Do Good CAPTCHAs Really Have To Be Unfriendly? An Expert Explains
by John Prodonovich
For those of you who are not familiar with the term, a CAPTCHA is a feature on many user populated websites, such as Myspace with the purpose of blocking automated programs from spamming its users and for overall security. Here is how it works:
A user is required to enter a random letter and number password into a form before being able to submit information, log in, etc. This password is essentially given directly to the user in an image, rather than in text form, so that an automated program cannot detect the characters. The password the form field expects is the same as that shown on the image, but this sometimes causes problems.
Jeff Atwood at the Coding Horrors blog discusses whether CAPTCHAs are dead. This follows a news report that scalpers probably beat the CAPTCHAs at Ticketmaster.
Jeff links to a Chinese site that sells CAPTCHA decoders. The site quotes different prices for breaking different CAPTCHAs. An eBay decoder, for example, is being sold for $4000 and claims 70% accuracy.
What caught my attention were the unbreakable CAPTCHAs in the list. The Yahoo CAPTCHA is listed as unbreakable. That isn't surprising. Most of us can barely get it right ourselves.
Consider a Yahoo CAPTCHA. Sometimes you cannot tell the difference between a G or a 6? And the way that letters are often skewed, the difference bewteen certain uppercase and lowercase letters is virtually unrecognizable?
Contrast that with a Google CAPTCHA also listed as unbreakable. The Google image is clean and legible. Most of us have no difficulty getting it right. Google demonstrates that effective CAPTCHAs don't have to be unfriendly to users.
I am curious to learn which CAPTCHA libraries generate strong, yet user friendly challenges.
For information on Penetration Testing, please visit Plynt.com.
R6
