CAPTCHA Using Ad-Based Verification 174
mk1004 writes "Yahoo news has an article explaining how the text-based CAPTCHA is giving way to ad-based challenge/response. It's claimed that users are faster at responding to familiar logos, shortening the amount of time they spend proving that they are human. From the article: 'Rather than taking just a mere glance to figure out, recent studies show that a typical CAPTCHA takes, on average, 14 seconds to solve, with some taking much, much longer. Multiply that by the millions and millions of verifications per day, and Web users as a whole are wasting years and years of their lives just trying to prove they're not actually computers. This has led many companies to abandon the age-old system in favor of something not only more secure, but also easier to use for your average Webgoer: Ad-based verification, which can actually cut the time it takes to complete the task in half.'"
more ads (Score:5, Insightful)
Re:more ads (Score:4, Interesting)
They also know that if you have to write down the name you're more likely to remember the brand. There's a lot of research right now in working around people's wonderful capacity to tune out commercials.
(I think I saw a Microsoft patent for Kinect-based ads where you could skip the ad, but only by saying the product's name (or whatever).)
translation (Score:5, Insightful)
Heh, This is a desperate attempt to stop people like me from adblocking so we can actually use the service.
Re: (Score:2)
This is too funny.
First off, TFA is W-A-Y off: companies didn't abandon text-based CAPTCHAs because they took too long! They have been abandoning them because they are TOO EASY for machines to solve! I have been paid to do CAPTCHA - solving apps myself.
Put logos in there instead, it will just get easier!
And "to add insult to injury", as the saying goes: even m
Re: (Score:2)
On one of my sites, I found that the spam bots were getting through Google Captcha as if it wasn't there. I tried a math test and the spam bots stopped getting through... Can you explain to me why as I would find it much easier to write a script that could solve simple math?
My biggest problem with Captcha is that the clients do not like it at all. They want an easy life.
Re: (Score:3, Insightful)
Doh, because the spam bots weren't configured/programmed to solve math problems.
Of course you'll find many humans aren't able to solve math problems either and thus have problems using your site. This may or may not be a feature depending on the type of site. For a site like slashdot it may be a feature if people who can't solve simple math problems are prevented from posting.
Re: (Score:2)
Not necessarily - most CAPTCHAS are solved by human labor. Perhaps as a fake entry to "free porn" and other things. Doing this is ridiculously easy - user signs up and the webserver registers for an account on some web site, captures the CAPTCHA and presents it as its own. It then asks the user to do it, and forwards the response.
Sometimes there are even farms of people who do this - just solving them day in and day out (for lik
Re: (Score:3)
Somebody hired me a couple of years back to scrape information from a government site, which was technically public information, but it used a CAPTCHA. Turned out t
Re: (Score:2)
Just wait until captchas turn into 30-second flash videos, followed by freeform text answers with questions like, "How many cups of ___'s delicious Mountain Roast coffee did Jane buy?", followed by "What color was the scarf of the elderly woman behind her" and "what is the 800 number you can call to send a gift certificate for CoffeeCo's tasty rich dark coffee to a cherished friend?".
Before you argue that the number questions would be small, remember... advertisers will be shooting loads on their computer s
Re: (Score:2)
"Just wait until captchas turn into 30-second flash videos, followed by freeform text answers with questions..."
I don't deny it could happen. But I wouldn't sit through them.
There isn't always a significant other provider (Score:2)
Like the big 3 news agencies: Reuters, AP, AFP (Score:2)
Although you may be right when it comes to very big sites.
Or very big providers of works that a lot of providers reprint. Consider what would happen if all sites that syndicated stories from Reuters, Associated Press, or Agence France-Presse were to adopt a particular method of access control.
Re: (Score:2)
Re: (Score:2)
I wouldnt say that text captcha's are "too easy" for computers to solve
Apparently, use of apostrophes is far too hard for you to solve.
It's a bot, dude...
Re: (Score:2)
I have been paid to do CAPTCHA - solving apps myself.
So you rent yourself out to spammers? Or something less objectionable? I'm trying to think of a legitimate reason for mass cracking of captchas but I can't think of one. Have I missed something?
