Captchas are Becoming Ridiculous

https://www.andrewmunsell.com/blog/captchas-are-becoming-ridiculous

by JoshTheGeek • 12 years ago

330 194 12 years ago

andrewmunsell.com

opendais2• 12 years ago

I agree that those captchas are obscenely bad. :)

I think we really, really need a replacement solution for them that works as reliably vs. bots.

ChuckMcM• 12 years ago

So at what point do we 'switch over' which is to say that the Captcha code realizes that if you solve it your a robot/script because humans can't ?

opendais2• 12 years ago

The API stuff that solves these captchas is really akin to Amazon's Mechanical Turk and outsourced to places like India.

http://antigate.com/

Scroll to the bottom.

sp332• 12 years ago

The squished-up word is the control word, and the straight one is the unknown one. You only need to get the wavy word right and just guess at all the cut-off examples.

Nyubis• 12 years ago

^ This is the way to go. Don't waste any energy on the "unknown" word, just fill out the one that has been smeared out and fill in bogus for the rest.

If you want to post on 4chan and don't have a Pass, you need to solve a captcha for every single post. It becomes easier with practice, I fail maybe 1 in 10 captchas. And the more captchas you solve correctly, the easier the captchas for your IP get.

ademarre2• 12 years ago

If enough people colluded to use the same unknown word, say "foobar", then couldn't they train recaptcha to believe that is the true value of the word? If I understand recaptcha correctly, and assuming they don't detect collusion well, then eventually the known word pool would get poisoned with a surplus of foobars.

Alupis6• 12 years ago

I've solved a lot of captcha's in my time, and really have never experienced the trouble the author is detailing. Not only am I relieved when I see a reCaptcha since they are some of the easiest and most forgiving challenges, but I don't recall ever having repeated bad/unsolvable challenges presented on the same page.

Sure, maybe sometimes you get a weird one and fail it. But typically the next challenge is easy to pass. Seems the author cherry-picked some of the worst reCaptcha examples for the article, but wrote it in a way that made it seem they were presented back-to-back.

Besides this -- the article makes no attempt to offer a better solution.

Captcha's are really the best way we have right now to "prove" someone is not a bot. Hidden Form fields, etc, don't work and are easily spoofed. Sure Captcha's can be beaten by bots sometimes -- but I trust Google's scale/volume with ReCaptcha to handle that for me (for the most part).

Captcha's are not going anywhere anytime soon.

ademarre2• 12 years ago

Captcha's are not going anywhere anytime soon.

You're probably right. But the fact remains that captchas aren't good enough. They can be partially automated; blackhats can use captcha solving farms which will be at least as accurate as the average human (probably more accurate, I imagine).

A better solution might employ heuristics similar to DDoS mitigation techniques. I really don't know, but there is a need for something better here.

VLM• 12 years ago

"Captcha's are not going anywhere anytime soon."

Its turning in to the new version of "3rd world outsourced phone support" A strong indicator the user simply doesn't care about the customer experience.

For some industries / companies, this is perfectly OK and BAU. For others it can be a company-killer.

I see a captcha and I know the company doesn't like me, doesn't like what I'm doing, and doesn't care if I know how they feel about me. And for some situations that's perfectly OK. Certainly not all.

vitd• 12 years ago

Besides this -- the article makes no attempt to offer a better solution.

That's completely irrelevant. Criticism is not about solving the problem. It's about pointing out that the current solution is inadequate.

Most movie critics never wrote, directed, or acted in movies. It doesn't invalidate their criticism.

In fact, your criticism of the other poster's criticism doesn't offer a better solution than criticism either. You simply criticize that post. (And that's OK, if ironic.)

Kluny• 12 years ago

If you look farther down the page, you'll notice hashcash launched their proof-of-work captcha replacement thing today. I'm not saying it's related, but both of these are on the front page together.

beedogs• 12 years ago

Captcha's are not going anywhere anytime soon.

Which is truly unfortunate, as they're a fucking abomination, an embarrassment to the IT industry in general.

