17

A Hacker News article pointed me to http://www.apple.com/itunes/50-billion-app-countdown/entry-form/ where they use moving captchas:

enter image description here

I assume that its a way to make shorter (and therefore convienient) captchas secure. My hypothesis is that if you freeze it at a point, you cannot isolate letters for an OCR program to process.

What benefit does this scheme bring?

4
  • 7
    FYI this catptcha is not made by apple, but rather by nucaptcha.com . They list a lot of benefits on their website, I leave to you to judge if these claims are real or marketing.
    – Daniele
    May 14, 2013 at 11:53
  • 7
    Someday: xkcd.com/810
    – zzzzBov
    May 14, 2013 at 16:18
  • FWIW I took a half dozen screenshots to grab single frames from the animation. I'd rate them among the easier half of captchas I've seen. My hypothesis would be that by animating the letters so you can see all parts of them clearly at one point in time their objective is to make it trivial for humans while still requiring a bit of work for the spambot authors. May 14, 2013 at 17:06
  • 1
    It seems to me this would actually degrade the security of the captcha and make it easier to crack, because it offers bots more images to OCR and correlate against one another. That is, perform the OCR 50 times and take the most common result.
    – devios1
    May 16, 2013 at 19:54

4 Answers 4

11

Here's the goal of a CAPTCHA from Wikipedia:

These tests are designed to be easy for a computer to generate but difficult for a computer to solve, but again easy for a human.

The CAPTCHA you are referencing is easy for us to understand and far easier than the path that static CAPTCHAs have been going down:

A difficult CAPTCHA

Imagine the difficulty a person with poor eyesight would have trying to solve that or other challenging CAPTCHAs.

For the second part of being difficult for computers to understand, your theory that OCR programs can't take a single screengrab and be able to solve the puzzle may be correct. But, you'd have to think that would be short-lived if more sites adopt this type of CAPTCHA. It seems like it'd be pretty easy to solve if the OCR program made a composite of two or more stills from the animation.

So, this animated CAPTCHA is easy for humans to solve and difficult for computers... for now.

1
  • 8
    Even users with good eyesight have problems. I have 20/20 and find myself asking for new CAPTCHAs all the time because they're just too hard to read.
    – elemjay19
    May 14, 2013 at 19:19
10

These "security" devices hurt user experience.

Some of the hacking/security "industry" guides suggest manually completing one of these CAPTCHA mechanisms as a person before allowing your interactive program to interface with the target site or application. This means that once you're authenticated as a person most sites assume you will still behave as a person. Just as people research habits of good visitors, bad visitors research the patterns of the security systems on the websites.

The animated captcha you've referenced has been compromised already. Another major CAPTCHA (reCAPTCHA) was also hacked by people who took the time to examine the system, look for a pattern and break it.

Why use these in regard to User Experience?

The benefits of these mechanisms are simple. If your site runs the risk of being massively exploited to the point it severely limits the user experience, then mechanisms need to be in place that prevent people (or applications) from automatically completing forms and require users to participate as good, wanted users.

Why should I not use these in regard to User Experience?

  1. When you're using one of these devices (gimmicks) to keep people from exploiting a website instead of hardening the website itself, basically it makes everything a little harder on your normal visitors and their user experience has the potential to be much worse. They may see this hurdle every time they access the site or the application. If it causes their account to be locked, now they have other hurdles to overcome because of their misunderstanding of how to complete your device successfully, or because they misspelled or misread a character.

  2. CAPTCHA mechanisms often require that the visitor complete the test in English. This might not always be the best solution.

  3. In regard to the sound challenge, if someone isn't familiar with the language and they're trying to use the audio portion: if they have a sound card, and are not in a loud place, and can actually hear the audio, then they have to recognize the phrases and translate them into characters that phonetically sound like the originating language. This is also pretty complicated and require a good understanding of phonetics.

  4. There are also math CAPTCHA mechanisms that require people to solve a math problem. These are easily beatable because most computers are pretty excellent at math, much more so than their users.

  5. If someone's trying to get into your site or app to compromise it and you've not hardened the security, the exploiter may only see a mechanism once. There are several security mechanisms available on the market that work similar to these I've mentioned. With any amount of time they can all be beaten and are all basic gimmicks presented as solutions to the problem of lack of budgets (or laziness) in regard to security when designing websites and applications. Then the exploits are made available on the internet and it's only a matter of time before the device's original intention is useless.

