Evolution of the 'Captcha' 383
FireballX301 writes "The New York Times is running an article about the small word puzzles various sites use in order to defeat automated script registration while still letting humans through. It seems many people can't actually solve them anymore, so new alternatives (image recognition) are being created. This, of course, seems breakable as well — is there a feasible alternative to the captcha, or are we stuck jumping through more and more hoops to register at places?"
Alternative? (Score:3, Insightful)
Great idea (Score:3, Insightful)
Are they chosen for any good reason, or are they completely arbitrary? Are there letters that bots have trouble with? Fonts? Who knows?
The only thing that's sure is that every protection will eventually be broken.
What's more, maybe if you can't solve a simple word puzzle, I don't want you registering at my site...
Re:Great idea (Score:5, Insightful)
I have perfect vision and I struggle to tell if some S/5/Zs are one of the letters. The fonts and distortion is getting worse and worse to the point where it's usually 2 or 3 attempts before I can get one correctly, purely because letters are so distorted in them these days.
Captcha too hard (Score:5, Insightful)
I am not sure if a picture is better, but it is defintively a step forward if I don't have to spend 5 time retrying.
Stop testing the Humans, test the Robots (Score:5, Insightful)
We know that humans are more intelligent than scripts, so I always thought it should be easier to test the lack of intelligence in scripts than proving intelligence in humans.
For example just use a simple honeypot in a html form. Put a dummy input field in a form. You can hide the field with CSS/noscript tag or just mark it: "This field should be left intentionally blank" or something of that nature to make it more human friendly.
Seeing that all form fields are generally blank, the spambot/script will fill your dummy field. On server side check if the field has data, ignore the submission. It would be a VERY intelligent script that could COMPREHEND the purpose of any particular html input field.
my anonymous 2c
woah (Score:2, Insightful)
Come to think of it - its great to see fp without some sort of script bollocks - welcome back to
Digital Certificates are the answer (Score:3, Insightful)
Re:Alternative? (Score:5, Insightful)
Re:Great idea (Score:5, Insightful)
Meanwhile, having an automated system feed them to Chinese people on $0.50 an hour can't be too hard, and they'll have at least as good a chance of getting the correct result as I do.
Scraping works too (Score:2, Insightful)
Re:Captcha too hard (Score:1, Insightful)
Bugmenot wants to join our b&. (Score:3, Insightful)
Re:Ask questions (Score:2, Insightful)
Re:Alternative? (Score:5, Insightful)
You give script your email address, it sends you an email and you follow a validation link within the email. Implementing this on my website where I had a captcha before got rid of 100% of the spam.
There are also other little dirty tricks you can do to ensure it's a human on the other end, one of my favorites is to check the referrer URL when accepting a comment... if it's not being referred from my entry forum then it just happily throws the request away. Even if it's not spam it's probably something malicious anyway.
Another thing I used to use that worked really well in conjunction with registration is "approving" any account in which the first post doesn't contain any links or any words on a "spam list". If the first post of the newly registered account contains any links or spam words at all, it's held for moderation and must be approved manually. A vast majority of the legit people leaving comments for the first time wont be including any links or talking about viagra on a tech site, no links or spam words means they've been validated as "not spam" and if they've included links it only takes a human a few seconds to qualify if the account should be canceled as spam or approved as a non-spam account. This one obviously takes some man power so it only really works on smaller sites. It might be easy for a spam bot to counteract this but the way it validates is not apparent, not to mention this is already after an email has been validated.
Re:Alternative? (Score:3, Insightful)
Your search space wouldn't be large enough -- you can only have a limited number of photographs, since they have to be manually generated, and once the correct answers have been identified the captcha-breaking algorithm would reduce to "which image is closest to something in this set", a fairly trivial image-matching problem. This is exactly the issue the GP was referring to: the captchas must be randomly computer-generated to create a suitably large search space, but they mustn't be computer-solvable.
Re:Knowledge tests... (Score:5, Insightful)
Re:!you can't solve them ; machine can (Score:3, Insightful)
Re:Alternative? (Score:3, Insightful)
Get over yourself.
If you're building a community forum where your visitors are likely to be repeat customers then IMO a more formal registration is appropriate.
How many people do you really think come to your website thinking, "Today I am going to join a community!"? Joining a community is not something people carefully plan out doing, it's something that happens if they try it out for a while and like it.
Re:Alternative? (Score:3, Insightful)
Meanwhile, you have shut out all users who do not speak English well can can't figure out your instructions.
Re:Knowledge tests... (Score:2, Insightful)
Re:Alternative? (Score:3, Insightful)
In many circumstances, email validation will cause users who would have otherwise filled out your captcha, to leave your site without contributing.
For example, I'll gladly solve a captcha to comment on a blog, but 90% of the time, if email validation is required, I'm just going to close the window and move on to someone else's site.
Filling in a captcha is a nuisance, but email validation is an even larger nuisance that also requires that I give you personal data.
Re:Knowledge tests... (Score:1, Insightful)
And 3^-3 is (drum roll).... 1/27
Re:Put the knowledge in the question (Score:3, Insightful)
Implement a standard CAPTCHA system, with fairly easy to read characters.
Then, for the challenge section, randomly select a prompt from the following (as an image, not plain text):
"Enter only the last letter of the captcha"
"Enter all the numbers included in the captcha"
"Enter all the letters included in the captcha"
"Enter the character from the captcha in reverse order"
"Enter all the vowels from the captcha"
"Enter all the consonants from the captcha"
"Enter the letter of the alphabet that follows the second letter shown in the captcha"
"Enter all the blue characters"
It seems to me that this would make the already-used captchas much harder to crack, as the bots would have to be able to recognize the captcha, locate the prompt graphic (which could be randomly inserted, along with "dummy" images), understand what the prompt is saying, and then apply its instructions to the captcha. Most humans should be able to do this (except maybe the consonant one, for people who never learned what a consonant is), but most computerized means that could do this would be more lucrative sold as commercial software than used to enter captchas on websites.
Re:Knowledge tests... (Score:3, Insightful)
Also you would need a small army of people to write the question in the first place (actually you could try to generate category/item couples from a statistical analysis of wikipedia).
Now that I think of it... it's just too easy to beat your captcha randomly (1/4 chances is not that bad for a script).
On a funny note... captcha similar in spirit to the one you propose is http://www.hotcaptcha.com/ [hotcaptcha.com] based on hotornot. At least it's worth a laugh