Try solving these actual examples:

https://i.groupme.com/311x122.png.48e978e0def70131a42422000b...

https://i.groupme.com/495x276.png.4da125f0def70131a42422000b...

liveoneggs• 12 years ago

have you tried this recently? zendesk's use of recaptcha was so bad that they are getting rid of it.

I personally experienced this and can't wait.

Washuu• 12 years ago

In the past month the reCAPTCHA challenges I have encountered have been like the article. I just have to hit reload until I can get something remotely readable or I managed to guess the letters correctly.

jobigoud4• 12 years ago

"I've solved a lot of captcha's in my time, and really have never experienced the trouble the author is detailing."

That might be the problem right here. Try browsing with Tor or passing through an anonymizing proxy. The more you solve correctly, the easier they get. The more unknown you are, the harder.

pbhjpbhj2• 12 years ago

http://alicious.com/wp-content/google-captcha7.png - which is the control?

Aldo_MX• 12 years ago

The first one.

Probably the mankind will hate me, but I'm the kind of person who answers correctly the control word, and writes an incorrect, but similar word for the unknown one.

This is my way to protest against recaptcha.

anon43• 12 years ago

That one doesn't even have any kanji, come on.

rnmnthwu cntnfru

SippinLean• 12 years ago

You don't need to enter anything at all for the second (non-control) word

vinc• 12 years ago

We need a browser extension to help us solve captchas with OCR. This is indeed ridiculous.

asaddhamani• 12 years ago

There's webvisum and Captcha Monster. Captcha Monster is like $5 per 1000 captchas or something. Not sure about webvisum.

If someone could use [something like this](https://github.com/mekarpeles/captcha-decoder) to make an extension it would be great.

slig• 12 years ago

I thought about this as well. I went and registered instacaptcha.com but I never managed to do it and the domain expired.

Seems to be doable. The user pays 1 usd/month and gets 100 credits. The extension author can outsource the solving to http://antigate.com/ and get the answer in 15 seconds.

joelgrus• 12 years ago

I always worry that they're getting harder because I'm getting old, so it's comforting that an arms race against bots is the real cause! :)

drglitch2• 12 years ago

I literally had the same thought after I unsuccessfully tried to get through a captcha for 10 minutes.

It was for a contact form on a vendor's website. Ended up going with another vendor who had identical product

hippich2• 12 years ago

would you wait instead of entering captcha with hashcash.io widget? Widget like that - https://hashcash.io/auth (notice unlock switch)

wmf3• 12 years ago

Since 2012 there have been some changes that make it easier under "normal" conditions: http://googleonlinesecurity.blogspot.com/2013/10/recaptcha-j...

nsxwolf2• 12 years ago

The audio captchas are psychotic. They are scarier sounding than anything I've heard in a horror movie lately, and I have never been able to solve one.

lfam4• 12 years ago

Psychotic and almost impossible to solve. I tried an audio captcha recently on a whim and I was bewildered.

I think any site that uses reCAPTCHA must not have any regular vision impaired users.

https://www.youtube.com/watch?v=HhFLC8ZZQeM https://www.youtube.com/watch?v=KNVcIogEXOo

krapp2• 12 years ago

Analysis of audio captchas has led to a number of exploits for several captcha systems including recaptcha - which is what all that horrible obfuscation is trying to prevent.

EddieLomax• 12 years ago

They are especially hard because the numbers overlap with each other-- so the numbers "three", "five", and "seven" become this weird mash of "threeven".

lfam4• 12 years ago

Apparently, if you have good cookies you get an easier captcha

find accessibility: https://www.google.com/recaptcha/intro/index.html

talles• 12 years ago

This made me remember: I once saw a website with a moving captcha.

Can't remember where I saw. Anyone knows?

callahad• 12 years ago

Comcast does that on their password reset pages. E.g., go to https://login.comcast.net/myaccount/reset, type in "foo", and click "Next."

Edit: From checking the source, it looks like they're using NuCaptcha (http://www.nucaptcha.com/). Looks like O2, Groupon, and StumbleUpon are also NuCaptcha customers. You can see examples on this page: http://nucaptcha.com/features/security-features

ashmud• 12 years ago

There is a blog post about defeating NuCaptcha here: http://www.elie.im/blog/security/how-we-broke-the-nucaptcha-...

johnchristopher• 12 years ago

Happened to me yesterday when logging to flickr via yahoo.

