Goodbye (Crummy) CAPTCHAs. Hello Ad Dollars?

http://mediamemo.allthingsd.com/20100920/goodbye-crummy-captchas-hello-ad-dollars/

by jkopelman • 16 years ago

76 79 16 years ago

mediamemo.allthingsd.com

mikemol3• 16 years ago

Tried signing up for an account. They eat their own dogfood, for which I'm thankful.

It looks like the advertisers can force you to click through to get the security code. (e.g. Catfish's "Click through to see the security code!") I'll pass.

CTISN2• 16 years ago

Funny, I first noticed how they don't eat their own dogfood. They don't have a captcha on their contact form: http://www.solvemedia.com/contact.html. Seems to me like that would be a good place to have one.

mikemol3• 16 years ago

They have (or had; not checking again) one on their sign-up form. That they don't have one on their contact page suggests they don't know what CATPCHAs are for...

almost2• 16 years ago

So you replace the hard to read CAPTCHAs with easy to read ads. Of which presumably there will be a limited number in circulation at any one time. Sounds kinda easy to circumvent...

aristidb• 16 years ago

Indeed. Without some form of randomisation (which advertisers probably do not want), this would drastically lower the price of solving a captcha. Because you need to submit each ad to a human solver network only once, and can store the solution.

mseebach5• 16 years ago

A longtime standing solution to hard-to-read captchas are easy to read (but hard to process) captchas. E.g. show a picture of an animal or a shape and ask what it is, or even just ask a simple math problem or riddle in writing.

Problem with those are that they need to be constantly updated from a reliable source, or else, once the solution becomes popular, the spammer can bruteforce it in linear time (no matter how high N is, there are only N possible patterns).

This seems to be an attempt at fixing this. Ads are often relatively short lived so by the time the spammer has them bruteforced, it might be out of circulation - and more importantly, there are new ads in. It's an armsrace, and this is a way to pay our troops. Also, it's trivial for advertisers to make many different variations (e.g. one for each sales bulletpoint), so there are many variations in circulation. Since there's often more textual content than the password in the ad, they're not prone to simple OCR, while still easy to comprehend for the user.

Obvious shortcomings are if ads are not so shortlived, and if it's easy to identify and break classes of ads (e.g. if it's yellow and has the IE logo in position X, OCR area Y, done). Also, it's a bit of a dealbreaker if I'm forced to open and visit a website to get the password.

olegk4• 16 years ago

You have no idea what you're talking about.

> show a picture of an animal or a shape and ask what it is,

Ok, so let's say you come up with pictures of 20 different animals. A spam script that picks the same answer every time will have a 5% success rate.

> or even just ask a simple math problem or riddle in writing.

Computers are way better at solving most math problems than people.

pedalpete2• 16 years ago

Your argument is somewhat flawed from a technical level as Olegk mentioned, but also from a business marketing stand-point.

Specific ads may be in circulation for a short time, or there may be many running concurrently, but it is the message that the advertiser is trying to get across, the tagline, and it would be of most benefit to the advertiser to get the user to associate their brand with a single concept. Using the example in the article, Subaru may want to be associated with "outback", not "four wheel drive" or "comfy" or "sporty". Businesses who try to target too many things or too wide an audience end up not getting their message across.

I'm not saying that what Solve Media is trying to do isn't a great idea. I think it has lots of potential, but they clearly still have more to work on.

shalmanese• 16 years ago

This was the process used by the Microsoft Research project ASSIRA (http://research.microsoft.com/en-us/um/redmond/projects/asir...) which used images of kittens and puppies put up for adoption as a constant fresh source of input data.

This was later, awesomely riffed on by HotCaptcha (http://valleywag.gawker.com/246656/a-face-only-a-bot-could-l...) which pulled HotOrNot data and asked you to select the 3 hot women out of 9. Sadly, the site is down now but I remember trying it and it was remarkably useful and a hell of a lot more fun than word captchas.

il5• 16 years ago

You know, most modern capchas are not solved by bots, but by people in third world countries solving them for pennies. The current going rate is about $1/1000 and there are easy to use captcha solving APIs for any platform. capcha has long provided an illusion of security, nothing more. Any and all captchas will be broken.

almost2• 16 years ago

£1/1000 is still more expensive then if they could be done with human input. And they need to be done for every time a captcha is needed, with this scheme you could presumably pay for humans to solve the adds currently in rotation (ten? hundreds? thousands? not more than that) then just remember the results.

jchonphoenix3• 16 years ago

I know the founders of reCaptcha. This is easier to prevent than you think. Its also quite rare.

jfager3• 16 years ago

Before adding captchas to my stupid personal blog, Akismet was catching ~300 attempted spams a day, and I was manually flagging ~2 a day.

