7 ms·

So you are, literally, arguing for security by obscurity. "Oh, my captcha is unique, therefore nobody will bother". There are easier to implement unique captch

by rorrr 14y ago

So you are, literally, arguing for security by obscurity. "Oh, my captcha is unique, therefore nobody will bother". There are easier to implement unique captchas, than chess.

aethertap 14y ago
I'd agree partially, but I'd comment that it's also security by diversity. If every site had a unique captcha solution requiring custom software for a defeat, the force multiplier effect of "write once, run everywhere" would be hugely diminished, and it would be much less cost effective to implement various types of spam. So, the particular security strategy here is indeed weak, but I would say that it might actually strike closer to the root of the problem than just making a really hard, but still universally applied, captcha technology.
- rorrr 14y ago
  You are not making any sense.
  - aethertap 14y ago
    The economics of spam commenting makes sense if it can be done automatically at a massive scale. If only one or a very small number of "humanity tests" exist, then cracking those tests has a high payoff value. Having a huge number of different, ad-hoc authentication schemes would make developing automatic cracks unacceptably expensive for the actual level of benefit achieved by posting the spam comment. Therefore, being a site with a unique CAPTCHA system attacks the core value proposition of spam comments, which strikes the root of the issue. Another way to look at it is like the entire collection of CAPTCHAs on the Internet is really just one big CAPTCHA library, which tests a subset of "human" abilities. The larger the subset, the more difficult it will be to circumvent. Relying on one or two special abilities makes it easier for a machine to emulate those behaviors and gain access. I hope that clarifies the point I was making.
danielweber 14y ago
Obscurity can be a great tool for security. But you have to understand its limitations, and expect at some point it will fail. Custom captchas are probably a great use of this.

by rorrr 14y ago

So you are, literally, arguing for security by obscurity. "Oh, my captcha is unique, therefore nobody will bother". There are easier to implement unique captchas, than chess.

aethertap 14y ago

I'd agree partially, but I'd comment that it's also security by diversity. If every site had a unique captcha solution requiring custom software for a defeat, the force multiplier effect of "write once, run everywhere" would be hugely diminished, and it would be much less cost effective to implement various types of spam. So, the particular security strategy here is indeed weak, but I would say that it might actually strike closer to the root of the problem than just making a really hard, but still universally applied, captcha technology.

rorrr 14y ago
You are not making any sense.
- aethertap 14y ago
  The economics of spam commenting makes sense if it can be done automatically at a massive scale. If only one or a very small number of "humanity tests" exist, then cracking those tests has a high payoff value. Having a huge number of different, ad-hoc authentication schemes would make developing automatic cracks unacceptably expensive for the actual level of benefit achieved by posting the spam comment. Therefore, being a site with a unique CAPTCHA system attacks the core value proposition of spam comments, which strikes the root of the issue. Another way to look at it is like the entire collection of CAPTCHAs on the Internet is really just one big CAPTCHA library, which tests a subset of "human" abilities. The larger the subset, the more difficult it will be to circumvent. Relying on one or two special abilities makes it easier for a machine to emulate those behaviors and gain access. I hope that clarifies the point I was making.

danielweber 14y ago

Obscurity can be a great tool for security. But you have to understand its limitations, and expect at some point it will fail. Custom captchas are probably a great use of this.