71–80 of 100 posts
Earlier quoted context omitted.
Here's a scenario: a dissident living in a third world country with pervasive surveillance. He accesses the net using TOR, and disables cookies. Now his IP is blacklisted, because there are lots of people using the same exit node; his reputation is low for the same reason, and the cookie is rejected. There's a good chance that this one person will be blocked, even though he didn't do anything wrong. For a simpler cas…
I would argue that the problem of spam and hackers is a greater burden on society as a whole than someone in Iran not being able to get past a captcha.
Earlier quoted context omitted.
Here's a scenario: a dissident living in a third world country with pervasive surveillance. He accesses the net using TOR, and disables cookies. Now his IP is blacklisted, because there are lots of people using the same exit node; his reputation is low for the same reason, and the cookie is rejected. There's a good chance that this one person will be blocked, even though he didn't do anything wrong. For a simpler cas…
I would argue that the problem of spam and hackers is a greater burden on society as a whole than someone in Iran not being able to get past a captcha.
I'm often being denied access to free content because I'm accessing from the "wrong" countries, and that's infuriating. If I start being locked out of free content due to my privacy measures, I'm probably going to start setting buildings on fire.
Earlier quoted context omitted.
It's no easier for bots. They still have to answer the old OCR challenge or a computer vision problem.
Using clickjacking we can get lots of valid tokens, no need to solve challenges.
Earlier quoted context omitted.
The weird thing about this entire No Captcha solution, in my opinion, is that it assumes that a captcha is the most efficient method for defeating spam. In most blackhat circles, captchas are an afterthought. You figure out everything else (IPs, original content), then plug in a service like deathbycaptcha that solves the captcha for... looks like $1.39 per 1000 (thanks to ultramancool for the correction). ( http://d…
With both of your examples (and many others I've come across) those question type captchas can be done with a quick ping to Google and a sanity check on the answer "what popular figure comes through your chimney in December" -> "Santa Claus - Wikipedia, the free encyclopedia" "what's 1+1" -> "2" They only really work if maybe the question is in the market of the site you're registering for "What's 's last name" etc
If they have to make very careful sets of photos to avoid confusion, then the sets of photos will be small enough to build lookup libraries for bots.
Earlier quoted context omitted.
Using clickjacking we can get lots of valid tokens, no need to solve challenges.
You don't think Google will figure something out when a bunch of tokens from different IP addresses are all being used by one IP?
This is why I still recommend using other form spam prevention techniques before sacrificing usability for a CAPTCHA. One of the most effective combinations for 80%+ of the sites I've ever dealt with is having a honeypot field in the form, plus some amount of time required to pass before the form can be submitted successfully. There are other ways to mitigate bots as well, but these two alone have sufficed for quite…
The weird thing about this entire No Captcha solution, in my opinion, is that it assumes that a captcha is the most efficient method for defeating spam. In most blackhat circles, captchas are an afterthought. You figure out everything else (IPs, original content), then plug in a service like deathbycaptcha that solves the captcha for... looks like $1.39 per 1000 (thanks to ultramancool for the correction). ( http://d…
I run a forum using Invision Power Boards, which has a built in question-and-answer verification during registration. Soon after I set it up I watched a bot in the server logs completing the registration in only a couple seconds.
I suspect that because IPB is a big enough target, they farm out the questions just like they farm out CAPTCHAs, and build a database of questions and answers. You'd need to include some randomness in the questions to throw them off.
Earlier quoted context omitted.
With both of your examples (and many others I've come across) those question type captchas can be done with a quick ping to Google and a sanity check on the answer "what popular figure comes through your chimney in December" -> "Santa Claus - Wikipedia, the free encyclopedia" "what's 1+1" -> "2" They only really work if maybe the question is in the market of the site you're registering for "What's 's last name" etc
Well the Santa Claus question will defeat bots for now at least... http://imgur.com/qX8pWrQ