Suggested practice

The first thing we look at is user interaction. User habits are a great indicator as to what to expect from a website's normal visitors.

Most users take time to complete a post or form; they read things at average speeds and interact in a standard way. Even auto-complete usually requires some sort of interaction.

  1. If people complete the forms too quickly (inhumanly impossible) then chances are they've copied and pasted their content or they've automatically injected into the board.
  2. If they take an excessively long amount of time to respond (more than the session time) then they've attempted to compromise the system the other way.

Use the research

If you do simple things like check the length of time it takes to post, check if the mouse has moved while the person was on the page (if it's a computer), see if they've scrolled (on a mobile device), check if the user is using a real browser (not something like cURL), or if they've actually spent some time on the page actually reading what they're going to interact with, then you're much more likely not to get a false positive. Check to see if they've been on the site for a little bit of time before posting. There are circumstances where someone writes out their thoughts in an application like Microsoft Word (like on this site where people cite their references) and instantly pastes them in; even then those people will typically alter their content before posting or they will have been on the site for some time before adding their content. At the point someone exceeds their expected limits (or breaks form), THEN you present them with a challenge and response.

A new type of CAPTCHA

If you make people provide an answer to a problem in their native language or recognize a shape and provide their response in their native language (through multiple choice and on -the-fly translation) it's much more user friendly because with a library of thousands of images(understood in all cultures) the attacker would theoretically have to figure out what the image is, then find its meaning, then store a database of these images for repeated attempts. If the images and answers load at random, the attacker has a much harder time finding a pattern.

New type of captcha

Here's a working example of the concept featuring language translation: http://code-resource.com/captcha/

Closing

A CAPTCHA might stop a lot of new abusive traffic. It will look good to the people who run the website. At the point the CAPTCHA is compromised, it's lost its charm and is simply a hurdle driving real visitors, customers, and users away.

4
  • Google image search broke your last example; so you're down to the strength of the captcha Google uses to stop bots from abusing its services. images.google.com/imghp?hl=en Click the camera, paste the URL of the image into the popup textbox, and you get a bunch of results about biking. May 14, 2013 at 21:01
  • @DanNeely I do not understand what you're saying. So someone has to go offsite to find the image to answer the question? It's okay if the users know that this is an image of a bicycle. The bots would have to figure out that this was a bicycle based on the visual image and the context. The hidden value would be a hashed pairing that happens in a database. We obviously wouldn't let them send "Bicycle" as the value. May 14, 2013 at 21:49
  • 2
    I'm saying the bots would just have to throw the image into GIS and just compare the radio button choices to the text returned. The only limiting factor on them breaking it is the strength of Googles captcha; which I'd imagine is a top priority for them to keep up with breaking. May 14, 2013 at 22:25
  • @DanNeely I've added a working example of the concept with the Google Translate Widget enabled. May 14, 2013 at 23:46
3

The goal of captcha is to have a task that is easy for a person to do, but hard (or impossible) for a computer to do. The problem is that computer programs have been developing, and they can now pass many captcha systems. As a response captcha systems have had to evolve more difficult tasks, which are frustrating to decipher.

enter image description here

The benefit of simple moving images is that it is trivial for a human to read the letters, but still difficult for computer systems. That is the goal of captcha, and this looks to be a step in the right direction.

2
  • 11
    wow, nice find of a totally impossible captcha. May 14, 2013 at 15:11
  • They get even worse :)
    – JohnGB
    May 14, 2013 at 17:02
1

There are various apps/programs out there which can detect the captcha and help you automate various tasks. These beat the reason for using the captcha - 'Human verfication'

Some other approaches which people have tried is, using match captcha: enter image description here

Among others are using 3D images and even asking the user to quote the add.

Moving captcha are a step in the same direction but trying to improve the UX (so-to-say). (Speculation) Problem with traditional captcha is that you cannot expect everyone to be able to decipher the cryptic texts and enforce the traditional security measures of blocking access after limited trials. With the moving captcha, you can say with decent confidence that most average people will be able to detect the word on their first attempt with ease. Allowing you the ability to enforce stricter security measures.

That being said, I do not believe it will take much time for people to crack this (or has it already been done?) :)

2
  • 3
    Already been cracked
    – Mervin
    May 14, 2013 at 14:17
  • @Mervin As expected ;)
    – rk.
    May 14, 2013 at 14:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.