Yesterday I had to go through a moving captcha when trying to log into flickr. I got redirected to the yahoo login webpage where I copied and pasted that 20 something random characters yahoo had me working on for a cumulative time of an hour (I had to tweak pwgen to get some reaaally random stuff and yet see yahoo rejecting it because "too easy" and then wait for an hour or two before I could try again).

Then they had me confirm I was not a bot by asking me to type the moving letters in a captcha.

Tarang• 12 years ago

I have to type this awful thing every time I log into Envato and I can never get it right. It's so frustrating. Envato refuse to acknowledge its an issue.

I don't even get the point of it since you can get passed them by just hiring people off like at http://antigate.com/ for as little as 70c per 1000 captchas

mmagin• 12 years ago

I experienced animated GIF captchas with Yahoo's login process. Not sure if that was better or worse than reCaptcha.

pornel• 12 years ago

I don't get why they're doing this. Animation adds information and makes CAPTCHA easier to break!

Attacker can choose the frame that's easiest to attack and they can segment better with help of motion vectors and differences between frames.

Tycho• 12 years ago

If only we could invent the verbal equivalent of a trapdoor function. A word puzzle that would be extremely easy for computers to generate and humans to solve (since we understand language), but extremely hard for computers to solve.

peterwwillis2• 12 years ago

It's a nice idea, but you have to consider the complexity of the word puzzles compared to the average human's brain power. Most people are quite dumb. If there aren't a sufficient number of problems/answers, or they're simple enough for computers to solve, or they're too complex for a minority of humans to solve, you're boned.

The whole thing is a technology arm's race. The best solution would be one where you simply verify fixed private information. We use captchas for verifying a human being is not a bot, right? And we do that because we assume the user is anonymous for a short time.

Instead we could simply provide a secured authentication gateway where one could provide private information that is linked to a human identity. That way it can't be abused unless they have an unlimited supply of stolen identities. Even better would be if everyone signed up for a TOTP service provider and used their token generator and service-account to prove their human-ness without needing to put in sensitive information. But that's probably too much work.

jdbernard6• 12 years ago

Except you lose the benefit of anonymity, which is a big draw for many of the places using Captchas. Unless I don't understand your idea, which is possible.

biggerfisch• 12 years ago

Most people are quite dumb.

I know what you're trying to say here, but consider today's xkcd[0] as a counter-point. I think "most people" are quite capable of solving a lot of puzzles. This issue is that any puzzle that we can solve in a reasonable timeframe is often a good target for a computer-generated solution as well.

[0] http://xkcd.com/1386/

companyhen2• 12 years ago

What is everyone thoughts on this type of CAPTCHA?

http://areyouahuman.com/site-owners/playthru/

gdilla• 12 years ago

it's interesting but two things come to mind. Viewing it on this site makes it seem like it's great, but what about in context? If i came across that, I'm forced to think more than a capthca, just since it's so different and unexpected (maybe that goes away if it's very widespread). Also, it looks like an annoying banner ad game from orbitz or something of years back - that might make me avoid it, ignore or just not trust it.

tjpaxton2• 12 years ago

in context we get about 40%-60% higher conversion rate depending on the use case and have over a 95% success rate. we have a lightbox mode that makes it really apparent what you are doing and only has you attempt a captcha after you submit and the form is validated.

MrQuincle• 12 years ago

Nice! I am playing with the idea to put it on my site for fun. :-)

companyhen2• 12 years ago

I use it as an alternative captcha for contact forms on some WordPress sites I run.

