Evolution of the 'Captcha'

FireballX301 writes "The New York Times is running an article about the small word puzzles various sites use in order to defeat automated script registration while still letting humans through. It seems many people can't actually solve them anymore, so new alternatives (image recognition) are being created. This, of course, seems breakable as well — is there a feasible alternative to the captcha, or are we stuck jumping through more and more hoops to register at places?"

the hell with registration

[Anonymous Coward]

use http://www.bugmenot.com./ [www.bugmenot.com]

audio captcha

[weighn]

Especially with provisions of Section 508 [wikipedia.org] and the ADA [wikipedia.org] (and foreign counterparts) that ban discrimination against blind people, who use computers through screen readers that render text as speech or braille.

some sites are including an audio option.
examples are here [captcha.net] (under Guidelines > Accessibility) and here [accessibilityblog.com]

Re:Stop testing the Humans, test the Robots

[Anonymous Coward]

This works unless you're talking about a popular open source project in which case it is trivial for the spambots to be coded around it.

Re:Stop testing the Humans, test the Robots

[Kijori]

The problem is that the solutions are being coded for individual sites not one size fits all. A custom solution would have no problem with that system at all.

Re:Knowledge tests...

[lazlo]

You know, as a security sort of person, I tend to agree in principle. I do, however, find it fascinating how principle and reality don't quite line up all that often. A case in point, one of the blogs I read fairly regularly uses captchas. He doesn't really obscure it too much, and it's always the same 3 character string, related to the name of the site. Any spammer who actually posted more than once could easily figure it out. So far, none have. He wrote about his experiences with this here. [shamusyoung.com] So maybe captchas don't need to be all that complex...

Re:Alternative?

[Mr2cents]

Now, with only 4 images, you have 1+1+4+4+6+6 = 22 different possible outcomes, while having the problem remain trivially easy for a human.

Each image either shows or doesn't show a cat, so that are two possibilities. With 4 images that makes 2^4 = 16 possibilities. I don't know where you got "1+1+4+4+6+6" from, but it doesn't make any sense to me.

(Or maybe I misinterpreted).

Re:Knowledge tests...

[TodMinuit]

You can get away with that if you're a little site. But if you're Google, or Slashdot, or Facebook, then it'll last about two days.

Re:Captcha effectiveness isn't related to difficul

[Samrobb]

Custom solutions tend to work. At least for some time. For popular OSS project this is usually not an option and not all users of the popular OSS software are capable or willing to write a custom solution.

If you read Shamus' blog post, he's not using a custom solution - he's using a standard Wordpress plugin that is configured to only offer up a single captcha phrase. Presumably, if he were to run into issues with using just the single phrase, he could update his configuration to use additional captcha phrases, without having to do any custom development.

Re:Stop testing the Humans, test the Robots

[CodeBuster]

It would be a VERY intelligent script that could COMPREHEND the purpose of any particular html input field.

Not really, considering that most of these scripts are targeted at large sites (yahoo, hotmail, etc) OR common site frameworks (PhpNuke, Drupal, Blogger, etc) where common hidden field input patterns would very quickly be tested and coded around by the script writers. The whole point of CAPTCHA in the first place was that it presented a random and dynamic test which was easy enough for users to solve (at least in theory) while hard enough to foil simple analysis by script. This might work on a small custom website where it is not worth the trouble of the script writers to code a version specifically for the hidden input pattern of your site, but this hidden field stuff was tried and failed on big sites even before CAPTCHA was in common use.