Hacker News Reader

Comment by Turing_Machine | Hacker News Reader

A slightly less clueless (but still clueless) approach to CAPTCHA design is to 1) make the CAPTCHA case-sensitive, 2) use letters for which the lower-case representation is very similar to upper-case, and/or use both zero and the letter O, 1 and the letter l, and so on, 3) use an image munging algorithm that makes it next to impossible to disambiguate the cases in 2).

View on HN

The problem with captchas is they have to be readable to humans.

Sure, a captcha of "lI0Ol1o" would would probably be unreadable to a computer ... but it would be to a human too.

We're quickly approaching the point that image recognition is getting as good at solving image captchas as humans are, and when we do, we'll need to find some other way to do it.

Reminds me of the infamous Rapidshare Captcha with cats. [1] There were hard to solve. However, also for humans.

[1]: http://www.labnol.org/internet/favorites/cats-inside-rapidsh...

> However, also for humans.

Which is exactly why they added those. Premium accounts do not require the user to enter a captcha for every download. So every user who was annoyed by the "cats captcha" was a potential customer.

That's actually probably going to be easier for a computer to solve than a human.

A computer can do statistical sampling of many CAPTCHAs generated by the same website, and then try to reverse-engineer the image munging algorithm.

Humans, OTOH will probably give up after 2 tries and already struggle to get |O0Il1l right.

What I think is cool are the captchas that make fake words that actually look like they could be real words (as opposed to a random string of text). Makes it easier for a human to read and figure out, but no easier for a bot. I dont know how they do that.

Markov chains: http://en.wikipedia.org/wiki/Markov_chain

Imagine picking letters with the right frequencies. Now, instead of doing that, pick pairs of letters, with the right frequency, so that each pair "chains" with the previous. If you have good pair frequency data, you can do longer than pairs and get even closer to English.

(vowel+consonant).times(6).join('')

if(failed_attempts > 20){ ban for ten minutes }

I dislike like long, nonsensical captchas that confuse people, it's totally annoying. A few years ago i used a 5 digit captcha, but in the background i added faded small letters in various angles.

Unfortunately the faded small letters probably did not make your captcha more difficult to crack. It's relatively simple to remove all grey pixels from the image before OCRing it.

However having your own custom captcha probably helped quite a bit. I'm guessing spammers aren't going to bother writing custom software to decode your captcha unless you have a major site.

Yes of course. But you can choose certain colors, not gray that look faded to the eye but are not in rgb values. In any case, captchas are always mediocre solutions.

Reply on news.ycombinator.com