Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TextCAPTCHA: 180 million simple logic questions

textcaptcha.com

Post reply on HN
Print view View original

11–20 of 66 posts

Re: TextCAPTCHA: 180 million simple logic questions

#11

Post by mseebach »

moxiemk1 wrote: post #4

Since there are 180million of them, presumably they were generated with a computer. Then, it seems that they probably fit into a finite number of patterns. If these could be determined, wouldn't this be a rather easy to crack captcha system? Most captchas depend on the difficulty of the reverse transform applied to an image, especially when you don't know what the transform is. Here, the forms seem pretty regular, an…

It will only be little harder to reverse than it was to develop. Unless the generation of patterns can be distributed to attain a scale that the attackers can't match, this will fail as soon as it's protecting something worthwhile.

Re: TextCAPTCHA: 180 million simple logic questions

#12

Post by nkohari »

I understand the importance of CAPTCHAs, but I wouldn't put anything that required a reasonable level of thought in between my users and something I wanted them to do (for example, buy something from me). The more complex CAPTCHAs get, the less likely users are to try to complete them.

Re: TextCAPTCHA: 180 million simple logic questions

#13

Post by mseebach »

bjonathan wrote: post #8

Easy is not enough, Captcha need to be universal also. For non native english speakers: "Cheese, cat, mosquito, trousers, elbow and ant: how many body parts in the list?" or "Soup, dog, trousers, house, mosquito or pink: the colour is?"arent as easy as "3+1" or reCaptcha . Not everybody speak english on the interweb...

> Easy is not enough, Captcha need to be universal also.

Perhaps on the long term, but solving the captcha problem for the english-speaking (or any language, for that matter) subset of the internet population is still a very worthwhile undertaking.

Re: TextCAPTCHA: 180 million simple logic questions

#14

Post by eli »

bjonathan wrote: post #8

Easy is not enough, Captcha need to be universal also. For non native english speakers: "Cheese, cat, mosquito, trousers, elbow and ant: how many body parts in the list?" or "Soup, dog, trousers, house, mosquito or pink: the colour is?"arent as easy as "3+1" or reCaptcha . Not everybody speak english on the interweb...

On the plus side, these captcha are much easier on people who can't see.

Re: TextCAPTCHA: 180 million simple logic questions

#15

Post by daten »

TamDenholm wrote: post #5

I know some people that would fail a few of these questions...

I agree. The questions in the example may be easily solved by a technically minded person, but they could also confuse a large part of your audience. I would find it very difficult to generate questions that are appropriate no matter what language, culture, math or literacy background my visitors have.

Re: TextCAPTCHA: 180 million simple logic questions

#16

Post by [deleted] »

amih wrote: post #7

Some of the questions don't have one globally unique answer, for example: which day is a part of the weekend, Sunday, Friday or Monday. Where I live (Israel), Friday is part of the weekend, were as I bet the creator of the list lives in the USA and as many times happens, believes the USA==World and the "correct" answer is probably Sunday.

[deleted]

Re: TextCAPTCHA: 180 million simple logic questions

#17

Post by mitko »

Trying all the words in the captcha one by one has a big chance of "hitting" correct answer. If it doesn't a brute-forcer can just request a new captcha until it works.

Said that, they don't seem very spam-proof to me.

For more info about how hard CAPTCHAs need to be read Luis Von Ahn's papers:

http://www.cs.cmu.edu/~biglou/

Re: TextCAPTCHA: 180 million simple logic questions

#18

Post by mike-cardwell »

moxiemk1 wrote: post #4

Since there are 180million of them, presumably they were generated with a computer. Then, it seems that they probably fit into a finite number of patterns. If these could be determined, wouldn't this be a rather easy to crack captcha system? Most captchas depend on the difficulty of the reverse transform applied to an image, especially when you don't know what the transform is. Here, the forms seem pretty regular, an…

Yeah, the 180million number is irrelevant. What's important is the number and variety of patterns, not the number of questions.

I don't even need to program something which will understand all of the patterns. I just need to program something that will understand some of the patterns, which just keeps fetching captchas until it eventually understands the format, eg "What is X plus Y?"

This captcha system is considerably more simple to break than the typical image based ones.

Re: TextCAPTCHA: 180 million simple logic questions

#19

Post by ryanc »

moxiemk1 wrote: post #4

Since there are 180million of them, presumably they were generated with a computer. Then, it seems that they probably fit into a finite number of patterns. If these could be determined, wouldn't this be a rather easy to crack captcha system? Most captchas depend on the difficulty of the reverse transform applied to an image, especially when you don't know what the transform is. Here, the forms seem pretty regular, an…

Not only do they follow a small number of patterns, most that involve subject matter rather than simply logic are part of a small number of categories. Almost all involve body parts, colors, names and days of the week.

Re: TextCAPTCHA: 180 million simple logic questions

#20

Post by mike-cardwell »

mitko wrote: post #17

Trying all the words in the captcha one by one has a big chance of "hitting" correct answer. If it doesn't a brute-forcer can just request a new captcha until it works. Said that, they don't seem very spam-proof to me. For more info about how hard CAPTCHAs need to be read Luis Von Ahn's papers: http://www.cs.cmu.edu/~biglou/

I get the impression that about half of the questions are list based. And the questions are about 10 words long. If that's the case, then using the algorithm you mentioned, you have a 1 in 20 chance of getting the captcha right. So yeah, it's a completely useless captcha system. That number should be 1 in a million or higher, not 1 in 20.
Post reply on HN