Comments on: How NOT to invent the next-gen CAPTCHA http://lbrandy.com/blog/2009/10/how-not-to-invent-the-next-gen-captcha/ { on programming and the internets, every monday } Thu, 17 May 2012 07:59:48 +0000 hourly 1 http://wordpress.org/?v=3.0.1 By: key http://lbrandy.com/blog/2009/10/how-not-to-invent-the-next-gen-captcha/comment-page-1/#comment-29465 key Thu, 17 May 2012 07:55:19 +0000 http://lbrandy.com/blog/?p=1096#comment-29465 Efficiency and elegance, these are things that a system of <a href="http://xn--80aafybakikq7bg7c.org" rel="nofollow"> зареждане на автоклиматици </a>semi-structural curtain walls will <a href="http://aluminievadograma.com/" rel="nofollow"> дограма </a>complement the building. Efficiency and elegance, these are things that a system of зареждане на автоклиматици semi-structural curtain walls will дограма complement the building.

]]> By: key http://lbrandy.com/blog/2009/10/how-not-to-invent-the-next-gen-captcha/comment-page-1/#comment-29402 key Wed, 18 Apr 2012 08:59:37 +0000 http://lbrandy.com/blog/?p=1096#comment-29402 This method consists in comparing each employee with the achievements of others. <a href="http://xn--hxajxbacedk6ejc.net" rel="nofollow"> κλιματιστικά </a> This method consists in comparing each employee with the achievements of others. κλιματιστικά

]]> By: Alpheus http://lbrandy.com/blog/2009/10/how-not-to-invent-the-next-gen-captcha/comment-page-1/#comment-28958 Alpheus Tue, 03 Jan 2012 17:13:45 +0000 http://lbrandy.com/blog/?p=1096#comment-28958 One idea that hasn't yet seen much use, is the use of "Bayesian" techniques, to determine if the message itself is spam. Paul Graham talked about his experiments in using such techniques to filter out e-mail spam. Apparently, those techniques are highly accurate, and have become a bit of a standard in e-mail filters. For the life of me, I have no clue why that technique hasn't been applied to comments. An issue with training the filter, perhaps? One idea that hasn’t yet seen much use, is the use of “Bayesian” techniques, to determine if the message itself is spam. Paul Graham talked about his experiments in using such techniques to filter out e-mail spam. Apparently, those techniques are highly accurate, and have become a bit of a standard in e-mail filters.

For the life of me, I have no clue why that technique hasn’t been applied to comments. An issue with training the filter, perhaps?

]]> By: Jacob http://lbrandy.com/blog/2009/10/how-not-to-invent-the-next-gen-captcha/comment-page-1/#comment-26699 Jacob Wed, 03 Nov 2010 09:58:56 +0000 http://lbrandy.com/blog/?p=1096#comment-26699 The way the spammers are breaking unbreakable CAPTCHAs are by mirroring them to high traffic websites (torrent sites, download sites and so on). Users there must enter a captcha to download stuff. So users are solving the CAPTCHAs from a site they want to spam. Once you submit it they submit it and it works. So the inet users are the best OCRs the spammers can use. What do you think about using other type of biometrics on these registration forms? For example measuring the typing speed in the form fields. A automatic submission won't have any. And make one of the fields unelectable with the TAB key and see if the mouse was moved and used to reach there. Or some other type of biometrics that can be implemented. I'm sure there will be solutions to break all of these but used in random combination plus the fact that you can apply all these events and rules at runtime it will really complicate things. The scripts must be evaluated in order to figure out what is measured and how. And yes...throw there a CAPTCHA into the mix to make it really tasty. The way the spammers are breaking unbreakable CAPTCHAs are by mirroring them to high traffic websites (torrent sites, download sites and so on). Users there must enter a captcha to download stuff. So users are solving the CAPTCHAs from a site they want to spam. Once you submit it they submit it and it works. So the inet users are the best OCRs the spammers can use.

What do you think about using other type of biometrics on these registration forms? For example measuring the typing speed in the form fields. A automatic submission won’t have any. And make one of the fields unelectable with the TAB key and see if the mouse was moved and used to reach there. Or some other type of biometrics that can be implemented.

I’m sure there will be solutions to break all of these but used in random combination plus the fact that you can apply all these events and rules at runtime it will really complicate things. The scripts must be evaluated in order to figure out what is measured and how.

And yes…throw there a CAPTCHA into the mix to make it really tasty.

]]> By: としあき http://lbrandy.com/blog/2009/10/how-not-to-invent-the-next-gen-captcha/comment-page-1/#comment-25690 としあき Tue, 20 Oct 2009 19:37:41 +0000 http://lbrandy.com/blog/?p=1096#comment-25690 I think you did not cover one important factor when trying to design a CAPTCHA and that is the characteristics of those humans that are supposed to be able to pass it. Not every CAPTCHA needs to be designed so that /any/ human can solve it. A good example of this is the one used by http://random.irb.hr/signup.php which generally requires higher level mathematical knowledge. This is not unreasonable as if their resource is to be of any use to you you would likely already possess the required skills to solve them. One might even want to require cultural knowledge for a CAPTCHA as this will hinder human CAPTCHA farms being paid per CAPTCHA (however, they can still just send them to people looking for porn to solve). I think you did not cover one important factor when trying to design a CAPTCHA and that is the characteristics of those humans that are supposed to be able to pass it. Not every CAPTCHA needs to be designed so that /any/ human can solve it. A good example of this is the one used by http://random.irb.hr/signup.php which generally requires higher level mathematical knowledge. This is not unreasonable as if their resource is to be of any use to you you would likely already possess the required skills to solve them. One might even want to require cultural knowledge for a CAPTCHA as this will hinder human CAPTCHA farms being paid per CAPTCHA (however, they can still just send them to people looking for porn to solve).

]]> By: Jach http://lbrandy.com/blog/2009/10/how-not-to-invent-the-next-gen-captcha/comment-page-1/#comment-25689 Jach Tue, 20 Oct 2009 19:18:13 +0000 http://lbrandy.com/blog/?p=1096#comment-25689 Non-image based captchas work just as well in my opinion, if not better. If you're using a third party captcha system lots of other places use, it's bound to be under several attacks. Asking the user a logic question (or "what image is this? (cat/dog/elephant)" works, as does forcing JavaScript on to set a hidden field at the form submit. The future of captchas isn't in fancier images, but in just using a variety of techniques. Non-image based captchas work just as well in my opinion, if not better. If you’re using a third party captcha system lots of other places use, it’s bound to be under several attacks. Asking the user a logic question (or “what image is this? (cat/dog/elephant)” works, as does forcing JavaScript on to set a hidden field at the form submit. The future of captchas isn’t in fancier images, but in just using a variety of techniques.

]]> By: Michael Buckbee http://lbrandy.com/blog/2009/10/how-not-to-invent-the-next-gen-captcha/comment-page-1/#comment-25684 Michael Buckbee Tue, 20 Oct 2009 14:27:19 +0000 http://lbrandy.com/blog/?p=1096#comment-25684 I really just wish that there were more CAPTCHA implementations running around (and constantly evolving) so that the price and hassle to the spammers would go up. I really just wish that there were more CAPTCHA implementations running around (and constantly evolving) so that the price and hassle to the spammers would go up.

]]>