Worst CAPTCHA Ever

http://svedic.org/programming/worst-captcha-ever

by ZeljkoS • 13 years ago

346 164 13 years ago

svedic.org

_ikke_• 13 years ago

Well, it is a good way to tell computers and humans apart. Computers can read it, while humans can't.

They should reject corectly filled in captchas.

fosap• 13 years ago

That's a great idea. If i was ever to create a product for colorblinds only i'd use that.

ihsw• 13 years ago

It's not an uncommon strategy (eg: fill up a comment form with hidden but obviously named form fields) and since people won't be filling in those hidden fields then bots will have revealed themselves.

This isn't by any means a complete solution however it does catch 90% of drive-by spam.

wyck• 13 years ago

Well maybe they are really good and this is a honeypot.

laurent1234562• 13 years ago

You'd think, but what's so dumb about this captcha is that it's both easy to guess for a computer, but for a human too. If you look at it, the random parts are outside the readable text (which is just white on a gray background). I'd love to know what led to the "decision" of implementing something so dumb.

eCa• 13 years ago

The text has been selected, hence the single-colour backhround.

lutze• 13 years ago

You're missing the point bud, it's not that it's easy to guess, it's that the answer is in the bloody HTML as plaintext.

No guessing required.

fakeer• 13 years ago

I still loathe reCAPTCHA more than any other captcha out there. I've given up hopes of logging in on many occasions simply because of it.

Looks like it's designed for not to be deciphered either by humans or computers.

reeses• 13 years ago

It started so well, as a tool to harness collective 'intelligence' to digitize text while preventing spam. Now you're right, even the bloody accessible (audio) versions are useless. It's as if a dozen poltergeists are whispering in your ear, and you have to pick out the one that matters.

kristofferR• 13 years ago

I actually think reCAPTCHA has gotten quite good actually after they switched one of the words to a street address. Just look at the examples in this post, most are pretty easy to decode right away.

http://techcrunch.com/2012/03/29/google-now-using-recaptcha-...

senthilnayagam• 13 years ago

I totally agree, see this recaptcha which is upside down, how are we supposed to read it

http://postimg.org/image/7xgovvhij/

lmkg• 13 years ago

Technically somewhat true. Their source material is fragments of books being OCR'd that their program had issues on, some of which are literally impossible (I've seen math equations that require non-unicode characters). On top of this, they add extra distortions.

BUT! These are actually easy to solve. reCAPTCHA will give you two words, only one of which it knows the ground truth on (it's using you to solve the other). It will accept any gibberish for the one word it doesn't know. I've made a point of trying to guess which one is the 'real' captcha (usually the more-distorted one), but next time you see Cyrillic or an integral, just mash the keyboard.

nnq2• 13 years ago

And at the same time, most captcha solving services I've tried break recaptcha with no problem! And they aren't even expensive. Now, I dunno if they use fancy ML techniques or sweatshops with little African children receiving electroshocks when they get one wrong, but they do work to the point that nowadays captchas only repel legit users and very badly engineered spam bots, the good bots are already ahead of the game... I even thought of writing a browser extension that would use a captcha solving service to save legit users from the pain of captchas, but I'm too lazy to do it...

drostie• 13 years ago

Fun tip: reCAPTCHA is actually two things, the "re" and the "CAPTCHA". In other words, one half is about testing that you're not a human, while the other half is a legitimately unknown word from a source of failed optical character recognition.

You actually don't have to get the latter one anything close to right; and I think you're given the option of at least one typo in the actual CAPTCHA test.

So when a CAPTCHA looks impossible, try doing the possible half and typing in "balls" for the other half. It actually works with pretty reasonable accuracy.

chanced• 13 years ago

http://i.imgur.com/YmNjN.png - best I've gotten from them recently.

mschuster912• 13 years ago

D&B?! Aren't these the guys everyone including Apple trusts for their DUNS number?!

Are you fucking serious?

mzahir2• 13 years ago

Exactly. They're not the people everybody trusts to determine if incoming traffic is human/machine.

