Yahoo CAPTCHA Cracked.

http://www.0x000000.com/?i=502

by hhm • 18 years ago

27 29 18 years ago

ajkirwin• 18 years ago

A long time ago I decided, that if I were to ever have a captcha system, it wouldn't use ones of that style, which are getting so.. randomized these days, it's hard for a human to read.

Frankly, I think knowledge or logic based captchas are the way to go.

"Todd is three times as old as Jane is. When Jane was ten years younger, Todd was five times as old as Jane is. How old is Todd?" for example.

Sure, takes longer to think about, but if someone can write a script to start parsing logic puzzles like that, quickly, and use it to defeat website signup authentication methods?

I'll buy that person a pint.

cglee• 18 years ago

If myspace used that system, they'd have about 99 million less users.

tomjen• 18 years ago

You better have a really good porn site if you expect me to jump through that kind of holes to use it.

Oh and Todd is 60.

derefr2• 18 years ago

"Todd was five times as old as Jane is."

I believe that that semantic flaw sadly classes Todd out of existence by 15 years (that is, t = -15).

marcus5• 18 years ago

I'd take you on that bet. Write the system and I'll write the solver. I drink Guinness :)

A better system would be to ask the user to identify the gender of a person based on an image to tell whether the picture is of a dog or of a cat and so on, these tasks are trivial for a person and very very hard for a program.

apgwoz2• 18 years ago

My introduction to AI class required us to write a classifier for people in the news (20 different images of 10 different people). We were given the location of the people's faces, but we were able to get 60% accuracy using SVMs and the 32x32 block of pixels (nose, eyes, mouth region). This was the "baseline" system. Some systems were getting nearly 85+%. I must admit though, that this was a restricted dataset, but the faces were not all looking straight ahead the way eigenfaces are, and I'm sure with enough data, and enough features that sort of CAPTCHA could be defeated a large percentage of the time.

utnick• 18 years ago

i could write a script to solve your system 50% of the time, which is probably good enough for spammers

Lockheed• 18 years ago

For photograph based captchas,the diversity will be too low and will be uneconomical to implement on a large scale.

How about animated gifs instead of static images as captchas?

whacked_new• 18 years ago

Consider an image-based, interactive captcha using drag and drop.

Show a map with a bee on it. Please guide this bee to the flower, passing the pond, the bear, and the scarecrow. Now bring the bear to the beehive; you would generate a hash string based on the sequence of visits. This may involve multiple back-and-forths, which is probably bad, but fairly brainless and robust, from what it seems, as little thought as I have given it.

buro9• 18 years ago

And highly inaccessible.

paulgb• 18 years ago

The problem is that problems that are easy to generate with a computer are usually easy to solve with one. Even if you rotated through 100 different variations, solving 10 of those would give the spammer a 10% success rate. If it is just for one small site, no one is going to break it, but there are easier ways to prevent spam on small sites (comment spam bots don't understand JavaScript for instance - something that I take advantage of on my blog).

A system like that might be good for keeping commenter quality high though :).

bayareaguy• 18 years ago

I've always thought that for blog comments, the captcha should actually take the form of a few short SAT-style questions which would test reading comprehension. E.g.

"Which one of the following is not one of the points the author is trying to make"

"Which of the following best describes the authors' opinion of Java?"

"What did the author cite as his source for his labor statistics?"

boredguy8• 18 years ago

Not only do you cut down on spam, but respondents would have actually READ the article.

That's convergence if I've ever seen it!

dawnerd2• 18 years ago

I really like to use reCpatcha. Sure it's not the most secure, but it's for a good cause, and it keeps out the basic bots.

For anyone who doesn't know what recaptcha is: http://recaptcha.net/

nickb2• 18 years ago

I wrote about reCaptcha before and the big problem with it is that it can be hard. And by hard I mean that the majority of people can't solve it. If you have a big site and you have a spam issue, then by all means, use it. But if you're a small site that's trying to grow and a site that considers every potential user to be precious, stay away from it because the last thing you want is to frustrate people!

Since you will not be a target early on, consider not using captcha at all since spammers don't target sites that have no traffic.

thomasswift• 18 years ago

do you have a link? i love to read your thoughts. I have been thinking about using recaptcha, primarily because of the little refresh button and of course the captcha.

curi• 18 years ago

comment spammers came to my blog. which has no traffic.

dawnerd2• 18 years ago

I have to agree with you on that. I only use the captcha when I absolutely need to. What I've found to work well is have the mail go through a good spam filter before you get it.

rms• 18 years ago

I'm surprised the Russian hackers gave away their implementation for free. I suspect it was an unintentional leak.

Anyone else remember that Chinese website that was selling captcha hacks for 20 different types of captchas?

dejb• 18 years ago

Oh my god! The singularity has begun!

derefr2• 18 years ago

A CAPTCHA method that just came into my head at this moment, and thus is completely unfounded and horrible: "Please compose a haiku on the topic of 'togetherness' [or something equally vague]. Your work will then be passed through a Bayesian filter specifically trained on that topic."

Yahoo CAPTCHA Cracked.

Related Stories