Met a couple people who work at the company (I'm in Detroit and think that's where it is based) at some startup events a couple years ago. That's how I found out about it.

adestefan4• 12 years ago

If I saw that it wouldn't be worth my time to continue with the site. Next we'll be punching the monkey for a prize.

aestra2• 12 years ago

Looks too much like spam.

tjpaxton2• 12 years ago

Founder of Are You a Human here. Happy to answer any questions.

gildas• 12 years ago

Here's the one I got on linkedin recently

https://twitter.com/check_ca/status/480784849260019712

kroger• 12 years ago

I got one in Hebrew once:

http://twitpic.com/8u8un4

arseniclifeform• 12 years ago

Looks like something you might get with CRAPCHA:

http://crapcha.com

anon43• 12 years ago

OP's is obviously

z̤͍̩͓̲̤̗̳̤̼̪̺̦̤̹̻͓̲̏̉ͥ̂͗̆̉͒͑͒ͬ͆̂́̀̚͘a̴̴̘̥̻̗̰͋̌ͨͧ̒̃̾́̒͑ͣ͜l̎ͤ̎͗̿̚͞҉̵̧̤̻̰͎͉̯͙͕̰̣̻̬͚͖͢ͅģ̏́̓̿̇͌ͥͬ̈ͭ͂͏̥̯̠̯͚͙̞͇̲̫̲̭͔̝͈̗o̴̐͒̂ͯ̐ͧͣͬ̒̈́̀͏̧̝̤̦̭̙̳̣̹͕͚͍͝ͅ

while yours is

rlyeh ryights

aluhut2• 12 years ago

I realised an intersting thing there. I also get those complex captaches using firefox. But I also have an Opera12.17 running. With this one my captchas for the same page are ridiculousy easy. Sometimes it's just an house number. One item. I never had one even close to what I get on FF.

wmf3• 12 years ago

I think it depends on a cookie. Once you correctly solve a dozen or so hard captchas they'll give you easy ones from then on.

aluhut2• 12 years ago

That would be the logical thing to do. Unfortunately I rarely use Opera. I can't remember solving more then 5 captchas with it. I use FF most of the time with hunderts of solved captchas there. (FF Private Mode did not help either)

incision• 12 years ago

I was just thinking this yesterday when I had to recover a Flickr account I hadn't used in ages. I had to solve captchas from Yahoo and Microsoft.

The Yahoo captcha used rotating, bouncing letters on a scrolling background of more letters - ridiculous. Microsoft's was just a typical smeared mess, but no easier to actually solve.

I think I failed each at least 3 times.

It's not just difficult captchas, but use of them everywhere. The site my university recommends for ordering textbooks starts inserting captchas if one searches more often than perhaps twice within a minute. Another I can't recall the details of requires a captcha solve to make any sort of profile change despite being previously authenticated.

Alupis6• 12 years ago

The article's largest complaint is not being able to read one (1) of the two (2) words in the captcha challenge.

ReCaptcha only requires one (1) out of two (2) words to be correct in the challenge.

It presents one known-by-the-system-word, and one not-known word. If you get the known word correct (the easier of the two to read) then it passes the challenge.

