User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It only takes a minute to sign up.
Sign up to join this community
A Hacker News article pointed me to http://www.apple.com/itunes/50-billion-app-countdown/entry-form/ where they use moving captchas:
I assume that its a way to make shorter (and therefore convienient) captchas secure. My hypothesis is that if you freeze it at a point, you cannot isolate letters for an OCR program to process.
What benefit does this scheme bring?
Here's the goal of a CAPTCHA from Wikipedia:
These tests are designed to be easy for a computer to generate but difficult for a computer to solve, but again easy for a human.
The CAPTCHA you are referencing is easy for us to understand and far easier than the path that static CAPTCHAs have been going down:
Imagine the difficulty a person with poor eyesight would have trying to solve that or other challenging CAPTCHAs.
For the second part of being difficult for computers to understand, your theory that OCR programs can't take a single screengrab and be able to solve the puzzle may be correct. But, you'd have to think that would be short-lived if more sites adopt this type of CAPTCHA. It seems like it'd be pretty easy to solve if the OCR program made a composite of two or more stills from the animation.
So, this animated CAPTCHA is easy for humans to solve and difficult for computers... for now.
Some of the hacking/security "industry" guides suggest manually completing one of these CAPTCHA mechanisms as a person before allowing your interactive program to interface with the target site or application. This means that once you're authenticated as a person most sites assume you will still behave as a person. Just as people research habits of good visitors, bad visitors research the patterns of the security systems on the websites.
The animated captcha you've referenced has been compromised already. Another major CAPTCHA (reCAPTCHA) was also hacked by people who took the time to examine the system, look for a pattern and break it.
The benefits of these mechanisms are simple. If your site runs the risk of being massively exploited to the point it severely limits the user experience, then mechanisms need to be in place that prevent people (or applications) from automatically completing forms and require users to participate as good, wanted users.
When you're using one of these devices (gimmicks) to keep people from exploiting a website instead of hardening the website itself, basically it makes everything a little harder on your normal visitors and their user experience has the potential to be much worse. They may see this hurdle every time they access the site or the application. If it causes their account to be locked, now they have other hurdles to overcome because of their misunderstanding of how to complete your device successfully, or because they misspelled or misread a character.
CAPTCHA mechanisms often require that the visitor complete the test in English. This might not always be the best solution.
In regard to the sound challenge, if someone isn't familiar with the language and they're trying to use the audio portion: if they have a sound card, and are not in a loud place, and can actually hear the audio, then they have to recognize the phrases and translate them into characters that phonetically sound like the originating language. This is also pretty complicated and require a good understanding of phonetics.
There are also math CAPTCHA mechanisms that require people to solve a math problem. These are easily beatable because most computers are pretty excellent at math, much more so than their users.
If someone's trying to get into your site or app to compromise it and you've not hardened the security, the exploiter may only see a mechanism once. There are several security mechanisms available on the market that work similar to these I've mentioned. With any amount of time they can all be beaten and are all basic gimmicks presented as solutions to the problem of lack of budgets (or laziness) in regard to security when designing websites and applications. Then the exploits are made available on the internet and it's only a matter of time before the device's original intention is useless.
The first thing we look at is user interaction. User habits are a great indicator as to what to expect from a website's normal visitors.
Most users take time to complete a post or form; they read things at average speeds and interact in a standard way. Even auto-complete usually requires some sort of interaction.
Use the research
If you do simple things like check the length of time it takes to post, check if the mouse has moved while the person was on the page (if it's a computer), see if they've scrolled (on a mobile device), check if the user is using a real browser (not something like cURL), or if they've actually spent some time on the page actually reading what they're going to interact with, then you're much more likely not to get a false positive. Check to see if they've been on the site for a little bit of time before posting. There are circumstances where someone writes out their thoughts in an application like Microsoft Word (like on this site where people cite their references) and instantly pastes them in; even then those people will typically alter their content before posting or they will have been on the site for some time before adding their content. At the point someone exceeds their expected limits (or breaks form), THEN you present them with a challenge and response.
If you make people provide an answer to a problem in their native language or recognize a shape and provide their response in their native language (through multiple choice and on -the-fly translation) it's much more user friendly because with a library of thousands of images(understood in all cultures) the attacker would theoretically have to figure out what the image is, then find its meaning, then store a database of these images for repeated attempts. If the images and answers load at random, the attacker has a much harder time finding a pattern.
Here's a working example of the concept featuring language translation: http://code-resource.com/captcha/
A CAPTCHA might stop a lot of new abusive traffic. It will look good to the people who run the website. At the point the CAPTCHA is compromised, it's lost its charm and is simply a hurdle driving real visitors, customers, and users away.
The goal of captcha is to have a task that is easy for a person to do, but hard (or impossible) for a computer to do. The problem is that computer programs have been developing, and they can now pass many captcha systems. As a response captcha systems have had to evolve more difficult tasks, which are frustrating to decipher.
The benefit of simple moving images is that it is trivial for a human to read the letters, but still difficult for computer systems. That is the goal of captcha, and this looks to be a step in the right direction.
There are various apps/programs out there which can detect the captcha and help you automate various tasks. These beat the reason for using the captcha - 'Human verfication'
Some other approaches which people have tried is, using match captcha:
Among others are using 3D images and even asking the user to quote the add.
Moving captcha are a step in the same direction but trying to improve the UX (so-to-say). (Speculation) Problem with traditional captcha is that you cannot expect everyone to be able to decipher the cryptic texts and enforce the traditional security measures of blocking access after limited trials. With the moving captcha, you can say with decent confidence that most average people will be able to detect the word on their first attempt with ease. Allowing you the ability to enforce stricter security measures.
That being said, I do not believe it will take much time for people to crack this (or has it already been done?) :)
