Comments on: Coming Captcha Crisis http://www.virtualblight.com/articles/feature/captcha-plays-an-essential-role-as-the-first-line-of-defense-for-web-20-sites-against-vandals-and-marketers-trying-to-exploit-user-generate-content-sites-blogs-and-opinion-sites-to-hawk-their-produc/ When bots move in humans move out! Thu, 24 Dec 2009 03:11:01 -0700 http://wordpress.org/?v=2.8.2 hourly 1 By: A few external links to Captcha related articles http://www.virtualblight.com/articles/feature/captcha-plays-an-essential-role-as-the-first-line-of-defense-for-web-20-sites-against-vandals-and-marketers-trying-to-exploit-user-generate-content-sites-blogs-and-opinion-sites-to-hawk-their-produc/comment-page-1/#comment-898 A few external links to Captcha related articles Tue, 26 May 2009 16:03:54 +0000 http://www.virtualblight.com/articles/?p=20#comment-898 [...] http://www.virtualblight.com/articles/?p=20 [...] [...] http://www.virtualblight.com/articles/?p=20 [...]

]]> By: Kuukunen http://www.virtualblight.com/articles/feature/captcha-plays-an-essential-role-as-the-first-line-of-defense-for-web-20-sites-against-vandals-and-marketers-trying-to-exploit-user-generate-content-sites-blogs-and-opinion-sites-to-hawk-their-produc/comment-page-1/#comment-187 Kuukunen Tue, 07 Oct 2008 20:47:16 +0000 http://www.virtualblight.com/articles/?p=20#comment-187 AAAA PANIC! THE MACHINES ARE OUT TO GET US!!!! Feh. Lot's of FUD and fail in this post. "The problem? Captchas don’t work anymore." So wrong. People just need to actually start thinking about how to make good CAPTCHAs. EZ-Gimply (or spelled correctly "EZ-Gimpy") was one of the first CAPTCHA systems. IT WAS NOT A SYSTEM FOR BRAKING CAPTCHAS. Besides, it's very old news. Also, the article gives the impression bots can break 35% of all CAPTCHAs. The article talks about YAHOO's CAPTCHAs... Please try to read your own references. What the hell are you using? I want to see you make a program for these: http://ocr-research.org.ua/teabag.html (Also has a list of weak CAPTCHAs) Sorry, for hostility, but this is the worst articles I've read in a while... I wonder why I am reading this anyways... AAAA PANIC! THE MACHINES ARE OUT TO GET US!!!!

Feh. Lot’s of FUD and fail in this post. “The problem? Captchas don’t work anymore.” So wrong. People just need to actually start thinking about how to make good CAPTCHAs. EZ-Gimply (or spelled correctly “EZ-Gimpy”) was one of the first CAPTCHA systems. IT WAS NOT A SYSTEM FOR BRAKING CAPTCHAS. Besides, it’s very old news. Also, the article gives the impression bots can break 35% of all CAPTCHAs. The article talks about YAHOO’s CAPTCHAs… Please try to read your own references. What the hell are you using?

I want to see you make a program for these: http://ocr-research.org.ua/teabag.html (Also has a list of weak CAPTCHAs)

Sorry, for hostility, but this is the worst articles I’ve read in a while… I wonder why I am reading this anyways…

]]> By: Chris http://www.virtualblight.com/articles/feature/captcha-plays-an-essential-role-as-the-first-line-of-defense-for-web-20-sites-against-vandals-and-marketers-trying-to-exploit-user-generate-content-sites-blogs-and-opinion-sites-to-hawk-their-produc/comment-page-1/#comment-94 Chris Fri, 29 Aug 2008 07:24:48 +0000 http://www.virtualblight.com/articles/?p=20#comment-94 If we can read them. Eventually machines will too. But at that point will we really care about the difference? If we can read them. Eventually machines will too. But at that point will we really care about the difference?