ReCaptcha then pools the answers for the second not-known word and after pooling thousands (or more) responses, then that word becomes "known" based on the average answers (and then that word is "digitized" and used by google maps, or ebooks, etc).

~~~~

And for those wondering, I find it easiest to read captcha's by just looking at the letters by shape.

Going down the list in the article:

onightsl secretary.

. phaRega

o ndaaar

proximity rsgrrem

and khseeke

. azedcg

elearsal 5

ination amesye

se ebtyR

Reomi now

ivestshm nwre

Again, it's important to note, you only have to get one of the two words correct to pass the challenge. So.. probably 99% of the above list would pass.

tass2• 12 years ago

Please re-read the article

surreal2• 12 years ago

The original article was specifically about reCAPTCHA, not homebrews, and how difficult they now are (something I've also noticed lately). Either give it a (re-)read, or if you're saying you were able to easily read the examples in the article please share the answers! :)

Artemis2• 12 years ago

Google exploits ReCaptcha to recognize street numbers. When typing a numerical ReCaptcha, you are doing OCR for Google Maps for free.

curun1r• 12 years ago

You might want to read the link...he's complaining about reCaptcha. The basic complaint is that the ability to recognize letters is no longer good enough to distinguish human intelligence. We need to identify some other trait that's simple for humans and difficult for computers. Those "home grown" captcha solutions are likely better in this regard from reCaptcha since they don't have the possibly contradictory goal of digitizing books.

isomorphic• 12 years ago

Don't re-invent the wheel? That is, please continue to give useful data to Google for free?

From the article, in the context of ReCaptcha, it seems like Google has stabbed itself in the face with the sword of data.

Google may think the data is telling it something, but what it's really managing to do is irritate legions of humans with terrible (borderline hostile in this case) UI/UX.

jdbernard6• 12 years ago

No, the problem the author mentions is explicitly with ReCaptcha. He addresses your edit in the article, which you would know if you actually read it and didn't just skim. The problem, as evidenced by the author's many examples, is that the control word is often distorted beyond reasonable recognition, and the new word is not valid data. So neither of the two words is solvable.

Edit in response to your edits

You've deleted your previous edit. Still, even with your current edit it is clear you are not actually reading the article. You say:

Again, it's important to note, you only have to get one of the two words correct to pass the challenge. So.. probably 99% of the above list would pass.

However, the author of the article explicitly states that he did this:

I decided to just guess the first word and hope “secretary” was the control. It wasn’t.

So the author correctly identified one of the two words (and makes the same identification as you did), but was still rejected because it was not the control word.

You obviously don't have an accurate understanding of ReCaptcha implementation, and you apparently are not reading the article with comprehension, despite claiming several times that you have.

wingerlang• 12 years ago

Off topic slightly, but does people with dyslexia have a hard time with captchas?

stronglikedan• 12 years ago

x0054• 12 years ago

I have dyslexia, no problems with captchas though. In fact I found the examples from OP article to be not all that difficult. Maybe it's because when I am solving the capture, I just look at one letter at a time, instead of trying to read and comprehend the word. I found it that in many cases the control word isn't actually a word at all, just string of characters. I usually have 80-90% success rate nowadays, used to be 100%, but they are really getting more and more difficult.

me1010• 12 years ago

Easy... A stereogram "captcha" ... What's the hidden 3D image? More fun too... http://www.brainbashers.com/stereo.asp

sesqu2• 12 years ago

Sure, if you don't mind cutting out 30% of your audience.

aestra2• 12 years ago

NO!!!!!!!!!!!!!! Please NO! I'm stereoblind but also not a bot.

http://en.wikipedia.org/wiki/Stereoblindness

hippich2• 12 years ago

It is funny how link [1] from my app solving this problem got more upvotes :)

[1] https://news.ycombinator.com/item?id=7944540

Aardwolf• 12 years ago

If computers get so good at solving captchas, are we also getting better OCR?

Time to switch to next, harder, AI problems as captchas :)

valarauca1• 12 years ago

I hate to be so simple but XKCD said this first

https://xkcd.com/810/

pbreit2• 12 years ago

I can't believe we have not figured out something better than captchas by 2014. I would imagine Google could figure at least how to bake something into Chrome which many would eventually follow. It's asinine that all legit customers have to go through such a silly, completely unrelated hoop.

tempestn4• 12 years ago

