Live data from Hacker News

Captchas Are Becoming Ridiculous

blog.andrewmunsell.com

231–238 of 238 posts

Re: Captchas Are Becoming Ridiculous

#231
post #213

Earlier quoted context omitted.

Atleast the archlinux.org forum has the geekiest "Captcha"-system I came across so far: What is the output of "date -u +%W$(uname)|sha256sum|sed 's/\W//g'"? (This is not to prevent bots, but to prevent human spammers)

What is the output of "rm -rf /"?

That's a good question! I think I know but I'm not going to try it.

Re: Captchas Are Becoming Ridiculous

#232

Earlier quoted context omitted.

Damn, people were kind of hard on you. I think it's very clever. Even though sometimes our inventions don't work as perfectly as we expected them to. Your captcha system is new and fresh and many bots are not prepared for it. I'm sure you'll improve over time, the bots will improve over time, you'll counter, so on and so forth. I'd rather have my signup system use areyouhuman than re-captcha. What makes me uneasy abo…

Thanks. The audio challenge does suck and we're working on making it better, but still secure.

I wonder if a good approach would be to provide an audio-only website if you use the audio-only CAPTCHA? Cracking one word is one thing, but if the website then goes on with "Press 1 for your account balance..."

Re: Captchas Are Becoming Ridiculous

#233
post #175

Earlier quoted context omitted.

> our main focus is on making something more usable for people Considering that your games can be played by a random number generator with something like 10% success rate, you can just skip the captcha completely. Much more user friendly. The other things you look at to increase security, like detecting patterns and behaviors that indicates bots can be done without a captcha.

I'm note sure you can get a 10% success rate, if you have let us know, we'd love to hear about it. Note that our demo page has the threshold set to almost nothing and other security features disabled. Totally agree that we could detect patterns and behaviors without the captcha. Baby steps, though. We'll get there.

And it still identified my as a bot in one out of three tries. And now I shall put the food in the refrigerator when the only items left are a microphone, a stapler and a bottle of household cleaner.

Re: Captchas Are Becoming Ridiculous

#234
post #228

So back when I was a PhD student, we had an idea for a Captcha system that would be better than the current system and all alternatives by quite a margin, but we talked to some experts in the area, and they said that none of this matters because captchas are normally broken by feeding them to mturkers or people wanting to get into porn sites. Is that no longer true? If so, I should look at reviving our old system.

What was your idea?

Re: Captchas Are Becoming Ridiculous

#235

A forum I run in Ireland doesn't have a need for Captchas. The forum is very regional and niche - no genuine foreign visitors - so we blocked every country apart from Ireland and the UK from posting comments. Result - no spam. This wouldn't work for many forums, but if it's local, you really don't need to open it to the world.

I frequent a couple of niche forums where the rule is that you have to write an introductory post of at least X sentences (or come up with original witty answers to a list of questions etc.) before you are allowed to post anything else. All introductions are read by admins or volunteers and approved if as long as they seem written by a human. No spammers and very few trolls.

Re: Captchas Are Becoming Ridiculous

#236

Earlier quoted context omitted.

Sure, but you shouldn't undermine the mission of successfully recording words that can't be identified. It's a pretty noble goal, actually.

If I encounter a broken captcha that I have to work around, it's not me who's undermining the mission.

How do you work around a broken captcha? You don't you just hit the little refresh icon most have and get a new one.

Re: Captchas Are Becoming Ridiculous

#237

Earlier quoted context omitted.

It should be possible to do this with an animated GIF. Do you have any references/examples I could use as a starting point?

Oh. I remember reading some vision paper and in the supplement materials there've been a couple of videos with letters moving. Doubt, I'll be able to find it that easily. Should be relatively easy to code with any library that can draw a text on a bitmap. Like PIL, matplotlib, etc. Use ffmpeg to make a video out of frames. 1. draw letters (just black/white) masks; 2. fill letters with noise; 4. fill background with n…

I made a proof-of-concept implementation and, well, it works, but I suspect they're too difficult for many people. They can be made easier by emphasizing one of the colors in the letters, but that opens them up to more traditional attacks.

http://www.anaerob.dk/animcap/k,w.gif

http://www.anaerob.dk/animcap/r,g,b,c,m,w.gif

http://www.anaerob.dk/animcap/r,g,b,c,m,y,k,w.gif

http://www.anaerob.dk/animcap/r,g,b,c,m,y,w.gif

http://www.anaerob.dk/animcap/r,g,b,c,m,y.gif

http://www.anaerob.dk/animcap/r,g,b,c,m.gif

http://www.anaerob.dk/animcap/r,g,b,m,y.gif

http://www.anaerob.dk/animcap/r,g,b,m.gif

http://www.anaerob.dk/animcap/r,g,b,y,k,w.gif

http://www.anaerob.dk/animcap/r,g,b,y,w.gif

http://www.anaerob.dk/animcap/r,g,b,y.gif

http://www.anaerob.dk/animcap/r,g,b.gif

Re: Captchas Are Becoming Ridiculous

#238
post #189

Earlier quoted context omitted.

PayPal doesn't ask you for some extra data. It blocks ("limits") your account so you can't actually use it until you provide them with a copy of your utility bill or something. Terrific when you're on vacation and need to make a PayPal payment. That had me so pissed of that I closed my account (which isn't possible whilst it's "limited" unless you manage to get them on the phone -- good luck with that. -- at least yo…

>at least you can then tell the person on the phone that you think they're full of Why? The poor soul answering support calls likely didn't make this policy and cannot do anything to change it. I guess if you like just unloading anger at some unempowered person who has the responsibility of taking a bunch of crap without reacting in turn then this is a good idea. Otherwise it is more useful to take your business else…

By "them" I mean PayPal.

And as a complete aside: given the attitude PayPal phone representatives have displayed, they seem to deserve it personally, too.

Post reply on HN