Your response implies that they are inept at their area of expertise.

SoftwareMaven2• 13 years ago

It's relevant if being able to automate the connection allows you to circumvent the checks Apple, et al, have put in place with the DUNS number. I have no clue, so I can't render an opinion.

mschuster912• 13 years ago

The shown website development bug does not make me confident about the quality of the rest of their website and data handling in general, so yes, I imply that they are not up to protect the data of their customers - which is the area of expertise of anyone handling massive amount of customer data.

spikels• 13 years ago

D&B has got itself a sweet little monopoly business with these DUNS numbers. They charge $299 if you want "Expedited" service otherwise (according to the FAQ) it will take "a MINIMUM of 30 business days for a new D&B DUNS Number to be processed" (emphasis added). I get the sense they just sit on you app until the 30 days are up and no actual work is being done.

They also try to upsell you to one of the many other plans starting at $299. To somewhat soften their touch the basic service is free after all. And the expedited service is free for businesses considering doing government contracting (maybe we should all consider this as we apply to the Apple developer program).

https://iupdate.dnb.com/iUpdate/showFaq.htm#Request2

thomaslutz• 13 years ago

I thought you meant the reCaptcha Audio-Version (unsolvable for humans after it got broken a few times). This is just hilarious.

codesuela3• 13 years ago

While this captcha is truly a display of ignorance I could imagine that "corporate developers" at D&B aren't web developers. All I am saying is that if you force me to write enterprise software (which I have zero experience with) on a tight schedule I'm probably going to make a stupid mistake or two even though I hope I am not of "lower quality". I imagine someone in management refused to hire web devs because "we've already got developers inhouse". Just a wild guess though.

rytis• 13 years ago

What is this thing that people call "enterprise software"?

Semaphor• 13 years ago

According to the internet it's badly written, extremely slow and very expensive software that will only get replaced after 20-50 years of use.

unclebucknasty• 13 years ago

It is exactly the type of software you'd expect to be developed by huge, lumbering, beauracratic corporations.

Several years ago when I was doing contract enterprise development work for various Fortune companies, EJB was all the rage in the Enterprise Java space. I started to feel a little rate pressure, so figured I'd better at least pick up a book and get up to speed.

About 3 chapters into it, I couldn't believe how bad it was (especially entity beans). I mean, it was almost like the perfect anti-pattern. Anyway, that didn't stop massive numbers of enterprises from jumping in head first, because it was sold as "the way" to do enterprise development. The tooling and app servers were insanely expensive too. But many IT managers didn't want to take any chances on not going the standard route.

Anyway, that about sums up enterprise software. Even for groups not into EJB specifically, the culture and thinking are the same. There is this meme that enterprise software must be more robust or scalable, etc., but the funny part is that consumer facing Web apps must typically be far more robust and dynamically scalable to serve much larger user bases. Enterprise software is typically run in a more tightly controlled environment too (specified required browser and OS, Intranet-based, etc.).

Yet, just labeling something "Enterprise" and targeting it as such, seems to command a premium.

krapp6• 13 years ago

It doesn't matter though. This isn't just a 'stupid mistake' made by a dev rushed for time, this is literally 'not a captcha.' It's not. Not even a poorly designed and incompetently executed captcha... it just isn't even one at all.

It doesn't take long to find out that best practices exist for captchas, what they are, what the typical vulnerabilities are, and then pick one from the top shelf of existing solutions once you realize captchas are hard to do properly and you're probably not being paid what it's worth to roll your own.

laurent1234562• 13 years ago

The funny thing is that the dev is apparently competent enough to make it look like a captcha, yet not enough to know what the purpose of a captcha is.

Actually, even if it was real captcha, a computer could still easily guess the answer because the random parts are outside the answer text.

jodrellblank2• 13 years ago

With hindsight, sure. But that's not looking at the whole picture.