Google has figured out something "better". Basically they use all the data they collect on you to determine whether you're likely to be a bot or not. If not, you most likely won't even see a captcha. (And if so, you'll get a difficult one.)

kstenerud2• 12 years ago

It must think I'm a bot, then. I get captchas all the time, and they've been definitely getting harder and harder to solve over time. I suspect their algorithm pushes me further and further into the bot camp the more captchas I fail (I have about a 10-20% success rate now, and it's dropping). At this point, I only stick around for the 5-6 tries it takes if I REALLY want to use whatever service it's guarding. Often, I'll just leave the moment a captcha appears because I don't want to be bothered. If it's a contact form, I'll use google to find a direct email address or phone number instead (Yes, I've had to resort to that approach many times).

mike-cardwell• 12 years ago

Are you suggesting somehow automating the process of proving you are a human?

pbreit2• 12 years ago

No. Just trying to avoid something that is completely stupid on many levels.

andmarios• 12 years ago

I have this fear that skynet originally started as a captcha solver algorithm. :p

nikanj• 12 years ago

I think it's time to move to the ultimate captcha: "Is this post spam?"

Then we just hope that the spammers create a perfect solver again :)

adestefan4• 12 years ago

I've recently seen a bunch of them with just one number. Just a single 7 or 4 on a white background and nothing else. Kind of scratch my head at those ones.

scandinavian• 12 years ago

Do you mean the house numbers/street signs? Like these: http://i.imgur.com/yD1FrlH.jpg

If it's those, I guess google uses recaptcha to get data for streetview.

adestefan4• 12 years ago

I've seen that, but I've also seen plain black numbers on white that look like they're right out of MS Word. Got me.

tempestn4• 12 years ago

Is it not obvious in the first case that "secretary" is the unknown word? Clearly ocr wasn't able to read it due to the fading. Likewise, the cut off words spanning two lines in the later versions are obviously the unknown words. The author states right at the beginning that he understands there is a control and an unknown word; he then proceeds to "hope" that the obvious unknown word is the control in the first case, then skip numerous captchas where the control word is straightforward and the illegible word is obviously the unknown. This certainly sounds like willful ignorance for the sake of a blog post.

Also, '“Onightsl”? “Onighisl”? Are those even words?' No, my understanding is that dictionary words are never used as the control, so as not to be vulnerable to dictionary attacks.

Edit: I'm not suggesting that these captchas are in any way good; they do clearly have issues. I'm just saying that storyline in the blog post seems contrived. To me it would be more convincing if presented in a more genuine manner. However, perhaps he was simply very unlucky.

arrrg• 12 years ago

What a concise description of why captchas as they exist today are just awful and we have to come up with a better solution!

There you are, talking on and on and on about some tiny unimportant but extremely specific implementation detail no one should ever have to care about. People shouldn’t have to read a manual about the inner workings of this captcha implementation (and have some experience with what types of text computer vision is good and bad at recognising!) to have any chance solving it.

In this case the author clearly had no idea how that control/unknown system works in detail (it seems like they, just like me, only know that you do not have to recognise both, but they didn’t really understand the reason for that – nor should they have to) but that doesn’t really matter for their argument even a tiny bit.

tempestn4• 12 years ago

Fair enough. I didn't mean to suggest that these captchas are in any way good. Only that the author does appear to have technical knowledge of how they work - otherwise they wouldn't use terms like "control word", so it seems that the difficulty experienced was likely contrived for the purpose of writing the blog post.

For me at least, the point would have come across better if that (seemingly) false ignorance were dropped. (Either that, or frame it in terms of, "Here's what an average user sees when they try to log in," or something along those lines.)

id• 12 years ago

It's also clearly "onightsl" and not "onighisl". A couple of years ago, captchas were just as easy / difficult as they are now.

Except for some untrusted websites / users who can get really difficult captchas sometimes: https://i.imgur.com/6pAatnC.png

smackfu2• 12 years ago

Here's something interesting. If I go to the ReCaptcha demo page in Chrome that is logged in to Google, I get all house numbers, a lot of which seem like easy OCR. If go to the same demo page in Incognito mode, I get the two word version instead, like this blog is complaining about.

http://www.google.com/recaptcha/demo/

wmf3• 12 years ago

Yep, in incognito mode Google hasn't built up a profile of you yet so they assume you're a spammer.

