Forum Moderators: phranque
CAPTCHA used to be an easy and useful way for Web administrators to authenticate users. Now it's an easy and useful way for malware authors and spammers to do their dirty work.
There are now programs available online that automate CAPTCHA attacks. You don't need to have any cracking skills. All you need is a desire to spread spam, make anonymous online attacks against your enemies, propagate malware or, in general, be an online jerk.
Quoted from here [computerworld.com.au]...interesting read.
So, what can we expect from CAPTCHA in the future? Is CAPTCHA even worth implementing still if it is so easily worked around? How can CAPTCHA fight back!? Do you think it will slowly be repalced with other technologies and methods? Your thoughts...
Marshall
They said that even the Firefox extension called Captcha Killer had a 80% success when tested on Yahoo pages although it was a bit long (25 s to 4 min) - so it is indeed the dead of captcha.
They mention the ASIRRA (Animals Species Image Recognition for Restricting Access) launched by Microsoft and inspired by the unethic HotCaptcha (where the user has to choose the 3 hottest persons amongst 9 pictures).
They say that 3D Captcha will never be implemented since they can also be cracked and are heavy on resources.
Here is my captcha implementation:
1) find a free font “funky enough” bur still readable
2) use the resulting number/lower/upper-case combo ($str_1) and make it a session (SESSION_A)
Next: mingle $str_1 with $_SERVER[‘HTTP_USER_AGENT’] then md5 the new str and create a session (SESSION_B)
3) pass to the landing page SESSION_A and SESSION_B
Still on the landing page, again, create SESSION_C to be a new combo of SESSION_A and SERVER[‘HTTP_USER_AGENT’]
What we do is to recreate a new session on the landing page to assure that the landing page is view by the intended user.
Compare SESSION_B and SESSION_C obviously if the sessions do not match then
Even if the captcha was properly entered, “the page view” will fell due to false USER_AGENT
The future of CAPTCHA will need to be be imperceptible to the user, or innocuous enough not to impede the exchange of information. The stuff we have today is ineffective and unaccessible.
Slightly more sophisticated systems are still keeping out slightly more sophisticated spammers "3+6=?", for example, seems to stop most bots or at least slow them down.
Other simple ideas can stop spammers in their tracks - using weird parameters in forms (email=aardvark", name="trolley") is simple and makes for blank forms at worst, total block at best.
Only a spammer would wish for the demise of captcha; honest folks will be content if it evloves just a little faster than the average spammer.
You don't expect to win against spamers; just hope to stay ahead. There's always been cheats in all walks of life, and likely there aways will be.
<input name="email&address" value="">
ends up as:
?email&address=spam@attempt.foo
[recaptcha.net...]
We have implemented this on majority of sites and easilt able to fight back more then 95% of spam registrations.
reCAPTCHA has an audio alternative (my hearing is imperfect too), but seems to require scripts and cookies and other undocumented things in most implementations, so still doesn't work.
If you want to fight spam, please fight spam. You can score keyphrases and RBL hits, add preview steps, include time-limited hidden form tokens, sleep() in your form action script and so on.
Please don't fight imperfect humans.
MJR, a human with imperfect eyesight.
This has been discussed before but all I do is ask a simple question, not mathematical but something obvious only to a human e.g, "What colour is blood"? If you want to ask a more complex question you can do so and even provide the answer in the text comments on your form. AFAIK there is no automated process that can beat this?
I am no expert at these things but is there any way to crack this other than have a human entering the right answer? If so, isn't this better than any captcha?
Stands back waiting to be corrected. ;)
However, people with poor English-language skills will struggle with them.
This need not be a problem. There is an infinite number of ways of offering the answer in a way that is oblique enough to hide it from spammers and language need not be a problem. For example put an image or a word somewhere obvious on the page and ask the enquirer to input that word to the required form field.
it's still not a real anti-spam tactic
Why ever not?. If it stops spam then it it is anti-spam and it has worked for me for more than two years without a single problem.
The next level of captchas might well be "Choose which one of these ten images is out of ordinary" with one of them having a huge shoe shopped to be next to eiffel tower to rival it in size...
But all captchas can be broken and all bots pretend to be people. If by no other ways, get a few humans to do 14 hour days cracking captchas for bots to get them past registarations and pay them a few dollars a month.
I think that the community reviewing is the only way. For example, wordpress blog platform has Akismet plugin. Akisment prevents anyone from commenting if others using that plugins have marked those addresses as spammers. Prevents spamming quite efficiently.
[edited by: engine at 12:41 pm (utc) on July 17, 2008]
As for stopping the high level spammers I would use CAPTHCHAs in combination with an email field that should be left blank. Those bots love to fill in email fields even when there is an image on the page saying to leave it blank.
Any automatically generated questions (items assosciated with colors, sentence strutctures used, etc.) can also be automatically solved.
The key is having a unique question, for example on one form the company has a two word name and you ask whats the first word in the company name. Keep the question simple to answer but unique.