The problem is not how much effort to stop this one mistake, the problem is how much effort to stop every potential mistake of similar importance to this.

Or worse, perhaps they did get this from a shelf of existing solutions.

unlucky• 13 years ago

Seems almost too simple... I feel like I am being tricked.

ef42• 13 years ago

A wonderful example of cargo cult programming.

sabe__2• 13 years ago

It's like all these sites that requires you to enter your current password before you can change it, but deleting the entire account is just ticking a check box (at least twitter and dribbble worked this way back when I had accounts there).

Some things we been doing for so long that we forget why we do them at all.

nostrademons5• 13 years ago

Or ones that make you confirm an e-mail address by entering it twice.

The reason you confirm a password is because you can't see the password, and so you never know if you mistyped it. Confirming an e-mail address, in a normal text field, is just stupid busywork.

natemcguire• 13 years ago

After the D&B signup process, well, I am not surprised.

ricardoz17• 13 years ago

Twitter does something similar with 3rd-party authentication. The user puts in their name and password but then the rest of the process can be done by a bot. 1. click on a button to confirm granting access 2. provide the code in an image to he App but the HTML for the code hass the following:

Next, return to TrainerLists and enter this PIN to complete the authorization process:

iambibhas• 13 years ago

Somebody is gonna get fired.

nelse• 13 years ago

That reminded me the captcha I got some time ago: http://24.media.tumblr.com/tumblr_lvy7sl13MV1r839zio1_500.pn...

jmorton• 13 years ago

But wait, how else would you make the automated tests pass?

geoffroy• 13 years ago

lol

tomjen3• 13 years ago

Stub the captcha generator with one that returns a known value...

d23• 13 years ago

Funny coincidence, I ran into this on another website yesterday. And if it weren't bad enough that it was printed in plain text in the source code, it was only checked client side with javascript. Seriously?

kevin_p2• 13 years ago

Just because something is checked client-side doesn't mean it's only checked client-side. I've used JS checking on anti-bot questions[1] quite deliberately: it doesn't have any effect on 99%+ of bots, but it stops posts by humans from accidentally being flagged as spam.

[1] admittedly questions like "type someword in this box to prove you're not a spambot"[2] rather than actual captchas, which I agree would be rather silly.

[2] if this is what you meant by a "printed in plain text in the source code" question, remember that most spambots aren't customised to an individual site, they just roam the internet submitting their crap to anything that looks like a comment form. Sure, it's trivial to write a script to parse the page and find the answer to the question - but nobody's actually going to do that for a typical company's "Contact Us" form. Adding this sort of check cuts down on spam enormously (from hundreds a day to zero), and is way easier for humans than solving a captcha.

__david__• 13 years ago

> admittedly questions like "type someword in this box to prove you're not a spambot" rather than actual captchas, which I agree would be rather silly.

This is not silly. This works extremely well for the low traffic forum I run. Since there are a huge number of phpbb3 forums out there, spammers have made spam bots specifically targeting the platform. If you make your forum epsilon different from the default then the bots don't work without manual intervention. That's enough to keep you off of autospam lists for very, very long periods of time.

And when someone inevitably adds your extra form element to their spam bot (it's happened to me 2 or 3 times over about 6 years) then you just change the answer and it stops working (and they might not even notice since it's a bot).

GuriK• 13 years ago

Have a fun guys ...

http://pro.sony.com/bbsc/jsp/forms/generateCaptcha.jsp

metaphorm• 13 years ago

too easy. try again.

