "protection" or to find out what these "issues" are, you have to pay Dun and Bradstreet a shitload of money. That company is a SCAM and a perfect example of how completely retarded/bought-and-paid-for the United States government is.

dsl 14y ago
They have the same slimy up sell tactics as every other credit reporting agency, but the core business is far from a scam. The startup crowd doesn't see it much, but D&B is a critical component of how non-technical medium to large businesses vet each other and prevent fraud. They are effectively the Better Business Bureau for B2B.
harryh 14y ago
It's not just contract work with the government. Once you are a business of sufficient size it's almost inevitable that you'll run into some random thing where you're required to have a DUNS number before proceeding (and it's always unclear why this is a requirement). So dumb.

ed2417 14y ago

Your data will be safe with us!

cefarix 14y ago

My company got a couple of emails from a "credit advisor" Stacy at D&B with no subject. Then in the third email, from the same person... the email was typed out in the subject and there was no body. facepalm

rhapsodyv 14y ago

https://gist.github.com/rhapsodyv/5279369/raw/88af15fdba655b01db0cfe896a5376d033511fd2/gistfile1.txt https://gist.github.com/rhapsodyv/5279369/raw/88af15fdba655b... This is a cpf (something like social security number in brazil) validator from this site: http://via7solucoes.com.br/curriculos/cadastro.asp http://via7solucoes.com.br/curriculos/cadastro.asp

drakaal 14y ago

D&B is in the business of selling your corporate data to marketing companies. They claim that they never share their data base in an automated way, and to protect this information, so that it is only human readable but it is in their best interest to let companies have access. Likely this is there to allow miners, not specifically because they are incompetent, but because they are dishonest.

jmotion 14y ago

Thing is, this will actually stop most contact form spam software.

exodust 14y ago

I don't see the problem. It's easy for people to see the word and type it in. Lightweight but not insignificant measure of protection. Compared with no protection, this form will receive less spam. There is no impact on the user except a better user experience. The corporate developer may have looked at the spam levels and decided that a basic measure would be fine considering the exposure to the page, or other reasons. CAPTCHA is anti-people. It's a step back to the dark ages every time a website asks you to type in a fuzzy word, often just a jumbled string making it even worse for reading. Surprised some comments are taking aim at the developer, who at least isn't using the stupidly backwards, barely visible full version of captcha. Check en.wikipedia.org/wiki/CAPTCHA it's a joke that the examples posted there seem so much easier than the overly-abstract usual suspects out there in reality. That wikipedia article needs a new section, something like 'criticisms' or 'UX Fail'. D&B's 'captcha' is whack? So is Google's.

WatchDog 14y ago
Why even bother adding the background image if you are just trying to stop dumb spam crawlers.
- exodust 14y ago
  Very true, why indeed. A misunderstanding of how spam crawlers work? Btw, how do spam crawlers work? People must prove they are people. And spam crawlers don't need to prove anything. Turing wouldn't have liked his name associated with a test that humans fail often (needing to refresh the captcha), and a test that machines must fail in order to be effective.

petercoolz 14y ago

I hate hate hate D&B. so scammy and spammy and worthless. I think their corporate structure reflects the scam... One company issues the DUNS # but another is the telemarketing spammy one that calls you for years afterward.

heroic 14y ago

Beats this! http://www.hmv-news.co.uk/register.php http://www.hmv-news.co.uk/register.php

aragot 14y ago

That's an April Fools! ...or isn't it?