5 ms·

Although often not considered, the greatest flaw of captchas is they make some functionality unavailable for disabled web users (audio captcha for the deaf, sta

Although often not considered, the greatest flaw of captchas is they make some functionality unavailable for disabled web users (audio captcha for the deaf, standard distortion captchas for those with poor eyesight, flash captchas will also be impervious to screen readers). I have played with captchas a bit and I think its important to make captchas which rely on thinking and comprehending, not on some facet where human senses are still more acute than electronic sensors (this is a deadend, as computer cycles get cheaper and algorithms improve I don't really believe that human senses will be superior to dedicated electronic ones in well... anything). My favorite captcha (perhaps my own idea, not quite sure though) is to have something like this "Please enter the missing item: 532 533 534 535 536". This satisfies my requires for a 'fair' captcha: 1. it is delivery neutral (a screen reader, a blind individual, or a fully healthy individual can all understand this captcha), and 2. It is relatively resistant to brute force because the question doesn't contain the answer. As is stands, the vast majority of captcha implementations are discriminatory (you need to, at minimum, have a choice between an audio and a visual captcha, or use a captcha that is delivery neutral). The best way to avoid needing a captcha is to build a non-consistent UI (which is to say, to differentiate yourself, hopefully by making it better) that the existing spam algorithms won't recognize. Much like diverse genetics give species resistance to disease, diverse design and UIs give the internet resistance to spam.

Tichy 19y ago
I think there are algorithms that solve simple IQ tests like that. And how would the non-consistent UI work? Not use http Post anymore, just do everything with AJAX?
- willarson 19y ago
  Solving that test is indeed pretty simple, I think its O(n^2) give or take. Even if it was n^3 the value of n is so low it isn't restrictive. The benefit is that it is relatively uncommon (not being targeted), and it is more difficult than the average captcha (less likely to be targeted). It is also resistant to brute force (many captchas have the answer to them included in the question, this one requires some parsing and solving, not simply trying words near the captcha randomly). This captcha is not perfect, but I think it is better than most current captchas, and it is deliver neutral (doesn't penalize the impaired). Thus it seems like a step in the right direction, but is not a final destination by any means. By non-consistent UI I mean breaking the "Name, Email, Webpage, Body" paradigm. I think a good (although certainly harder to implement) example of this is http://www.djangobook.com/en/beta/chapter01/ http://www.djangobook.com/en/beta/chapter01/ . If you click on the little tabs/indexes on the side of the page a little comment box pops up that is relevant to the specific position. This UI is sufficiently different from a standard commenting system that a standard form filling spambot would be clueless. This is only an example, but perhaps it helps explain my idea of diversifying a bit. Other types of spam bots would not be affected, but perhaps similar changes would make them less effective as well (your example of using Ajax is a good possible example).

Tichy 19y ago

I think there are algorithms that solve simple IQ tests like that. And how would the non-consistent UI work? Not use http Post anymore, just do everything with AJAX?

willarson 19y ago
Solving that test is indeed pretty simple, I think its O(n^2) give or take. Even if it was n^3 the value of n is so low it isn't restrictive. The benefit is that it is relatively uncommon (not being targeted), and it is more difficult than the average captcha (less likely to be targeted). It is also resistant to brute force (many captchas have the answer to them included in the question, this one requires some parsing and solving, not simply trying words near the captcha randomly). This captcha is not perfect, but I think it is better than most current captchas, and it is deliver neutral (doesn't penalize the impaired). Thus it seems like a step in the right direction, but is not a final destination by any means. By non-consistent UI I mean breaking the "Name, Email, Webpage, Body" paradigm. I think a good (although certainly harder to implement) example of this is http://www.djangobook.com/en/beta/chapter01/ http://www.djangobook.com/en/beta/chapter01/ . If you click on the little tabs/indexes on the side of the page a little comment box pops up that is relevant to the specific position. This UI is sufficiently different from a standard commenting system that a standard form filling spambot would be clueless. This is only an example, but perhaps it helps explain my idea of diversifying a bit. Other types of spam bots would not be affected, but perhaps similar changes would make them less effective as well (your example of using Ajax is a good possible example).