Shouldn't using something sensing the movement of a mouse cursor be enough as a captcha? If no mouse movement is detected, fall back to a text input captcha.
This wouldn't catch browser based automation, using selenium for instance.
How to Smell Difference Between Humans & Robots - Annoying Captcha Forms
11–20 of 29 posts
Re: How to Smell Difference Between Humans & Robots - Annoying Captcha Forms
#12This is a great idea. The point is merely to provide an alternative to an explicit CAPTCHA that requires interaction like reCAPTCHA that doesn't cost less to try and break. That way, it's strictly more convenient to the user, if they use autofill or whatever, they'll just be subject to the ordinary reCAPTCHA that they would be anyway. I'm imagining listening to mousemove on the document and doing something lightweigh…
If it's in JavaScript it's trivial for me to hack on the client side, and if you insist on mouse movements I can just send along a prerecorded array of mouse moves before my request. Maybe even tweak a few every time, so you don't catch on right away. It's more trouble than it's worth.
Re: How to Smell Difference Between Humans & Robots - Annoying Captcha Forms
#13One big issue that nobody is talking about here: There is a huge increase in networks using cheap labor to solve CAPTCHAs. A service like decaptcher.com can have humans solve CAPTCHAs at the rate of $2/1000.
At that kind of price, all of the effort you go to to prevent automated signups is useless -- it's just being outsourced to humans, where these counter-measures are ineffective.
Re: How to Smell Difference Between Humans & Robots - Annoying Captcha Forms
#14> I tend to include text fields (later visually hidden or obscured with Javascript) with "name" parameters like "email", "url" and "name". Spam bots always fill these in. Your users won't, because the fields are hidden. If the fields are filled in, your submission came from a spambot. Easy!
Fuck every website that does this. It's 2011, we should all be using password managers. If using LastPass makes your site flag me as a robot, I'm not going to use it.
CAPTCHAs are like crypto: Don't roll your own unless you have good reason to and know what you're doing. Just throw in reCaptcha, or Mollom, or (preferably) some crowd-sourced solution that leverages your userbase (the best way that will scale, imo).
Re: How to Smell Difference Between Humans & Robots - Annoying Captcha Forms
#15Good ole stackoverflow - close topics that may bring new ideas for turing tests. The entire thread has a number of good ideas and relates to a thread you started the other day. http://news.ycombinator.com/item?id=2107972 Pity that it didn't get more traction.
A lot of them are pretty bad ideas once you think about them for more than a few minutes.
Mouse movements and clicks are easily emulated - just look at the mass of bots for online games. There's actually quite a large industry based around selling bots that can be used for goldfarming.
Keyboard events are similarly easy. It's very easy to write a function that separates keypresses with human-like pauses.
Also - many of these ideas have severe accessibility drawbacks. Touchscreens, for example, do not emit mouse move events like a mouse. Voice input will not act like a keyboard and may look like the user has pasted into the input box.
Re: How to Smell Difference Between Humans & Robots - Annoying Captcha Forms
#16Good ole stackoverflow - close topics that may bring new ideas for turing tests. The entire thread has a number of good ideas and relates to a thread you started the other day. http://news.ycombinator.com/item?id=2107972 Pity that it didn't get more traction.
I know we're supposed to be all starry-eyed about "the wisdom of the crowds" and all that, but I have trouble to believe that a random bunch of Stack Overflowers are going to come up with anything truly interesting in a field that already has the serious attention of researchers at Google and Microsoft Research.
Re: How to Smell Difference Between Humans & Robots - Annoying Captcha Forms
#17Jeff Atwood has mentioned in his coding horror blog a few times the idea of an internet license - using Facebook, Google etc. as a credential. Could this not be extended to anonymous comments, but requiring authentication against a real ID?
Re: How to Smell Difference Between Humans & Robots - Annoying Captcha Forms
#18> I tend to include text fields (later visually hidden or obscured with Javascript) with "name" parameters like "email", "url" and "name". Spam bots always fill these in. Your users won't, because the fields are hidden. If the fields are filled in, your submission came from a spambot. Easy! Fuck every website that does this. It's 2011, we should all be using password managers. If using LastPass makes your site flag m…
I use the same trick but instead of calling it name, url or email I just think of something which won't be used anywhere else. Last time I did it I called the field do_you_like_{site_name}. No more bots and no humans hurt.
Re: How to Smell Difference Between Humans & Robots - Annoying Captcha Forms
#19> I tend to include text fields (later visually hidden or obscured with Javascript) with "name" parameters like "email", "url" and "name". Spam bots always fill these in. Your users won't, because the fields are hidden. If the fields are filled in, your submission came from a spambot. Easy! Fuck every website that does this. It's 2011, we should all be using password managers. If using LastPass makes your site flag m…
Following the crypto analogy, reCAPTCHA is approaching the effectiveness of a Beaufort cipher. The reCAPTCHA tool has been broken.
Various of the botnets will sail right past reCAPTCHA.
And yes, the choice here and the options here stink.
Nobody wants a CAPTCHA.
But the alternative is becoming part of the collateral damage of the arms race seeking to fill Google with cruft.
Or shutting off all comments.
Or escalating the arms race with subnet firewall blocks, content and email address filtering, reactive security, moderation or (if you have the appropriate audience for it) crowd-sourcing.
Re: How to Smell Difference Between Humans & Robots - Annoying Captcha Forms
#20One big issue that nobody is talking about here: There is a huge increase in networks using cheap labor to solve CAPTCHAs. A service like decaptcher.com can have humans solve CAPTCHAs at the rate of $2/1000. At that kind of price, all of the effort you go to to prevent automated signups is useless -- it's just being outsourced to humans, where these counter-measures are ineffective.
Even the cheapest manual CAPTCHA solving is still too expensive for most spam. The expected return of a spam comment on a random blog is very low. Spamming relies on posting millions of them for free.