Slashdot Log In
Will Solve Captcha for Money?
Posted by
CmdrTaco
on Wed Sep 06, 2006 08:37 AM
from the i've-done-worse-for-less dept.
from the i've-done-worse-for-less dept.
alx_lo writes "Captchas are a nice idea to protect your blog or guestbook from being spammed by robots.
But what good is this protection when you can hire "data entry specialists" to solve captchas for $0.60 per hour for 50 hours a week?
Anyone here who can think up a solution that does not include drastically changing the global economy? How about captchas that require cultural background knowledge to solve?"
This discussion has been archived.
No new comments can be posted.
Will Solve Captcha for Money?
|
Log In/Create an Account
| Top
| 490 comments
(Spill at 50!) | Index Only
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
(1)
|
2
(1)
|
2
no good solution for now (Score:5, Interesting)
(http://www.euvsus.blogspot.com/)
US customs has been known to ask cultural questions at border crossings. My sister was once asked what Dan Quayle's parents did for a living after she said she lived in Indiana. This question is a bit before her time. (His parents ran a newspaper in Indiana.) This also brings into question age. My parents kill me in the original version of trivial pursuit that they play, but I win when playing the newest version.
A temporary stop gap measure might be to use the current Captchas in combination of looking at the users geolocation. I can see how this measure though would really anger free speech advocates for the third world.
How about a mathematical Captcha that cannot be solved with a calculator. Well educated foreigners will not even work for $.60. Then again, how many Americans could solve these.
Re:no good solution for now (Score:5, Funny)
Thank you for signing up with Blogger! Before you continue, please prove P=NP.
Re:no good solution for now (Score:4, Funny)
Re:no good solution for now (Score:5, Funny)
Re:no good solution for now (Score:5, Insightful)
(http://www.kibbee.ca/)
Uhhhmmmmm (Score:4, Funny)
Stupidity?
Peer pressure?
Re:no good solution for now (Score:4, Interesting)
Re: no good solution for now (Score:5, Funny)
Wait... I've got it!
To prevent inexpensive foreign labor from solving CAPTCHAs, simply ask easy math and science questions... but only only provide access for wrong answers. This should let most Americans through.
Cultural Captchas: (Score:5, Funny)
1. Metallica
2. Billy Ray Cyrus
3. Lynnrd Skynnrd
a. GMC truck with double tires on the back
b. Primer-color El Camino with beer cans in the back
c. Shiny red F-150 with aerodynamic truckbed lid
Re:no good solution for now (Score:5, Interesting)
(http://www.spamgourmet.com/)
If this sounds like a good idea, do something else, so that there's no pattern
Re:no good solution for now (Score:4, Informative)
It looks as if most spammers operate in two phase: first they collect valid guestbook URLs, and then, several weeks after, they spam those. Probably it's not even the same people doing both phases, the first could be selling lists to the second.
So, a couple of weeks ago, I moved my guestbook to another URL, and since then, I've got almost no spam (only 3 spams in 4 weeks, versus more than 10 per day before...). And apart from a simple keyword filter, the guestbook has no other protection (i.e. no captcha whatsoever).
"Who's Hot" (Score:4, Interesting)
(http://www.newsique.com/)
problem of course is when people disagree on what's "hot"..
Re:"Who's Hot" (Score:5, Funny)
(http://slashdot.org/)
Re:"Who's Hot" (Score:4, Insightful)
(Last Journal: Friday November 09, @04:36PM)
Ignoring any issues about offensiveness or whatever, that's not the problem with it. The problem is that it's easily broken.
How do you break it? Easy. Just pick a random number between one and the number of options you have. For a three option CAPTCHA, you have a one-in-three chance of getting through. You're a spammer remember, so these odds do not deter you, all you have to do is run your automated script three times and you'll be close to sending out the same number of spamvertisements as you would have sent without the CAPTCHA.
Realistically no multiple choice system, as advocated by a number of posters here, will succeed unless it has so many choices that it's improbable a real user will be able to use the system without issues.
CAPTCHAs are a bad idea in general. Yet again they're a poor, unwieldy, temporary "solution" to a problem the inventors barely understand that causes more problems than it fixes. Like 99% of anti-spam solutions. The only thing worse than a CAPTCHA is what'll replace them.
