Hacker News Reader

Trying all the words in the captcha one by one has a big chance of "hitting" correct answer. If it doesn't a brute-forcer can just request a new captcha until it works.

Said that, they don't seem very spam-proof to me.

For more info about how hard CAPTCHAs need to be read Luis Von Ahn's papers:

http://www.cs.cmu.edu/~biglou/

View on HN

I get the impression that about half of the questions are list based. And the questions are about 10 words long. If that's the case, then using the algorithm you mentioned, you have a 1 in 20 chance of getting the captcha right. So yeah, it's a completely useless captcha system. That number should be 1 in a million or higher, not 1 in 20.

And it's probably not the first or last word. And if it precedes a ',' then it's probably more likely to be it. There are many ways to increase the hit-rate.

Sure. I know my calculation was very rough, but my point is, if I'm not at least 2 orders of magnitude out, then the captcha system is very very bad.

Reply on news.ycombinator.com