It's more than that (Score:2, Interesting)
If a person hears or reads something that they don't like (e.g. an ad) their brain will often discard it immediately. But if you can make them say it, or in this case type it, they're more likely to remember it, and even start to believe it.
This is, essentially, low-grade mind control.
Re: (Score:2)
Re: (Score:2)
They can make me type the company's name.
In fact, I'll type it twice. The second copy will be in companies_never_to_buy_from.txt.
Re:translation (Score:5, Informative)
Time to dump Yahoo, I only still use it for the spam filter which it has been good at but if it expects me to look at ads I will stop using it.
I ran into a nasty 'ad-captcha' that was at least 10 seconds long before it would give the option to 'solve' the captcha. All the time an inane, loud commercial played for something I would never buy.
Yeah, great job annoying people even _more_.
Re: (Score:3, Insightful)
... All the time an inane, loud commercial played for something I would never buy.
And yet, people get upset about targeting ads, as if that was a bad thing rather than a blessing.
Re: (Score:2)
And yet, people get upset about targeting ads, as if that was a bad thing rather than a blessing.
I'm not at all upset about targeted ads themselves. If I'm going to see an ad I'd prefer it to be relevant. What I object to is being spied upon by companies that want to target ads at me.
As it happens I use Ad-block, so it makes no difference whether they try to target ads at me. I'm having my privacy compromised for something that's not benefiting anyone.
Re: (Score:3, Interesting)
What about the folks who want their privacy and in NO WAY shape or form said it was ok to track every web site they go to, location, and more?
And how about the security problems? Even Google gave out viruses in their ads just a couple of years ago. You think I trust strangers on the internet who want to push ads on me on pages I never wanted to begin with from doing searches? Most viruses are transmitted by online ads now.
http://www.avast.com/en-us/pr-online-ads-put-web-users-at-risk
http://www.spamfighter.c
Re: (Score:2)
If they want to make tracking you a condition of using their site, it's their site so either put up with it or don't use their service.
Or find a way to bypass it, because once the HTML reaches my computer, fuck you I can do what I like with it.
Re: (Score:3)
Don't let the door hit you on the way out. If you block ads, you're just a leech anyway,
Is "leech" your term for an individual who's not completely incompetent with regard to network security? Or, maybe someone whose value system doesn't mandate owing a debt for participating in a voluntary exchange of ideas?
As I see it, any person or entity who wants to publish their ideas on the web is generally responsible for the cost of doing so. For example, this site's owners incur the cost of publishing "slashvertisements" and links to other sources' articles on this website — much like how parti
Re: (Score:2)
The door didn't hit me on the way out, thank you for your concern.
Ads are blocked at my router, for the most part. It won't connect to ad servers. I have AdBlock installed, because not all ads come from servers. NoScript blocks all those cross site scripts that serve up ads that the router misses. I see precious few adverts.
If I MUST watch an ad to use the service, then it's not a "service". And, I don't need or want it, thank you very much.
Did you say I'm a leech? Whatever. I don't much care what yo
Re: (Score:2)
Better to be called a leech than to be a parasite and a blight on society.
My connection, my router, my computer, my firewall, my browser, my screen, my eyes, my brain.
If I decide to block your crap in any of these stages, I will damn well do so and if you have a problem with that, you can go fuck yourself with a jackhammer.
Any bits that enter my residence and stay there are mine to do with as I please. Don't like it? Find a different business model.
An in case you didn't get it, let me reiterate:
My connect
Re: (Score:2)
What does the purpose of the internet's creation have anything to do with the day someone asked 'who the hell is going to pay for all this'? On what planet do you live where advertisers have any right whatsoever to put anything on a website without the owner's permission? Even if it was forced permission through a contract that a re-seller uses, no one has a right to advertise anything. The sites you use decide what they put up. Vulgarity, violence and a complete lack of knowledge on how things work. Your p
Re: translation (Score:5, Interesting)
The sites you use decide what they put up.
Lowest common denominator. The way so many things in the world turn to shit.
In Sao Paolo they banned billboard advertising. Business wasn't damaged at all.
In many cities and towns in Europe, advertising only allowed to be very low key, so that it doesn't spoil the look of the place. Especially so in historical locations. They still flourish.
