Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Captchas Are Becoming Ridiculous

blog.andrewmunsell.com

Post reply on HN
Print view View original

201–210 of 238 posts

Re: Captchas Are Becoming Ridiculous

#201

Post by tjpaxton »

rickmb wrote: post #128
tjpaxton wrote: post #50

Earlier quoted context omitted.

Take a look at our product at areyouahuman.com We launched in January and are using games to make them easier for people. Some of our early testing showed captchas can decrease signups by up to 25% and we're able to recover almost all of that. We also monitor how you play the game (like mouse movement) so we can ramp up our security without having to make the task more difficult for people. Read more here http://arey…

Given the nature of the games, you may want to consider renaming to areyounorthamerican.com...

Ha. Looks like the domain is available. In reality we were initially targeting users in the US, but have had a lot of interest internationally. Most just use it as is, but we have had others pay for translation or custom games.

We are also planning on a set culturally agnostic (as well as culturally specific) games. If you go to our homepage and refresh through the games you'll see a shape game, that has no language for an example.

Re: Captchas Are Becoming Ridiculous

#202

Post by tjpaxton »

ChrisNorstrom wrote: post #158
tjpaxton wrote: post #50

Earlier quoted context omitted.

Take a look at our product at areyouahuman.com We launched in January and are using games to make them easier for people. Some of our early testing showed captchas can decrease signups by up to 25% and we're able to recover almost all of that. We also monitor how you play the game (like mouse movement) so we can ramp up our security without having to make the task more difficult for people. Read more here http://arey…

Damn, people were kind of hard on you. I think it's very clever. Even though sometimes our inventions don't work as perfectly as we expected them to. Your captcha system is new and fresh and many bots are not prepared for it. I'm sure you'll improve over time, the bots will improve over time, you'll counter, so on and so forth. I'd rather have my signup system use areyouhuman than re-captcha. What makes me uneasy abo…

Thanks. The audio challenge does suck and we're working on making it better, but still secure.

Re: Captchas Are Becoming Ridiculous

#203

Post by tjpaxton »

geon wrote: post #175
tjpaxton wrote: post #73

Earlier quoted context omitted.

Thanks for asking. First, our main focus is on making something more usable for people. We also think captchas are only part of the solution and should be employed with other things (rate limiting, keyword filtering, etc) That being said, we don't just ignore security. There are a lot of captcha alternatives out there that survive on just obscurity, if they were widely adopted, they wouldn't take much to get around (…

> our main focus is on making something more usable for people Considering that your games can be played by a random number generator with something like 10% success rate, you can just skip the captcha completely. Much more user friendly. The other things you look at to increase security, like detecting patterns and behaviors that indicates bots can be done without a captcha.

I'm note sure you can get a 10% success rate, if you have let us know, we'd love to hear about it. Note that our demo page has the threshold set to almost nothing and other security features disabled.

Totally agree that we could detect patterns and behaviors without the captcha. Baby steps, though. We'll get there.

Re: Captchas Are Becoming Ridiculous

#204

Post by freditup »

georgemcbay wrote: post #83
freditup wrote: post #43

I feel like the author of this article is still slightly misunderstanding the reCaptcha. Not to criticize him, but it's almost immediately clear which word you are actually being tested on, because it's has the same general 'look' to it each time. Take the first one: 'Secretary' is clearly out of some book. The other thing is the real test. Now, reCaptcha never gives you real words as a test, so he shouldn't be surpr…

I feel like you didn't read the article, because the author already addresses what you said and had you read the article you'd realize you made incorrect assumptions that, again, he already addressed.

I disagree: "The capatchas were not only difficult for a computer to read, but impossible for a human." He goes on to quote that computers can guess capatchas at 10%. My point is that if you understand capatchas, you can get them right almost all of the time. (Not talking about the audio ones here, since the visual ones seemed to be the focus of the article.)

Re: Captchas Are Becoming Ridiculous

#205

Post by antirez »

There is no stupid "hey I've an idea!" comment in this thread, so I'll offer one.

An alternative (probably already proposed?) could be the following, if you have a large set of human tagged images or videos you could show this images to users and, like, eight set of tags, and ask: what set of tags better apply to the image above (of course only one set is really about the image, other sets are random)? This are three bits per image, do this a few times and the probability of a computer random guessing is very low.

Every time you show an image you may crop + rotate it a bit and apply a filter, so that manually building a table is hard, but if you have a big set of images like google could have maybe this is not needed.

Re: Captchas Are Becoming Ridiculous

#206

Post by barik »

doc4t wrote: post #144
josscrowcroft wrote: post #137

Every time I read something like this I pine for never having the opportunity to turn MotionCAPTCHA[0] into a real (secure) system. Everyone said it couldn't be done, but I know it can! [0] http://www.josscrowcroft.com/demos/motioncaptcha/

Clever. Not knowing the details of how computers beat CAPTCHAa can you explain why it would be difficult to create a program to trace the path?