snarfy• 12 years ago

If they are using your profile, what is the point of recaptcha then? It's circular reasoning.

Igglyboo• 12 years ago

Same here, maybe they trust people who are using their services more and want them to OCR some google street view stuff.

nobodyshere• 12 years ago

Leaving no captcha would be a hint for spammers to provide requests with valid cookies thus simplifying the task. I assume that's the reason for increased difficulty in incognito.

adestefan4• 12 years ago

I've also seen a lot of house numbers in Firefox.

kijiki• 12 years ago

It is based on the google tracking cookies, not being logged in. I don't have a google account, but I still see the house #s on firefox, until I flush their cookies.

nandhp• 12 years ago

Yes: reCAPTCHA now keeps a profile of you and gives humanoid users easier reCAPTCHAs.

http://googleonlinesecurity.blogspot.com/2013/10/recaptcha-j...

metacorrector• 12 years ago

in other words, it's not giving you reCaptchas, it's giving you unCaptcha's yet so you can do work for them for google streetview.

Timshel• 12 years ago

And if you start entering some number that are close to the correct answer most times it's accepted. But if you do it like ten times you might be switched to the two words version.

mcv• 12 years ago

There are plenty of tricks around Visual Captchas. What you need is a semantic captcha that's only recognizable as such by a human. Hide a simple question somewhere in a piece of text.

lauradhamilton• 12 years ago

Who writes the question and answer?

Although...maybe you could outsource the question and answering to Mechanical Turk. Turn the whole thing on its head. Have a real person write a question to try to trick the bot into revealing its botness, have the real human grade the answer.

hammock• 12 years ago

It's difficult, but I was able to read all of those captchas (the wavy ones). Maybe it's a special skill?

joshfraser2• 12 years ago

I'll repost this once again. Why you should never use a CAPTCHA: http://www.onlineaspect.com/2010/07/02/why-you-should-never-...

k__• 12 years ago

The proposed alternatives are crap. Why shouldn't an attacker read the CSS...

joshfraser2• 12 years ago

Many (maybe even most) people who use CAPTCHAs are never going to be targeted with a personalized attack. Instead they're using CAPTCHAs to prevent generic, spray and pray spam. The bots know how to post a comment on a Wordpress blog, but making even a small tweak to your comment form can get rid of 99% of them.

iopq• 12 years ago

select three hot people but there's only two on that image

asaegyn• 12 years ago

It took me about 30 min and >15 captcha's before I could register for this site. The audio didn't help either...

They are getting ridiculous.

paulmd• 12 years ago

https://www.youtube.com/watch?v=kNdDROtrPcQ&feature=kp

Pretty neatly conveys the feelings on this topic.

Pinckney2• 12 years ago

The problem isn't captchas, but users not understanding how to interact with them. So what if a few are bad? Hammer out best guesses, fast as you can, until you're successful. It's not as if you're graded on accuracy. There is no reason to ever resort to the refresh button,

Out of curiosity, I went and opened the demo page (https://www.google.com/recaptcha/demo/ajax) in a new incognito window and timed myself. I can do about 8/minute at maybe 90% accuracy.

Captchas are only a problem if you compulsively refresh in hopes of getting something clear.

mkehrt• 12 years ago

Sorry, the user is never wrong. This is an interface problem, and the interface is terrible.

mrjatx• 12 years ago

After I've filled out 20 different forms the last thing I want to do is deal with a completely illegible captcha which might go far as to refresh the entire page or wipe out what I've entered in certain fields (password, ssn, etc) each time I get it wrong. That's one way to push me away from signing up for your service.

Pinckney2• 12 years ago

That's not really a problem with recaptcha so much as the integration with the rest of the site.

dkersten• 12 years ago

Eh, I've hit some really frustrating captchas where after five or so attempts I ended up just closing the page (these were reCAPTCHA ones...) The problem was most definitely with the captchas.

DanBC• 12 years ago

Captchas are only a problem if you compulsively refresh in hopes of getting something clear.

You're ignoring people with visual impairment or cognitive impairments.

pbhjpbhj2• 12 years ago

Recent discussion, https://news.ycombinator.com/item?id=7419667 (there are others)

Also a couple of examples http://alicious.com/hard-recaptcha-huh/.

Houshalter• 12 years ago

A paper came out awhile ago showing that neural networks are extremely vulnerable to adversarial examples [1]. They showed even slight perturbations of an image generated with their method could cause NNs to misclassify it, but appear no different at all to a human. I am interested if methods like this could be used to extend the life of CAPTCHA a bit longer, even as computers are starting to beat even humans at object recognition tasks.