<div id="captchdiv" style="position:absolute; left:10; top:15;"> <TABLE BORDER="0" CELLSPACING="0" WIDTH="170" height="30"> <tr> <td width="34" align="center" valign="top"> L</td> <td width="34" align="center" valign="bottom"> K</td> <td width="34" align="center" valign="top"> T</td> <td width="34" align="center" valign="bottom"> F</td> <td width="34" align="center"> B</td>

</tr> </table></div>

dEnigma4• 13 years ago

Oh no! I can't rightclick so how can I possibly look at the source code xD

qntmfred• 13 years ago

robbyking• 13 years ago

I've worked for managers who would've ask for features like this; they just wanted it to look like it functioned so our non-technical audience would think it was impressive.

niggler2• 13 years ago

How do audio captchas compare to the visual ones? Is it harder or easier for a computer to crack / people to understand ?

dEnigma4• 13 years ago

Audio captchas are pretty hard to solve for me personally, much harder than even almost unreadable Captchas. But maybe that's just me. Still can't imagine a bot solving the audio captchas I've heard though.

Edit: Just listen to it:

https://www.google.com/recaptcha/demo/

niggler2• 13 years ago

That is awful. In most of the triplets, the middle sound is completely drowned out by the noise

6ren• 13 years ago

Every expense was spared to give the impression that no expense had been spared. It's a credit report site; they want you to think they are secure.

dornab• 13 years ago

Exactly. It probably increases conversion because it looks secure.

Credit card forms are sometimes used that way too, they get a lot of extra information because if they don't, people feel that they're scammy.

krapp6• 13 years ago

But surely a working captcha would increase conversion as well and have the added benefit of being a captcha?

Draco6slayer• 13 years ago

That's a Douglass Adams quote, isn't it?

d0m• 13 years ago

There are different levels of "captcha". Some bots just fill any forms on any sites with their spam.. a simple client-side question goes a long way to mitigate this. It obviously is a very different story if it's a script created especially for this form.

Eliezer• 13 years ago

Wow. That's... we're lucky Homo sapiens didn't get its intelligent species license revoked for this.

krapp6• 13 years ago

The notice of our species' Sapience Rating revocation has been on display at our local planning department on Alpha Centauri for 50 years now....

lucb1e• 13 years ago

I've seen some company's code that generated captchas too. It were the first 5 characters of md5 output of rand(1,1000)...

davidroberts• 13 years ago

D&B executive's spouse: You've really got to help my little brother. He hasn't had a job since he got fired from McDonald's two years ago.

Executive: What can he do?

Spouse: He's really good at programming. He took a class in it in high school five years ago, and I'm pretty sure he didn't fail. He even has his own web page.

Executive: Hmmmmm. I think we have something he can work on....

superdude2• 13 years ago

One of my buddies worked in the accounting department at our state government. He needed to get a bunch of documents from another agency (like hundreds every month) to process claims. Well this other agency requires everyone to go through their website and download each document one at a time. They said it was to prevent abuse. For some reason they couldn't just send a batch of them to us, even a fellow state agency. So I made a scraper to download an entire month at a time. I figure it was a webforms site because it was filled with postbacks and viewstates which made it a bit of a pain, but the ridiculous thing was the CAPTCHA code:

and TFU3P was the CAPTCHA code!

pavel_lishin• 13 years ago

Isn't that one ambitious DA away from being a felony these days?

civilian• 13 years ago

Batman: You either die a hero or live long enough to see yourself become the villain. I can do those things. Because I'm not a hero, not like Dent. I killed those people. That's what I can be.

Lt. James Gordon: No, no, you can't! You're not! Batman: I'm whatever Gotham needs me to be.

[cut to Gordon at Dent's funeral]

Lt. James Gordon: A hero. Not the hero we deserved but the hero we needed. Nothing less than a knight. Shining.

[Gordon is shown on top of Gotham Central. An axe is in his hand. He is being watched by an assortment of reporters and police officers. The next lines are heard in voiceover]

Lt. James Gordon: They'll hunt you.

