Hacking CAPTCHA
Posted on Sunday, December 9th, 2007 at 4:38 pm

CAPTCHAs (Completely Automated Public Turing test to tell Computers and Humans Apart) are easily hacked...apparently.
So...I'm brainstorming different methods of testing for human intelligence that aren't easily hacked by computers.
One major problem of conventional image-based CAPTCHAs are their inaccessibility to people that are blind. This shouldn't matter to me if I'm developing a CAPTCHA for an art website...but still! It's a fun little challenge!
The W3C has an interesting paper on the issue of inaccessible CAPTCHAs and offers possible solutions:
- Sound output: sites like Hotmail, Google, and Yahoo! use this secondary, non-visual CAPTCHA for blind users. Great. But what about blind AND deaf users?! Plus, voice recognition technology works very well with these computer generated voice samples...
- Non-interactive checks (like Heuristics, or SPAM filtering): these are my personal favourite techniques for CAPTCHA. But, using heuristics to determine the behaviour of robots still requires them to spam your site...and high-volume human users might be difficult to separate. Oh, and SPAM filtering can be hacked, sadly...
- Logic puzzles: this sounds promising...ask a simple math, verbal, or recognition-type question that computers can't "get". The W3C says, "Users with cognitive disabilities may still have trouble." I don't really want stupid people on my websites anyway...but, America is raising a nation of
below-averagestupid students, so these tests would have to be simple enough for them to understand. Argh!
I'm torn between making a Taboo-esque CAPTCHA (eg, What's white, comes from cows, and you have it every morning? Answer: Milk!) and just using server-side, unobtrusive heuristics...
Sigh!
Heuristics are the way to go, obviously...but, omg...it's not nearly as fun.
Search
Tag Cloud
ajax as3 businesscard captcha chumby css design fap fapi flash hack hotlinking interface javascript jquery json lightbox myspace pipes site translation typography usability webservice wigits xss yahoo