Unique Reg Form (Score:5, Informative)
(http://www.random--precision.org/ | Last Journal: Wednesday May 17 2006, @10:35AM)
Re:Unique Reg Form (Score:5, Interesting)
(http://www.keiretsumusic.com/steve/ | Last Journal: Saturday February 17 2007, @05:51PM)
I noticed that bots were signing up but not actually posting, (I donno, maybe they were meant to post but that part of the script broke -- either way, they never posted, but it annoyed me having them there.) They were just there, with links to sites selling vicodin/viagra/etc. Which annoyed me somewhat, but one time a child porn link showed up which was really the straw that broke the camels back, and I decided to stop it. I noticed that 99% of the sites were *.ru so I altered the reg form to throw an error if it detected a *.ru domain in the website field. Then I just started getting non *.ru domains instead, so I just thought, fine, fuck it.... Now if anybody signs up with ANY website in the website field, it throws an error, and has a message along these lines: Since then, no spam bots. w00t. Of course, that forum only gets a handful of signups per year, so I don't really care if it inconveniences people slightly, it's primarily intended as a "private"ish (real life friends) forum anyway.
Re:Unique Reg Form (Score:5, Interesting)
(http://www.zenwerx.com/personal/)
SweatShopSoftware.com (Score:5, Funny)
(http://slashdot.org/)
Incidentally, for those of you in the market to advertise your wares: My team of fine Southeast Asian workers will circumvent those inconvenient captchas on web sites/bulletin boards/blogs for a low low price of $.60 US/hour.
Here at SweatShopSoftware.com, we have a solution to every problem.
Re:SweatShopSoftware.com (Score:5, Funny)
More accurately, you have a problem for every solution.
(:
Still hurts spammers (Score:5, Insightful)
That's Ironic.... (Score:3, Informative)
Timing (Score:4, Insightful)
(http://pyscrabble.sf.net/)
Perhaps a solution is making the captcha time-intensive? If it takes an additional 30 seconds of 45 seconds, it might cut down on the number of captchas a person could solve in an hour.
This would probably work better for sites where you only enter the CAPTCHA once, say for creating an account.
refundable micropayments. (Score:5, Interesting)
Re:refundable micropayments. (Score:5, Funny)
Re:refundable micropayments. (Score:5, Insightful)
(http://www.brynmosher.com/ | Last Journal: Monday August 27, @10:15PM)
What are CAPTCHAs really for? (Score:3, Insightful)
(http://www.candysporks.org/)
So the real problem is coming up with CAPTCHAs in real-time with no permanent (this session ID) correlation made between the image link and the answer. Then hiring "slave labor" to make this mapping for you will be completely useless.
Then the "other side" will volly back with an image algorithm to thwart CAPTCHA, then we'll get CAPTCHA 2.0 with synergistic AJAX-enabled authentication, and then we'll have Terminators ruling the world.
Re:What are CAPTCHAs really for? (Score:5, Informative)
(Last Journal: Monday April 03 2006, @07:23PM)
Yes and no - That solves the problem of precreated CAPTCHAs, by throwing CPU time at it, but the FP's complaint doesn't actually involve what CAPTCHAs solve.
CAPTCHAs, if effective (which a market for human solvers suggests), only prove that a human has responded. If a human solves it for pay on behalf of a spammer - The CAPTCHA worked perfectly. Virtually every suggestion on this topic has missed that key point. Using culturally-dependant information, or judgements of aesthetics, or awkwardly-phrased audio clips, or even time-wasting math problems, all still just prove that a human answered the question.
The real problem here involves the misuse of CAPTCHAs by those who assume they do something which they don't. They don't weed out "undesireables". They weed out non-humans. It really doesn't matter how complex you make them; if a human can solve it, you still have the same underlying flaw - Namely, that we have a HUMAN enemy in this battle.
Instead, we need to exploit a human vulnerability - Mortality. We need to hunt down spammers and kill them, slowly and painfully. We need to torture their wives and kids in front of them, then string the lot of 'em up in town squares as an example to others. We then need to hunt down all the companies funding these spammers as a form of advertising and castrate their boards of directors.
Or better yet, we need to trick them into running P2P nodes and let them and the RIAA weaken each other to the point that we can easily eliminate the winner.
Yeah, make your website more difficult. (Score:5, Insightful)
(http://shawn.redhive.com/ | Last Journal: Thursday May 26 2005, @09:04AM)
It's a mild pain in the ass to match a swirled up picture of letters (I've known the alphabet for about 25 years, and I still get them wrong sometimes), but I'll usually go through it. Make it much more difficult than that, however, and I'm pretty likely to decide it's not worth it, and go waste my time on another website.
The solution to this problem is not to make the visitor do more work, because you can easily drive your visitors away by making your website a hassle. The spam needs to be filtered on the server side, or just deleted as it appears.
I've encountered this problem on my own neglected website, and I haven't found a good solution that I have the skills to implement. I generally just delete the spam as it appears, and I turn off commenting on older posts. This works for my personal site, because it's low traffic, but I'd imagine someone who gets more readers and spam could find the motivation to set up some sort of filtering, similar to email spam filters.