Batman: You'll hunt me. You'll condemn me. Set the dogs on me.

superdude2• 13 years ago

No, it was publicly accessible information from a public-facing website.

mh-2• 13 years ago

no, as I understand, that part alone would be a misdemeanor (and therefore, unlikely to be worth pursuing) under the CFAA. the alleged intent to sell/defraud is what made it a potential felony.

dreamfactory• 13 years ago

I like the fact that it is case-sensitive and yet instructs to be typed in ALL CAPS :)

rsobers• 13 years ago

I love the use of the and tags, too.

stan_rogers3• 13 years ago

is valid in HTML, and different from . It's actually being used correctly here.

saraid2162• 13 years ago

It's valid, but it's one of those things that shows they're not a web developer. We don't use or anymore. That's what CSS is for.

ericz• 13 years ago

You know, maybe it's because they just wanted to slow down legitimate users for some reason, and spam wasn't a big problem. Ok I'm just trying to be optimistic.

bjoe_lewis• 13 years ago

D&B. Trolled.

dmazin• 13 years ago

Speaking of, has anyone else noticed that captchas (especially recaptcha) have gotten a lot harder over the last year?

nlh• 13 years ago

I have indeed. Anyone have more details? At one point I recall (re)CAPTCHAs being about helping OCR slightly less-readable words from book scans. But they were actual words. They seem to be gibberish words now.

SolarNet• 13 years ago

Maybe they ran out of non-gibberish readable things to OCR?

malandrew• 13 years ago

I've noticed that they occasionally have characters that are available in unicode, but are not part of the characters that are available on a 105-key keyboard with or without the shift key.

THe most common one I see is the integral symbol that used to be used as an S. On very rare occasions I see characters like:

codesuela3• 13 years ago

Those are the ones googles OCR couldn't decipher. Only one word (the random characters with a asymmetric background and maybe a line through them) matter. Once you know that you stop typing the part that doesn't matter. I usually just type asd (actual captcha)

JoaquinRoca• 13 years ago

This is hilariously awful. Thanks for sharing. I recently moved all my CAPTCHAs to games with AreYouAHuman.com and I love it.

polskibus• 13 years ago

this should be submitted to thedailywtf.com

brevityness• 13 years ago

One odd quirk I've noticed with CAPTCHA's is that requesting a new one almost always returns one that is far more legible to discern. Is this by design?

don_draper• 13 years ago

Hey D&B developer here. I'm excited to see so much interest in my work. If the captcha is correct we categorize it as a bot and don't let it through. If the captcha is incorrect then it must be a human and we let them through.

Good news: we're hiring! We have day long meetings Mondays and Wednesdays, but other than that it's great.

aprescott2• 13 years ago

I don't really understand this approach. Won't the false positive rate be close to 100%? Humans are going to get the captcha right every time. If it's supposed to be a honeypot system, the input should be hidden from human users to avoid that problem.

bjxrn• 13 years ago

Pssst. I don't think that was seriously a post from a D&B developer.

Groxx• 13 years ago

The last "I" and "I" are swapped with CSS. Bots don't realize this, but humans do.

1bitwonder• 13 years ago

I've seen one where it was always:

"What is 2+4?"

Jeremy1026• 13 years ago

I put a super basic human authentication system on my wedding website in the online guestbook. It was just a simple form that was getting hit with spammers, so I added a super quick "What is the groom's name?" field to the form for authentication. Spam stopped completely. Sometimes, depending on the website, a super secure captcha isn't needed.

njbooher• 13 years ago

Wrong. The worst CAPTCHA ever is http://www.solvemedia.com/

jpdoctor• 13 years ago

LOL. So someone is doing automated lookups on the D&B site, they noticed, and then they put a broken captcha on the site.

Really, the only thing wrong with this picture is that they got called out on HN, so now whoever is doing the automated lookups won't be able to kill off D&B by releasing their information.

smegel• 13 years ago

Security by "no one would be that stupid"

meistro• 13 years ago

Two years ago I had to deal D&B's flagship product, which came packaged in a Java applet. I remember one day I upgraded to the latest version of Java(a security patch) and it broke their tool. After contacting them they said the only solution was to downgrade to the Java version with a known security hole...

pkulak• 13 years ago

I find it hard to believe that you could be smart enough to build something like this, while also being dense enough to think that it's actually a CAPTCHA. My guess is that some pointy-haired boss really wanted a CAPTCHA and the developer didn't think it was needed. Everyone's happy.

