Is recent broken-Yahoo captcha tools affecting your site?

[foxfox]

A recent released opensourced program (last week) aims to break the Yahoo (CMU) 's captcha, our site seems to be affected by this program (or similar).

We are using a similar technique as Yahoo! to generate captcha, I think if the released program consists of a general image recognition module, then it can be used to break ANY captcha.

From our research, the hacker is hacking at rate of 40-50% of accuracy. We strongly believe that the hacker is using image recognition technique as in the following examples,

sYu52b => syuS2b
sud8k => 5Ud8b

As you can see, they are very similar recognition, and we have a lot of these examples from a UNIQUE IP (serverl K per day).

Any comments?

[Rosalind]

Image captchas have been breakable for years.

However, look at the geolocation of the IP. I have heard of people in developing countries who will work at captcha-breaking manually.

More importantly, though, why are you making things harder for people with visual problems? Use a text-based captcha.

[foxfox]

1. Yes, captcha was broken long time ago, but our site has attracted a huge number of spammers/robots from Taiwan (mainly Hinet, largest ISP in Taiwan, with massive dynamic IP range) in the past week with fairly high accuracy (nearly 40-50% for our well designed captcha), it was happended just after yahoo captcha was broken, I am NOT sure if it is related as they provided source codes for image segmenation.

2. Text captcha is even more easy to crack, if we go for usablility in the future, we might provide voice captcha for example.

[Rosalind]

Text captcha doesn't scale well for large, popular websites. But they're very effective so long as you don't use maths questions, and the variety of questions you pose corresponds to the reach of your website and its perceived value to spammers. It wouldn't work for Yahoo or Myspace.

[thecoalman]

Text captcha is even more easy to crack, if we go for usablility in the future, we might provide voice captcha for example.

Me experience has been the exact opposite, you're trying to stop bots. Bots can't answer questions. Keep it simple and keep it unique, for example put a paragraph with some text and underline a word. The underlined word is the answer to the captcha.

This is not an solution for big targets like Yahoo or other large sites because they could just program the bots to defeat it. They'd have to make huge selection of questions for it to be effective.

I used this on my old phpbb2 forum and didn't get a single bot registration in over a year, same goes for e-mail form.