I've done some research in this area with examining user input mechanics. This particular example would be solvable using B-spines [1], as one possible approach. The "path CAPTCHA" even provides some great computational hints, by indicating the starting point as a circle!

http://mathworld.wolfram.com/B-Spline.html

Re: Captchas Are Becoming Ridiculous

#207

Post by benmanns »

neotek wrote: post #99
coderdude wrote: post #38

Earlier quoted context omitted.

Randomizing the field names is a great idea but as you said they would just need to scrape the HTML each time they wanted to register. Have you considered sprinkling in random bits of markup to throw off the people using regex and other lazy parsing methods? That might make it a real pain to scrape your forms depending on how the spammer parses your page.

I still have 'username', 'email', and 'password' fields in the form but I hide those elements with CSS, which no scraper is going to bother parsing. When the registration form is submitted the account is essentially hellbanned, they can 'activate' the account via the normal email confirmation process but anything they post disappears into the ether. I'm catching about 100 spam accounts a day with this technique[1] an…

What happens if someone uses something like LastPass, RoboForm, or any of the other automatic form fillers to legitimately sign up for your website? I would imagine that these would "guess" that username means username and email means email, which may lead to false positives for real users.

Re: Captchas Are Becoming Ridiculous

#208

Post by tpinto »

antirez wrote: post #205

There is no stupid "hey I've an idea!" comment in this thread, so I'll offer one. An alternative (probably already proposed?) could be the following, if you have a large set of human tagged images or videos you could show this images to users and, like, eight set of tags, and ask: what set of tags better apply to the image above (of course only one set is really about the image, other sets are random)? This are three…

Once I found a nice captcha replacement (can't remember where it was, tho). It worked like this: at the end of the form, there were 6 to 9 playing cards and the text "Click on the seven of spades". This fitted the theme of website which had something to do with poker or magic tricks (can't really remember what it was) but this can be done with a lot of other stuff that is well known by people and not by robots (e.g. 6 photos of animals and the question "Click on the dog", etc.)

Re: Captchas Are Becoming Ridiculous

#209

Post by benmanns »

antirez wrote: post #205

There is no stupid "hey I've an idea!" comment in this thread, so I'll offer one. An alternative (probably already proposed?) could be the following, if you have a large set of human tagged images or videos you could show this images to users and, like, eight set of tags, and ask: what set of tags better apply to the image above (of course only one set is really about the image, other sets are random)? This are three…

I think that the problem that we will always run into, is that any human-performable task will either be cracked by someone writing a bot, or made trivially inexpensive by apps that charge as little as $0.00139 per solved captcha (see [1]). Microsoft has implemented a tagging-type captcha, ASIRRA (see [2]), for which you can hire out the results for $0.004 per solved captcha[3].

I think the only real solution is to make it cost real money (say $0.25 or $0.10) to perform whatever action you are protecting, so that repeated attempts are prohibitively expensive, but one or two by a legitimate user is not too expensive. Otherwise, financially-driven spammers will always find a way to inexpensively circumvent the protection.

[1]: http://www.deathbycaptcha.com/user/order

[2]: http://research.microsoft.com/en-us/um/redmond/projects/asir...

[3]: http://de-captcher.com/, no direct link to pricing without registering

Re: Captchas Are Becoming Ridiculous

#210

Post by ryanmolden »

shdon wrote: post #189
Jach wrote: post #187

Earlier quoted context omitted.

What my bank does (and PayPal too if I remember correctly) is keep track of my IP, and if it changes then it forces me to enter additional data about my account before letting me continue. (This assumes I got the password correct.) I think one or both also may use some cookie(s) to mitigate changing IPs. They may also make use of leaky browser data (like user agent strings etc.) to help identify me; they have the pot…

PayPal doesn't ask you for some extra data. It blocks ("limits") your account so you can't actually use it until you provide them with a copy of your utility bill or something. Terrific when you're on vacation and need to make a PayPal payment. That had me so pissed of that I closed my account (which isn't possible whilst it's "limited" unless you manage to get them on the phone -- good luck with that. -- at least yo…

>at least you can then tell the person on the phone that you think they're full of

Why? The poor soul answering support calls likely didn't make this policy and cannot do anything to change it. I guess if you like just unloading anger at some unempowered person who has the responsibility of taking a bunch of crap without reacting in turn then this is a good idea. Otherwise it is more useful to take your business elsewhere, and if you must try finding someone to complain towards that might actually be able to encourage change.

Post reply on HN