Then I installed reCaptcha, and now Akismet catches ~10 a month, and I've had to manually flag zero.

I'll take that illusion, thanks.

TorKlingberg• 16 years ago

I don't think having people solve capchas for money is all that common. Do you have a source or something? Even if it is common, capchas still stop those spamming strategies that rely on each spam being free for the spammer.

Ilovepee3• 16 years ago

yeh but you gota look at it from a business standpoint who profits from the outsourcing? why would a website owner pay to outsource the ads to get solved in india just to get blacklisted then lose revenue that would have come in anyway for less

jarin• 16 years ago

The article isn't totally accurate, I tried it out and got a trailer for Devil.

I would probably use this for media views or file downloads, but I wouldn't use it for signups because I think it would decrease conversions.

uptown• 16 years ago

I'll be happy with anything other than today's captcha solution. These are some captchas from my hall of fame:

http://www.twitpic.com/2qbv0e/full

fourneau• 16 years ago

Captchas like these make me wonder if I'm a robot...

I was a big fan of this new captcha idea until the video.

jncraton• 16 years ago

Those CAPTCHAs really aren't that bad. If I understand how ReCAPTCHA works, you only need to get one of the words correct.

zach• 16 years ago

You know that, I know that, but if everybody knows that you only have to enter the easier-to-read semi-nonsense word then ReCAPTCHA itself doesn't work so well for its larger purpose.

And if you don't know that, then giving someone a CAPTCHA with Hebrew or a Rorschach inkblot in it when they're trying to buy Yo Gabba Gabba Live tickets for their four-year old is a surreal enough experience to make people think they're living in a situation comedy.

mdolon• 16 years ago

Their sign up page required me to watch a video in order to get the security code. While the code came up a couple of seconds into the video, I still dislike the thought of having to watch and wait for ads to somehow contribute to a website (be it through comments, sign ups, etc).

pacak• 16 years ago

IE = Browse safer? I don't think so. Anyway, I am not going to leave comments on sites, which wants to turn my attention on useless junk like ads.

tomjen33• 16 years ago

Damn, that is both smart and evil (because the user can't ignore these kind of ads).

What can we do to make sure this product doesn't catch on?

hellweaver666• 16 years ago

If you don't want them to catch on, refuse to sign up to any service that uses them. Simple.

akadruid2• 16 years ago

In the long term, ugly, hard to use websites will loose. It can be a very long term in some cases. Just be patient.

tomjen33• 16 years ago

Thats the usual suggestion - but not using it isn't enough to kill IE6.

So what can we do that will actually work?

msy• 16 years ago

I spent a minute trying but no, I cannot think of anything that would make me go 'well fuck you' and go elsewhere faster then being expected to type out ad copy like a school child.

pedalpete2• 16 years ago

and yet you will gladly type randomized and difficult to read letters or words?

This is actually attempting to solve two problems at once, and in some ways it could be more interesting to the user if the ads are well targetted.

Why not help the site owner make a bit of $$??? are you really afraid that typing in a bit of ad copy is going to turn you into a mindless drone

melissamiranda• 16 years ago

I'd rather type random characters than "Safer Browsing" for an IE ad. You have to consider the emotional reaction to these ads.

akadruid2• 16 years ago

You've got the nail on the head. Capatcha publishing sites are already weeding out the idiots who will jump through hoops to join and blog comment argument or whatever it is - now they can sell the idiots to the highest bidder. Even if they get more spam, the idiot just earnt them cold hard cash in exchange for the spam, and you can still go back to solving spam the non-capatcha way.

It's evil, but evil in a kind of clinically beautiful way. I'd say it stands a good chance of working in the short term too - like punch they monkey ads made a lot of money for some people back in the day

tomjen33• 16 years ago

If the site owner is going to make money of that, then the only reason it is economically feasible to do so is if the brand owner gets at least that from the value of showing me their ad.

The only way to do that is if it works.

So yeah, I am concerned.

yesimahuman• 16 years ago

Did you go to their signup page? They had one that said "watch this ad clip to reveal the security code" and you had to watch the video to get the code to enter.