The only reason there's so much advertising on the internet is there's nothing to stop it. Bad practices induce worse practices.
What does the purpose of the internet's creation have anything to do with the day someone asked 'who the hell is going to pay for all this'?
Government pays for some of the internet. Consumers pay for some of the internet to their ISPs. Lots of content providers do it for fun. Lots of content providers do it because they want to spread their message, and that doesn't have to be third party advertising. If the internet wasn't an advertisers whorehouse, micropayments might take off for things that are worth paying for.
Advertising doesn't have to ruin everything.
Re: (Score:2)
Where is your planet? and how can I visit it?
Re: (Score:2)
In many cities and towns in Europe, advertising only allowed to be very low key, so that it doesn't spoil the look of the place. Especially so in historical locations. They still flourish.
This. I don't object to advertising in principle, and even disable adblock on certain domains. If the site puts up one of those "hey, you're using adblock, but we need the money can you please enable advertising?" messages up, I will usually disable adblock for that specific site, especially if it's a site I use on a regular basis.
What I object to are the fullscreen flash popups that some sites have, or the ones that start playing obnoxious music at you. And with HTML5, you can't get around just those ones
Re: (Score:2)
Except the billboard makers/installers
Re: (Score:2)
... and nothing of value was lost. If every advertising company worker in the world had to go and do something else, or even be unemployed, it would make the world a significantly better place.
Re: (Score:2)
Negative Turing Test (Score:2)
Re: (Score:2)
What if they create a service like recaptcha and it gains popularity? Though, I imagine those websites that use it would want a small cut just like anyone displaying ads on their site.
Don't shoot the messenger! (Score:5, Informative)
Time to dump Yahoo, I only still use it for the spam filter which it has been good at but if it expects me to look at ads I will stop using it.
The news was by Yahoo, not about Yahoo. The company could still be among those planning to adopt the technology, but this isn't mentioned in the news story.
Just ID computers (Score:5, Insightful)
It would be better to simply prove that the computer is used reasonably and then stop presenting the captcha's after the initial few tests. If the computer starts being detected as a spammer then it must prove again, harder this time, that it is a valid user to become reaccepted. This would save time and processing power.
Re: (Score:3, Interesting)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
The IP address is indeed one way of identifying computers but falls down. That is why I said, 'identify the computer' rather than the IP. IP's fall down because they may be dynamically assigned like yours or they may be used by many computers such as behind a router or WiFi point. Identifying the individual computers can be done in a number of ways.
Re: (Score:2)
Identifying the individual computers can be done in a number of ways.
That are all easily defeated. Ping fingerprinting isn't reliable because of firewall configuration. Agent strings are easily spoofed. Cookies are trivial to circumvent. Javascript *could* tell you what processes are running on a system, but with sandboxing and default security settings in modern browsers (even Internet Exploder), it wouldn't be feasible. Even using Flash to do it wouldn't work, because Flash isn't installed everywhere any more, and because it's sandboxed on most installations now. To get an
You're on the right track, but we can ID computers (Score:2)
Add to that we're confirming that you are indeed who you
Re: (Score:2)
There's an easier way to slow down spammers... generate a random string with some bit of known plaintext, save it in session context, generate a random 40-bit encryption key, save it in session context, encrypt the random string with that random key, deliver it to the user's client app, and make the client app bruteforce the encryption key & submit the decrypted value as a formvar along with the new message. Even phones are fast enough now to bruteforce a 40-bit key within a few seconds if you give them
Re: (Score:2)
Re: (Score:2)
The zombies would do bad things and web masters like me who flag them would mark those zombies as spammers. A single flag should not be enough to nail them but several would demote them to a 'proved not valid' status from which it is much harder to get back to both 'unknown' and then 'valid'. This sort of thing is already done with some software. The addition I'm suggesting is combining it with the Captcha which suggests 'valid' and at some point doesn't need to be done (no more Captcha) if the user/compute
That's what we do with Strongbox, one captcha ever (Score:2)
In our case, we use the CAPTCHA to reduce brute force on a login-in system. Once you enter the CAPTCHA correctly once, you don't have to enter again as long as you enter your user name and password correctly. If you start entering incorrect user names and passwords, that could be a brute force attack, so you have to enter CAPTCHAS again.