Leisure Suit Larry (Score:5, Funny)
(http://gotperl.com/)
Reputation ID (Score:5, Interesting)
(http://www.robotsrule.com/phpBB2/)
I hope to heaven that instead of a biometric authentication, someone can come up with a card reader for driver's licenses or some other ID method, but current events seem to indicate biometric authentication will prevail. Even in that case, I hope it is a "authenticated-user" token passing scheme so that the web site that you want to visit never knows who you are, just that you are a valid user that owns the account ID you claim to own (the Reputation ID web site acts as middleman and privacy shield, pray they are never hacked).
By the way, I don't like the thought of privacy problems and Reputation ID spoofing scenarios this implies. I just don't see any other way way to build an Internet with a high degree of trust. As I type this I am looking at the SlashDot captcha box for comments.
Correct me if I'm wrong... (Score:3, Interesting)
(http://tpno-co.org/)
Moderation (Score:5, Interesting)
(http://seenonslash.com/ | Last Journal: Friday May 11 2007, @04:02PM)
So in the end spam filters can help but human moderation is still the only real working solution today.
Solution using existing websites (Score:5, Interesting)
Perhaps an opportunity for a social experiment. (Score:3, Interesting)
(Last Journal: Friday August 17, @05:34AM)
The real problem with spam after all is not the spammers but the people who respond to it, if nobody bought from spam then there would be no spam. Well at least much less of it. After all it is advertising and spammers are not selling say viagra but selling spam itself.
In any case with this log of users who actually click on spam links you could then A compile an overview of what kind of user actually is stupid enough to respond, B educate them or C ban them for being to stupid to live.
Considerring the offered budget in this ad for (30-100 dollars) I don't think the guy is operating with that big a margin already. If you can reduce the number of people who respond to these spams then perhaps simple economics makes the problem go away.
Use a human then. (Score:5, Interesting)
(http://tru7h.org)
Could make the supporting cgi scripts as simple or as complicated as one's willing to author. One forum I maintained for a while had a low level "all access" section where new users posted an application. Forum regulars would respond, and eventually grade the new user. If they passed, they were given full access to the board. Granted, this system was employed more to limit the quantity of asshats than spammers, but the same principles apply.
It might even benefit society in the long run as a spammer's urge to do his work forces him to develop a "true" AI.
Japanese cultural capchas (Score:5, Interesting)
(http://www.hwacha.net/)
I've visited a Japanese art site (ie pictures of characters from fighting games drawn in alarmingly extreme detail) which had roughly this on the front page:
"Because there have been some people coming in here and stealing pictures or linking without permission, I have had to put this small test up. Please enter the Emperor's birth date in Japanese calendar in the box below. I'm sorry for this inconvenience and I will remove it when they forget about this site."
I've also seen a site (again in the 'students with too much time on their hands' sector) that asked for some other date in Japanese calendar. There are also a fair few personal sites that have a front page with just one link that takes you in, and several spurious links, with the page being 100% japanese text -- which I think serves about the same purpose.
On a related note, there also used to be WinMX groups which required that you say something in Japanese on entering or be booted. The point there was that otherwise you'd get masses of Korean 12-year-olds coming in and going 'Fuk Japanese bitch! dokdo nun uri tang!!lolz0rz!' and generally spamming the place. At least, I hope they were 12.
So, cultural captchas certainly exist... but it's easy to see why they work better on 'my pictures of Vampire Hunter D' sites than in the commercial world.
cultural background knowledge (Score:3, Insightful)
If the captcha does not itself contain all the information required to solve it, some legitimate users will be unable to solve it.
Now, simple riddles would at least require mastery of the language instead of mere character recognition skills. However, requiring language only raises the $/hour cost of solving them a little. More importantly, even easy riddles are much harder to generate for captchas than random strings. E.g., "What word is fourth in this sentence?"
Comments by email? (Score:3, Insightful)
(Last Journal: Thursday December 08 2005, @11:00PM)
What about reducing it to a single problem again by accepting comments only via email? Then you can bring the usual tools to bear - forcing server retries, greylists, whitelists, blacklists, analysis, etc.
Just provide the comment email address at the bottom of the article and a uid in the address would make it post to the proper article/story/whatever. Reply to email addresses would have a different uid as well.
Make the mail server moderate for you.
pre-loaded captchas? (Score:5, Funny)
The Anti-CAPTCHA (Score:3, Interesting)
(http://www.timtucker.com/)
The basic idea is to present a CAPTCHA image that's as easy for a machine to understand as possible and then ask the user to type in something else. (in the system that I'm using, users are presented with an unobscured image of a 6-digit number and asked to type in a different 6-digit number).
One of the great things about asking a user to type in something other than what's shown is that it's much more accessible than a regular CAPTCHA, since there's only a 1/1,000,000 chance that someone who can't see will accidentally type in the "right" six digit number.
Will solve CAPTCHAs for pr0n (Score:4, Interesting)
Re:$0.60/hour? (Score:4, Funny)