Interesting idea, but I would never watch an ad clip to signup for something nor would I want my users to have to.

niyazpk• 16 years ago

Yeah, this is exactly what I want - remind the user about some other brand in the exact same signup page where I should actually try hard to win him over.

Not to mention how ridiculously easy it will be to break these limited edition captchas.

notahacker• 16 years ago

Works just fine for a blogger that doesn't care too much whether you complete the captcha or not but likes the few extra bucks he makes on a well-commented blog entry.

petsos• 16 years ago

Not if the well-commented blog entry is 99% viagra comments.

bl4k• 16 years ago

here is the challenge I got when I signed up for the service: http://imgur.com/x5hoN.png

for the solution I put in 'stupid', and it worked

this definitely doesn't solve the security considerations that captchas were designed for.

Update: Ok so it didn't take long to break this thing. These guys have the plain text of the CAPTCHA in the document DOM. It isn't even an image - the CAPTCHA is rendered in javascript. See: http://imgur.com/9VO4J.png

The 'brand' logos are an image, but they are simple to OCR.

So to break this CAPTCHA, simply hook v8 up to your auto-submit bot and interpret the JS that is being returned to you. You can't read it from the client because they serve that IFRAME from a diff domain - so they base their security on the browser x-domain policy. But that is all moot if you are building a bot, or if you build a browser extension that solves these things.

StavrosK2• 16 years ago

And since this CAPTCHA isn't secure at all, they'll remove the security element altogether, making it a more annoying version of a banner ad.

scrrr• 16 years ago

If successful this can be copied easily and successfully by anyone. But I hope it won't succeed. Instead things like openid should be more widespread so I don't have to enter a captcha in the first place.

Timmy_C2• 16 years ago

What's going to happen if I'm asked to fill out a CAPTCHA like one of these while I am browsing with Adblock on?

Timmy_C2• 16 years ago

When I saw the title of this article I thought it was going to be about removing CAPTCHAs in favor of higher conversion rates . . . even if it means more SPAM.

jchonphoenix3• 16 years ago

I know the professor who created CAPTCHAs fairly well (did research with him) and I can say that these captcha's are missing the point of captcha's.

The hard to read word is there to prevent spammers. With easy to read words, you have a limited number of words per a page. In the end, the probability that a program randomly guessing the assortment of words (O(n^2) combinations if we assume order) is actually quite high.

mmastrac• 16 years ago

I don't often hope for entrepreneurs to fail, but I think this is a place where they are actually making the world worse. Not only do they completely fail at what they are trying to do (ie: prevent spam), but they do so in the most possibly annoying way.

I'll gladly contribute my time towards writing browser extensions to hide and automatically solve these things if they take off.

zentechen• 16 years ago

People are making everything into an ad. Stop creating more junks!

cobbal• 16 years ago

It seems to me that they're not attempting to prevent spam, they're merely trying to monetize what has become the standard practice of entering CAPTCHAs. going with something like this it's trading in spam prevention for cash. The legitimate users already expect to see a CAPTCHA, but you're using it for a different purpose

mikeknoop• 16 years ago

How about this for a CAPTCHA, a video ad unit where the questions are akin to those old SCENEIT questions?

Ie, what color shirt was the man pumping gas wearing?

Bonus points if you tell the user the question after the video so they have to re-watch.

metageek• 16 years ago

I hate wasting my time on videos even when they're about things I'm interested in; I'm not going to use a service that forces me to watch one I'm not interested in.

randomtask• 16 years ago

This sounds a lot like what Vidoop tried to do. Their initial idea was to replace passwords with an authentication mechanism based on selecting a number of pictures that fit into user-chosen categories. A person would select 3-5 images from a grid of 12 with each image belonging to a distinct category. Those who picked the images, in the correct order, corresponding to their chosen categories (selected on sign up to the service) along with their username was deemed authenticated. As far as I know they hoped to make money by selling ads within the categories, so if one of the categories displayed was "pets" you might see ads for petfood for example. They moved into doing captchas at some point too.

Anyway, it seemed like a promising idea, but they folded last year. Good write up from a former employee here: http://factoryjoe.com/blog/2009/06/05/the-fall-of-vidoop/

CTISN2• 16 years ago

Vidoop was bought up by Confident Technologies, which is still doing the image-based captcha as well as image-based authentication for Web and mobile: www.ConfidentTechnologies.com. The free MyVidoop service is still around too.

zabraxias• 16 years ago

I think the idea is an excellent example of how to think creatively but it would take me a long time to find the ad version of a captcha since I would see it as an ad and ignore it.