Of course, the developer could have also just slapped RECAPTCHA on there and been done in even less time...

L0j1k• 13 years ago

This should give you a really good idea what it's like trying to get a DUNS number (a requirement for doing contract work with the government as a business). Their entire business is basically the front-end to a scam. Somebody pulled a network contact to wedge their company in between businesses and the federal government.

You are guaranteed to get scammy-sounding emails and phone calls from D&B after signing up. Emails with subjects like "Your business is in danger!" or messages like "Your business credit report has some big issues!" and you find out that in order to get "protection" or to find out what these "issues" are, you have to pay Dun and Bradstreet a shitload of money.

That company is a SCAM and a perfect example of how completely retarded/bought-and-paid-for the United States government is.

dsl• 13 years ago

They have the same slimy up sell tactics as every other credit reporting agency, but the core business is far from a scam.

The startup crowd doesn't see it much, but D&B is a critical component of how non-technical medium to large businesses vet each other and prevent fraud. They are effectively the Better Business Bureau for B2B.

harryh• 13 years ago

It's not just contract work with the government. Once you are a business of sufficient size it's almost inevitable that you'll run into some random thing where you're required to have a DUNS number before proceeding (and it's always unclear why this is a requirement). So dumb.

ed2417• 13 years ago

Your data will be safe with us!

cefarix• 13 years ago

My company got a couple of emails from a "credit advisor" Stacy at D&B with no subject. Then in the third email, from the same person... the email was typed out in the subject and there was no body. facepalm

rhapsodyv• 13 years ago

https://gist.github.com/rhapsodyv/5279369/raw/88af15fdba655b...

This is a cpf (something like social security number in brazil) validator from this site: http://via7solucoes.com.br/curriculos/cadastro.asp

drakaal• 13 years ago

D&B is in the business of selling your corporate data to marketing companies. They claim that they never share their data base in an automated way, and to protect this information, so that it is only human readable but it is in their best interest to let companies have access. Likely this is there to allow miners, not specifically because they are incompetent, but because they are dishonest.

jmotion• 13 years ago

Thing is, this will actually stop most contact form spam software.

exodust2• 13 years ago

I don't see the problem. It's easy for people to see the word and type it in. Lightweight but not insignificant measure of protection. Compared with no protection, this form will receive less spam.

There is no impact on the user except a better user experience.

The corporate developer may have looked at the spam levels and decided that a basic measure would be fine considering the exposure to the page, or other reasons.

CAPTCHA is anti-people. It's a step back to the dark ages every time a website asks you to type in a fuzzy word, often just a jumbled string making it even worse for reading.

Surprised some comments are taking aim at the developer, who at least isn't using the stupidly backwards, barely visible full version of captcha. Check en.wikipedia.org/wiki/CAPTCHA it's a joke that the examples posted there seem so much easier than the overly-abstract usual suspects out there in reality. That wikipedia article needs a new section, something like 'criticisms' or 'UX Fail'.

D&B's 'captcha' is whack? So is Google's.

WatchDog• 13 years ago

Why even bother adding the background image if you are just trying to stop dumb spam crawlers.

exodust2• 13 years ago

Very true, why indeed. A misunderstanding of how spam crawlers work? Btw, how do spam crawlers work?

People must prove they are people. And spam crawlers don't need to prove anything. Turing wouldn't have liked his name associated with a test that humans fail often (needing to refresh the captcha), and a test that machines must fail in order to be effective.

petercoolz• 13 years ago

I hate hate hate D&B. so scammy and spammy and worthless. I think their corporate structure reflects the scam... One company issues the DUNS # but another is the telemarketing spammy one that calls you for years afterward.

heroic• 13 years ago

Beats this! http://www.hmv-news.co.uk/register.php

aragot• 13 years ago

That's an April Fools!

...or isn't it?

Worst CAPTCHA Ever

Related Stories