Yeah? (Score:5, Insightful)
A fancy rationalization of a money making scam. Nobody's wasting years of their lives doing captchas. And what about those of us who have very low exposure to advertising - how are we supposed to recognize logos?
Re: (Score:3)
how are we supposed to recognize logos?
You must be a communist! (ducks)
Re: (Score:1)
Re: (Score:2)
Re:Yeah? (Score:5, Insightful)
Re: (Score:3)
The "Ad-CAPTCHA" in question (image [bbcimg.co.uk]) asks to describe the brand "dyson". A valid answe
Re: (Score:3)
Re: (Score:2)
Cheaper vacuums that don't work nearly as well are available. Typical vacuum, it's hard to tell if the suction is working at all, without putting your hand over the aperture. A Dyson tends to pull the carpet up from the floor.
(That may have changed since Dyson's patent on cyclonic vacuums ran out. I haven't tried any of the Dyson copies.)
Re: (Score:2)
Dyson is a British brand. Americans would probably know it. I'd imagine there are quite a few countries where they are familiar.
But the general point is that captchas would have to be targeted per country. And that part at least is not an issue with this scheme, because the advertisers would want the ads to be targeted per country anyway.
Re: Yeah? (Score:2)
Geotargeting (Score:2)
Re: (Score:2)
Useless.
Re: (Score:2)
And the logos - there's no point showing a US-centric firm's logo to an Aussie visitor, for example. I wouldn't know what most of them look like or who they represent.
With a little bit of remedial studying and some perseverance, you'll be able to become more like an American consumer. I don't see how this would be be considered a bad thing to an advertiser.
Plus, I hear Aussies like to pay more for the same things, that's got to be good news for advertisers as well.
Re: (Score:2)
You can probably count on your fingers the number of corporate logos that are well known all over the world. A *lot* of brands that sell all over the world use different logos in different markets, for one reason or another, which cuts the number down to products like Coca Cola, and a very small number of car companies that actually sell their product everywhere without rebranding for different markets. Maybe a couple of cell phone manufacturers do it, too, but they don't sell in every market.
Spyware (Score:5, Interesting)
Re:Spyware (Score:4, Interesting)
Nice catch.
(shock, horror) I actually read The Article, and you're spot on about how thin it is.
I don't know anymore. Maybe slashdot editors feel like they're under a gun to produce something/"anything" in the timeframe, but the cost to the readers of bad stories is growing. In other news sites I wouldn't care because we expect that drivel from some of them. But "news for *nerds" ... yes this matters, but aren't / weren't nerds the ones who dug into the details!? The ones who got thrown into the dumpster because we asked too many questions in class?
Supposedly the raw code to slashdot is open, but I haven't once seen us fork slashdot to only include (fewer?) high quality stories. (Not saying someone didn't, just saying that this medium regular user never saw it.)
Re: (Score:2)
Who remembers K5? (Score:3)
I haven't once seen us fork slashdot to only include (fewer?) high quality stories.
Kuro5hin originally ran the SLASH software that powers Slashdot before Rusty rewrote it from the ground up to create Scoop.
Re: (Score:2)
Everybody tracks everything in the web development world. Analytics are key. Nobody should really be surprised by this any more.
They don't care about you as a person, and the reports aren't on you personally, they're aggregate. Mostly, they're built and sent by the ad-CAPTCHA provider to the client(s) to prove that they're doing what they say they're doing.
Only because of Adblolck (Score:2, Interesting)
Re: (Score:2)
Re: (Score:2)
No, it's not just because adblock. That's bullshit and you know it. Advertisers have upped the stakes every time they can.
Remember when google ads were unobtrusive text? During that time I whitelisted them and sometimes even clicked them, because that was fine. Then the advertisers won their case to annoy the hell out of users, and blacklisted it went. They would have gone to this point to convince people to pay attention to their damn ads anyways.