In any case I'll be watching their progress with this idea.

dannyr• 16 years ago

I had a similar idea a few years ago. I thought my idea was original but when I did my research, several companies have already thought of it.

Microsoft http://www.internetnews.com/webcontent/article.php/3836421/M...

Yahoo http://www.faqs.org/patents/app/20090012855

Ad Captcher http://adcaptcher.com/

9ec4c12949a4f3• 16 years ago

This is not a replacement for captchas.

photon_off2• 16 years ago

Normally, I refrain from writing such bad things about start-ups and people's ideas, unless there is something really awful about it. In this case, it's obvious how terrible this service is, both in terms of how it treats the user (who wants to do you a favor by signing up) as a cow to be milked, and how the implementation of it does very little to solve the actual problem of spam. It's just a greedy and short-sighted idea. I won't write any more about how stupid it is.

What I will note is that it is somewhat inspiring to see that an idea like this can get off the ground. I haven't dug into the details of "Solve Media", but I assume that some people poured a sum of money into this. Maybe there's a sucker born every minute, or maybe confidence in anything internet-related is just that high. Hopefully, both things are true, and I think that's a good thing. I'm not advocating taking suckers' money, but rather believing the following: If your idea is anything better than this, which it likely is, you have a shot at it.

mikemol3• 16 years ago

Users creating and using free accounts have costs associated with them. Those costs need to be met in order for the service to continue, either by tying a revenue model to the users directly, via charity, or by subsidizing their use of your resources by using something they contribute, such as content.

Selling user content is not a stable net in proportion to user use of the site; you don't know that the content will continue to sell at a rate keeping pace with user-incurred costs.

Charity is also not a stable net in proportion to user use of the site; nothing directly and reliably ties charity income to user-incurred cost, and nothing can--it's charity.

The only way to meet proportionate cost incurred by user use is by tying a proportionate revenue to user use. Even if you don't charge a user to use the service, even if you only ask that they fill out a text box to use the site, just as they might with reCAPTCHa, it suddenly becomes 'milking the user'.

Sadly, users no longer merely expect services to be free for them, they get offended if the service provider derives any money at all for their activity. (I think I sort of understand the mentality--"Why are they getting money for my work, when I'm not?"--but that logic doesn't hold up if no money was changing hands while they did the work anyway.)

You're also rather vague about what "the actual problem of spam" is. What strikes you as a mere symptom, and what strikes you as a cause? Yes, these peoples' particular implementation of challenge-response is pretty poor. Is that what you were specifically referring to, or did you have something else in mind?

photon_off2• 16 years ago

Very good points here.

I failed to remember that captchas are indeed used for other things besides registering as a member to a site. Things like one-time viewing of information (eg: WHOIS), etc, will probably benefit a lot from this. I showed some oversight claiming this service was dumb. It's great for things where it's OK that I get insulted, because I want to see something bad enough anyway.

I was in the mindset of imagining this being on a registration form to become a user of a website. I think the money lost from the amount of users getting turned off by this would be greater than the one-time profit incurred whenever a user registers. That is, unless your site profits from less users. In equation form:

(amt profit per lifetime of user) x (number of users that won't sign up because of this) > (amt of users that do sign up with this) x N [where N is how much you make from this ad captcha].

Notice that the longer you plan on retaining users, the less you should be willing to risk slowing down your sign-ups, unless this ad captcha offers a high enough profit. It is my opinion that for sites seeking long-term relationships with users, that this thing sucks. On the other hand, if you can afford that the user not continue beyond a point, then it's great. That's why it'll work for porn and other seedy crappy sites, and probably why I have low regard for it. I admit this is a foolish mindset.

In regards to "actual problem of spam," I was referring to the answer of the captcha being in the DOM, and the otherwise flawed implementation of it.

agscala• 16 years ago

What's wrong with recaptcha anyways? I actually like helping with translations of book scans.

steilpass• 16 years ago

There is a German startup which has been doing this for quite some time: http://www.captchaad.com/

ciupicri• 16 years ago

This is not a new idea. http://adcaptcher.com/ is at least one year old and it's already being used on a couple of sites.

hkim• 16 years ago

Guys, isn't ycombinator all about helping us become good entrepreneurs? Why tear down a good effort? How is this productive? These guys have serious supporters and cliemts so they have to be on to something

Goodbye (Crummy) CAPTCHAs. Hello Ad Dollars?

Related Stories