]]> By: Blake Elias http://www.virtualblight.com/articles/feature/captcha-plays-an-essential-role-as-the-first-line-of-defense-for-web-20-sites-against-vandals-and-marketers-trying-to-exploit-user-generate-content-sites-blogs-and-opinion-sites-to-hawk-their-produc/comment-page-1/#comment-89 Blake Elias Mon, 18 Aug 2008 15:47:25 +0000 http://www.virtualblight.com/articles/?p=20#comment-89 @<a href="http://www.virtualblight.com/articles/?p=20#comment-25" rel="nofollow">djtip</a>: That's a good idea, but much like the difficult CAPTCHAS, we don't want it to be too hard for humans to figure out either. The example you gave was simple enough, but how far can that go before it gets too complicated? You don't want to start asking obscure trivia to average users. A simple name-that-object test might do well, like showing a picture of an apple, an orange and a lemon and you have to enter "apple, orange, lemon" as verification. I don't think just having a new verification method is going to be enough. I think the key is to mix it up a bit, have a bunch of different methods in use, and consistently roll out new ones. So far we've always had the same one concept for verification, and this has allowed the black hats to focus on one task: beat the CAPTCHA. If new systems employ <i>a bunch of different methods</i> of verification, we'll keep them guessing. They won't have one thing to crack, they'd be one step behind with all the different verification methods. And we can't stop there, we should (somewhat regularly) introduce new methods as the old ones get weaker. We've been lazy so far, assuming that the CAPTCHA would cover us forever. It was once considered all but unbeatable, and has now been beaten. What's stopping the next "unbeatable" system from eventually getting beaten? We can't be lazy, we have to take a new approach altogether, which is to not give black hats the simplicity of one system to crack. @djtip:
That’s a good idea, but much like the difficult CAPTCHAS, we don’t want it to be too hard for humans to figure out either. The example you gave was simple enough, but how far can that go before it gets too complicated? You don’t want to start asking obscure trivia to average users.

A simple name-that-object test might do well, like showing a picture of an apple, an orange and a lemon and you have to enter “apple, orange, lemon” as verification.

I don’t think just having a new verification method is going to be enough. I think the key is to mix it up a bit, have a bunch of different methods in use, and consistently roll out new ones. So far we’ve always had the same one concept for verification, and this has allowed the black hats to focus on one task: beat the CAPTCHA. If new systems employ a bunch of different methods of verification, we’ll keep them guessing. They won’t have one thing to crack, they’d be one step behind with all the different verification methods. And we can’t stop there, we should (somewhat regularly) introduce new methods as the old ones get weaker.

We’ve been lazy so far, assuming that the CAPTCHA would cover us forever. It was once considered all but unbeatable, and has now been beaten. What’s stopping the next “unbeatable” system from eventually getting beaten? We can’t be lazy, we have to take a new approach altogether, which is to not give black hats the simplicity of one system to crack.

]]> By: djtip http://www.virtualblight.com/articles/feature/captcha-plays-an-essential-role-as-the-first-line-of-defense-for-web-20-sites-against-vandals-and-marketers-trying-to-exploit-user-generate-content-sites-blogs-and-opinion-sites-to-hawk-their-produc/comment-page-1/#comment-25 djtip Fri, 28 Mar 2008 17:29:26 +0000 http://www.virtualblight.com/articles/?p=20#comment-25 I wonder if a captcha-thesaurus strategy would improve the situation; ie, instead of having to fill in the word you see in the image, you could fill in the word that's described by the text in the image. Eg the captcha could say: four-legged animal that likes bones (three letters) and the user types in 'dog'... I wonder if a captcha-thesaurus strategy would improve the situation; ie, instead of having to fill in the word you see in the image, you could fill in the word that’s described by the text in the image. Eg the captcha could say: four-legged animal that likes bones (three letters) and the user types in ‘dog’…

]]> By: Matt Chanoff http://www.virtualblight.com/articles/feature/captcha-plays-an-essential-role-as-the-first-line-of-defense-for-web-20-sites-against-vandals-and-marketers-trying-to-exploit-user-generate-content-sites-blogs-and-opinion-sites-to-hawk-their-produc/comment-page-1/#comment-13 Matt Chanoff Fri, 07 Mar 2008 22:32:39 +0000 http://www.virtualblight.com/articles/?p=20#comment-13 The news that some Russian hackers have effectively beaten gmail's captcha (http://www.websense.com/securitylabs/blog/blog.php?BlogID=174) kicks this up to a whole new level. The news that some Russian hackers have effectively beaten gmail’s captcha (http://www.websense.com/securitylabs/blog/blog.php?BlogID=174) kicks this up to a whole new level.

]]>