http://cs.nyu.edu/~zaremba/docs/understanding.pdf

sjtrny• 12 years ago

I think you have made a good point and possible solution here. But I am keen to see if researchers can quickly address this issue with NNs. Someone might find an easy fix to this problem.

vegancap• 12 years ago

I had one read 'drink issue' once... Wasn't sure if normal capture or advice.

kkhire• 12 years ago

If i am relaxing back and have to enter a difficult captcha to watch a movie, I am not watching that movie.

Jekyll• 12 years ago

http://www.newscientist.com/article/dn24476-software-beats-c...

progx• 12 years ago

Alternatives exists, but the usage is low.

A simple solution is google Authenticator (or similar systems).

The only problem is a system for all kind of users and equipment.

ademsha• 12 years ago

[shameless blog post promo ahead]

One simple way for minimizing junk going through automated submits. Idea without using recaptcha at all: http://ademsha.com/notes/simple-proposal-to-stop-spam-going-...

It works only with JS enabled and uses randomization in order to stop bots learning how to avoid it.

bryan_rasmussen• 12 years ago

hmm, I have to say I haven't had a recaptcha that bad yet, but I have had some bad ones.... But uh... on the first bad recaptcha when trying to guess their password they thought - this recaptcha is ridiculous I will try to solve it of course but just right now I am also going to screenshot it because this is naturally the first thing I think to do!

sebmarion• 12 years ago

This is where Facebook comes in handy! Please add your captchas there: https://www.facebook.com/IHateCaptchas?fref=ts

Fice2• 12 years ago

Dear website owners, please, do not use reCaptcha. As was noted in other comments, Google discriminates against the users who try to protect their privacy by showing them nearly unsolvable variant. For instance, I see the hard version all the time since I started to use Privacy Badger for Firefox. It is also not impossible that they discriminate by user-agent.

And generally it is a very bad idea to choose the most popular service among the alternatives, as by doing so you are contributing to the centralization and monopolization of the Internet.

skj3• 12 years ago

It's almost like, if they already know you're not a bot, they don't have to try very hard to re-prove it, or something.

Think of it in a Bayesian sense.

If 10% of anonymous users end up being bots (the prior), and the "hard" recaptcha has a 1% false-negative (incorrectly identifying someone as a human) rate, then of the anonymous users who succeed in getting past the recaptcha, .1% will be bots (the posterior).

But if 1% of sign-in users are bots (probably less than that), you only need a recaptcha with a 10% false-negative rate to achieve the same bot throughput limit. And, those users are less frustrated.

jobigoud4• 12 years ago

While Google is worried by the false negative, we as users measure frustration with the false positive (failures to identify an actual human) rate. Ideally they would find a system where both rates are independent or where false positive are rare.

Fice2• 12 years ago

I understand how it is justified technically, but that does not invalidate the fact that reCaptcha is discriminating against the users who care about privacy.

izzydata• 12 years ago

Lately I've noticed 90% of my captcha's being a single number. That is it. A number like "1057" with nothing else. what do they honestly expect me to do with this?

Basically I have to fill in the number and then guess whether it was the first or second set of characters and fill out bogus before or after the number and hope I got it right. The numbers weren't even hard for a computer to read. The only thing it does is waste everyones' time.

karlshea• 12 years ago

I've seen guesses that those numbers come from addresses in pictures taken by the Google Street View cars.

jobigoud4• 12 years ago

This happens when they already know there is a fair chance that you are human. So they give you an easy one and get their OCR for free. You are probably already logged in your Google account when it happens. Go incognito, browse with Tor, etc. and you will get the impossible ones.

mathattack• 12 years ago

I believe that this will eventually become a losing game. Normally there's an arms race between those creating security and those thwarting it. In this case, once the recognition schemes are as good as humans, the game is over for good.

pertinhower• 12 years ago

Shoulda stopped at number 5: "and khseeke" seemed pretty clear to me.

But point taken.

yaroslavvb• 12 years ago

We found that neural networks can solve CAPTCHAS much better than humans, 99.8% on the "hard" ReCAPTCHA instances: http://arxiv.org/pdf/1312.6082.pdf

This is why visual recognition is just one of the signals you need to use to tell humans and computers apart http://googleonlinesecurity.blogspot.com/2014/04/street-view...

atoponce• 12 years ago

I've said it before, I'll say it again: hashcash.

Captchas are Becoming Ridiculous

Related Stories