How much shit can they sell us already? (Score:1)
Re: (Score:2)
Yeah, they cause me to use adblock and ghostery no matter how often they crash Safari
Re: (Score:2)
There might be some fall of of effectivness, but in general I don't think anybody really cares, given how bad ads on the Internet are. Not only are they still almost completely untargeted, they are also incredible repetitious, boring and not even made for the Internet. If Youtube for example shows me a video, why not tell me the name of the product at the start of the video? I am going to skip it in 5sec anyway, so you could just tell me now and reenforce that logo into my brain or I won't see it. Also why
Infomercials hide the price until late (Score:2)
Not only are they still almost completely untargeted
That's the fault of people using "do not track" and other similar privacy measures. I leave tracking on so that the ads I see are more likely to interest me. But it appears that a lot of advertisers don't care, as they continue to serve SWF ads that neither my laptop (which runs SWF in click-to-play) nor my tablet (which doesn't support SWF at all) can play.
why not tell me the name of the product at the start of the video?
For the same reason infomercials don't show you the price in minute one: the brand name might turn some people off. They want to show you the attributes
Re: (Score:2)
That's called clicking the ad.
That only brings me to a webpage with a bigger version of the same ad or the companies webpage. In the days of the Internet I would expect it to bring me straight to Amazon where I can buy the product or to a price search engine that gives me the place with the lowest price. Or at least some place where I can get actual information on the product, reviews and such, a webforum, something, not just more marketing bullshit, I already clicked the ad, so don't bother me with even more of it, provide me with the
Faster? More Lucrative! (Score:3)
Re: (Score:1)
Captcha's don't take all that long to solve if they are halfway readable.
This is correct, both for humans and computers. The last part is why many of the captchas I see these days aren't even halfway readable.
Leaving dial-up users out on purpose (Score:2)
CAPCHAs fail to load over slower dialup connections
That's called targeting. Dial-up tends to be popular among poor people and people living in rural areas where DSL and cable are not available. I'd guess a lot of advertisers prefer to target people with more disposable income in densely populated, easy-to-serve areas, not the dial-up demographic.
Culturally dependent question as geotargeting (Score:2)
Identify which items are food: [Culturally dependent question]
That's called targeting. Advertisers want to target people living in the country where they sell their products, not people halfway across the globe who have no reasonable chance of even encountering the product. Or a publisher might not have the license under copyright to display a given work in a given territory.
Defeating its purpose? (Score:1)
Well... isn't placing well-known logos, which can be easily image-matched by computers, kind of defeating the purpose of a CAPTCHA?
(And this CAPTCHA I just had to solve took me MUCH less than the fourteen seconds they claim as an average.)
Re: (Score:2)
it's not a captcha system.
it's a make-sure-the-ad-was-shown system.
and that's nothing new!
Re: (Score:2)
(oh and since computer use can be scripted they would still need a regular captcha for anything that really needs one)
A 'solution' in search of a problem (Score:2)
This is a waste of time, and another vector for ad-servers to throw malicious javascript and flash attacks at you.
Brand recognition? (Score:2)
In addition to all the other posters qualms about this, I really wonder how this would work on the internet. How many brands are generally recognized around the world? Fine, you can do some localization, but still.
It seems that this will be either choosing between the logos of Coca Cola, Apple and Nike, or presenting me with an ad of the biggest, most famous mattress company in the whole US.
Only when needed (Score:1)
So what? (Score:1)
Multiply that by the millions and millions of verifications per day, and Web users as a whole are wasting years and years of their lives just trying to prove they're not actually computers.
Web users as a whole are wasting years and years of their lives just trying to look at cute cat pictures. Does this mean we should embark upon the CATcha?
Just another attempt to make viewing ads compulsory...
icky (Score:1)
Was this really necessary /. (Score:2)
Mmmm it tastes just like butter, really??? Slashdot do you really need to place advertisments in this manner? Check the approval process for this piece of crap and you'll find someone taking kickbacks. If it wasn't deliberate ie a corporate decision then you have someone in the ranks getting kickbacks.
Ads? haha! (Score:1)
easily defeated (Score:3)
Complete bullshit. And you know for a fact that in no time we'd be having to answer questions about crap like "One weird secret for losing weight/Mom is 54 and looks 27". Then we'd have to watch a flash animation. And listen to a jingle....