I used this on phpbb2 before switching to phpbb3 and all my forms. There wasn't a single bot registration on my forum for better than a year that I had it implemented nor have I seen any spam through the forms.
Those bots love to fill in email fields even when there is an image on the page saying to leave it blank.
I would think a lot of real people would get caught in that, phpbb2 had a great mod that used a similar technique though. You removed the website field from the form, since the bots were automated they never loaded the form and directly posted the fields. Any registration that had the website field would get the IP banned immediately.
Really, there are two levels of solutions. A site like Yahoo needs a different approach than a smaller site that won't get a lot of individual human spammer attention.
It is best used in combination with other techniques, such as required blank form fields, Akismet, and a good crew of moderators. The goal isn't to block 100% of Spam registration, posts, or comments. The goal is (for me at least, in the cases where I use it) to keep the Spam down to a slow enough trickle that the Moderators can keep a grip on things.
Couple of key ways to keep CAPTCHA kicking for another few years on your site (if you are so inclined):
#1 Replace the library of images and answers you got when you downloaded the CAPTCHA system you're using. 90% of all bot based CAPTCHA defeating systems rely on the limited question/response list. There are stunningly few CAPTCHA libraries out there, and if you just implement the stock library you got with your CAPTCHA software, you're making life easy for the bots. They already have that library, trust me.
#2 The other %10 of CAPTCHA defeating bots rely on rapidly improving OCR technology, and there is still a way to defeat this with image based CAPTCHA. Instead of using distorted text in the CAPTCHA image, leave the text as bold and readable as you like (which even helps Usability for people like Slef). The trick? Animate the text. Using an animated GIF that has the text slide back and forth or up and down, defeats OCR software in almost every case.
Just my 2cents.
Don't lose soght of the fact that many bots are feeble, most spammers are lazy and / or stupid (why else would they pst on nofollow sites?), and / or opportunistic.
No line of defense can be dismissed ... until a better one comes along.
So if you ask what colour blood is, you might accept scarlet and crimson as well as red, and also typos.
Actually I usually offer the answer CAPITALISED on a drop down list to make it obvious. I realise that this could make it less effective but it has always worked for me.
Incidentally I have built small websites for some people without this technique and the spammers almost always find them. This proves (to me anyway) that it does work.
Even the most sophisticated OCR is so far away from this goal that it's not even really possible to guess when it will get there.
Yes it's possible to create a bot that can get past an individual CAPTCHA from a large site or software package, and even to create one that will break certain similar generic CAPTCHAs, but that's it.
If you use custom a CAPTCHA instead of mass distributed software then it will work just as well as it would have 5 years ago.
If by some chance a hacker decides to target your CAPTCHA specifically then you change it and the problem is again solved.
In addition, because OCR isn't any good at reading text that has been obfuscated, even successful CAPTCHA crackers often rely on some level of brute force, which can easily be detected and blocked.
Also should be noted that a CAPTCHA doesn't have to be an image. Examples like the one BeeDee posted are also CAPTCHAs. There are so many different possible ways to implement a CAPTCHA that, even if travellers from the future give us advanced OCR technology, CAPTCHAs will never be dead.
Using an animated GIF that has the text slide back and forth or up and down, defeats OCR software in almost every case.
wouldn't they just scan the first frame of your animated gif - so moving around would annoy a human being but not the bot?
Why ever not?. If it stops spam then it it is anti-spam and it has worked for me for more than two years without a single problem.
Any spam reduction effect from CAPTCHAs is merely temporary, a side-effect of making your site less easy than some other site. As soon as enough other sites deploy real anti-spam, making it impossible to get links quickly from them, they'll be back to your site. After all, you've got no anti-spam protection.
For what it's worth, I have built some CAPTCHA-free sites, with tricks like multi-stage form submission with small delays, tokens and keyphrase-scoring. They get ridiculously little spam. Telling Computers and Humans Apart (the TCHA of CAPTCHA) is a red herring.
Whatever the 'theory', CAPTCHA works. Maybe not in 100% of cases - but close enough for 99% of sites.
Alternatives that ARE 100% ('at this moment in time') are usually far more complex, code heavy and / or expensive.
By all means propose alternatives that work - the more the merrier - but why the need to pretend that captcha doesn't work, when it so very obviously does?
Your arguments simply don't make sense.
It clearly isn't a viable security measure though - not just because it's easily cracked. If the information/asset/resource the CAPTCHA is protecting is valuable enough it's pretty simple just to hire someone willing to work for $5 an hour to sit there, look at the CAPTCHA and enter the code. This cracks CAPTCHA's, secret questions and anything else around today designed to prevent non-humans from filling out a form.
it's pretty simple just to hire someone willing to work for $5 an hour to sit there, look at the CAPTCHA and enter the code
if (!from_target_market($remote_ip)) fake_success_page();
if (!from_target_market($remote_ip)) fake_success_page();
True - but in my area the concern isn't fake orders, it's scraping of information.
