Captcha sense and nonsense

To protect online submission forms from spam bots and other auto-publishing programs, webmasters are increasingly turning to the implementation of captcha on these forms. Although it keeps the simplest programs and bots out, it also turns away a lot of real people.

Captcha means “VScompletely FORautomated Public Turing test to count VScomputers and Hhumans FORpart “and now you know why no one uses Captcha with the unabridged form. It is sometimes called a Turing test or inverse Turing test. In its most common form, you, the user, get distorted text and are supposed to write that in a box and send it, just to show that you are a real human being.

Captcha problem It is that sometimes the letters are really difficult to read, especially for people with vision less than 10/10. I personally, if the Captcha is too difficult to read, I just click the back button. For example, in the “broken link report” links that you usually see in software directories, I will not continue with the report if the Captcha is too difficult. I mean come on … I’m doing the webmaster here a favor, helping him clean up his site and he wants me to guess 5 or 6 unreadable codes before I can actually help him? By no means is my time much more valuable than that! I’m pretty sure there are a lot of people doing the same.

Now the webmaster could make the Captcha easier, but the easy Captchas can be easily hacked with standard Linux tools like GD. In fact, even the medium hard ones are being hacked. But it gets worse. India and Pakistan now have data centers dedicated to solving Captchas. A spammer can now purchase an API (a piece of code on another computer that he can use remotely in his own software) through which his software can send the Captcha image to one of those data centers where a real human being will solve it. Cost of this: a measly $ 1 or $ 2 for every 1,000 Resolved Captchas (Yes, that’s a thousand).

Although Captchas will keep amateur hackers out, if they really want to send spam, they will. And that’s while real humans who want to contribute real and valuable “content” to the site are rejected in droves.

Other forms of Captcha are beginning to appear.

• There is the Math Solver Captcha which shows the user a simple math problem (5 + 6 =) and has to complete the answer. Useless as it was easily broken with GD
• Another uses different colors. You are shown several letters, some of which are a different color and you only have to write the blue ones, for example. If the letters that should not be written are black and some are another color, this is easily broken by GD. All a hacker has to do is take the image, select the part that is not white (all the letters), place it on a black background (the black letters will disappear), and then OCR the remaining image.
• The funniest and, in my opinion, the most promising is the one in which you have to select the 3 most attractive people from a list of 9. Although tastes differ, it is quite easy to get it right on the first try. It is also the most difficult to decipher by software, although I see that it is possibly done with statistical analysis.

None of these, however, will stand up to hacking from cheap Pakistani or Indian labor …

My suggestion: implement an easy and maybe fun type of Captcha, but that’s hard to figure out with image manipulation software like GD. This will keep would-be spammers out and your users happy.