Re: (Score:2)
Yeah, that's the joke of these systems. They are completely insecure and utter failures at actually being CAPTCHAs. Common sense should be enough to determine this, but apparently it's not. Ad-based CAPTCHAs are one of the most ridiculous scams I've seen for a long time.
I don't really recognise logos well (Score:2)
Another issue is that most people don't "see" adverts, and will skip over these.
Video and audio adverts are the worst - one of the things that annoys me about Spotify is the adverts, which are so annoying they make me less likely to even pay for the service and just stick to playing my own music. Every three songs I get some guy quack-quack-quacking away in a foreign language, which surely makes no commercial sense.
Re: (Score:2)
Paying isn't hugely convenient (or, it *wasn't* - they've sorted their payment gateway now) because it required a credit card.
What prompted me to go for the paid service was the 30-day free trial. The adverts were deeply annoying and spoilt my enjoyment of the service to the extent that I just couldn't put up with it for more than a couple of songs. Having it for a month for free demonstrated that it actually works extremely well (modulo a few bugs in the Linux client) and it's well worth the money.
Really? (Score:2)
"It's claimed that users are faster at responding to familiar logos..."
I have no TV (but a 55" monitor to watch torrented stuff without ads), use adblockers everywhere, refuse ads in my mailbox, I wouldn't recognize a logo that I don't know from childhood and most of those have changed.
" shortening the amount of time they spend proving that they are human."
I wouldn't qualify ad-watchers as 'human'.
Re: (Score:2)
"It's claimed that users are faster at responding to familiar logos..."
I have no TV (but a 55" monitor to watch torrented stuff without ads), use adblockers everywhere, refuse ads in my mailbox, I wouldn't recognize a logo that I don't know from childhood and most of those have changed.
Do you also never go outside? Visit a store? Or purchase any products?
I also block as many ads as I can, but I am still exposed to plenty of logos and such merely by going outside in any relatively urban area. Even interacting with any people you will see logos, since people wear all sorts of them on their clothing. There's also a logo on almost any product you can buy, even if you never go outside and never see any other people.
If you don't know any logos, you must have been living under a rock. Say, d
Won't go (Score:3)
The equivalent logic would apply to a grocery store putting all their prices up 20%. In the first week they would be rolling in profits due to customer inertia but by week 52 they are closed as there are so many other stores roughly 20% less.
But the worst logic is that an ad-capcha takes less time. Again MBA logic; the user is taking less time but seething the for that time and for a while after. Also keep in mind that most people (we aren't most people) don't have a clue what captchas are about but it must be something technical. But an ad everybody can understand.
So my prediction is that the best that ad-captcha sites can hope for will be that their growth will slow down; but my thinking is that most ad-captcha implementing sites will be taking it down and publicly saying that it was one of the worst decisions in the site's history.
Doesn't work (Score:2)
This will not work for the same reason that image-based captchas, riddles and maths questions do not work: There is only a small number of logo/slogan combinations. It is trivial to construct a database (1:1 mapping) of these.
The problem with captchas is to find a mapping which is easy for a computer to do one way, and difficult the other way. Initially, the ad-based captchas are a good idea, because it is impossible for a computer to derive the correct answer from the question. The problem is that computer
Advertising disguised as "Security" (Score:3)
I really despised TV news broadcasts using movie advertisements disguised as "news", and this is an advertising gimmick disguised as "security". I won't recognize most brands today, will not waste my time researching them, and will move to another web resource without flinching. Ad-based CAPTCHAs is a big fail.
not more secure (Score:2)
Re: (Score:2, Informative)
I dunno why he's getting down modded. I'd rather be told click on the coke ad than type something I can hardly read. Then again I have trouble seeing so I might not represent the majority.
Re: (Score:2)
The only problem here is that as I identify ad servers, I add them to my hosts file and block all connections with them. This is due to many of them being hacked and serving malware and viruses. All that is happening is that I'll soon have no reason to use any of the services I've been paying for - Cable TV ( already don't use due to ads), Internet (becoming less useful due to ad/malware servers), Phone (scammers and robo-callers: Political Parties are the worst offenders).
On the utility front, I'm already