Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 4 down vote favorite
3

In what case we should implement Captcha based security?. How accurate it is and if there exists any alternatives for Captcha based Security.

share|improve this question
Captcha are based upon the turning test and as such the main purpose is to differentiate human from machine. Pattern recognition, vocal, visual (dynamic/static) has been broken several time. Much of the time it become a pain for the end-user, because they are a pain to decipher. Cultural reference or social pattern could be proven useful, achieve the same purpose and be less annoying for your customer. – Happy ninja Jan 1 at 0:26

4 Answers

up vote 5 down vote accepted

I am not going into basics of CAPTCHAs based security as you can read it from Wikipedia. But what interesting is how accurate they are and what are the evaluating parameters for them. To my knowledge CAPTCHAs has been broken in research with image processing techniques but still requires practical implementation and its just a matter of time i.e. you can read a recent Decaptcha techique . There are two ways to evaluate CAPTCHAs

  1. Coverage : Number of captchas a user attempts
  2. Precision: Number of captchas answered correctly

A very nice must read paper for understanding use of Captcha based security.

share|improve this answer
5  
Or.. you know.. cheaply pay people in third world countries to solve captchas served by proxy. – Thomas Dec 28 '12 at 6:24
@Thomas Agreed that the question why captchas are being misused. In my point of view we are still adopting naive approaches in using captchas. Captchas can be used as a dual verification scheme where such attacks you have mentioned are not possible. Implementing captcha without understanding what it can do and what it can't is unrealistic. The papers i have mentioned address secure uses of captchas – Ali Ahmad Dec 28 '12 at 6:58
up vote 3 down vote

The captcha is a visual or audio challenge to the user to prevent bots and automated scripts from accessing the services protected by it.

It is valuable for:

  • forums that want to prevent spambots/adbots from signing up
  • protecting downloads from automated access by bots (which is not a security risk in itself, but a bandwidth drain)
  • Google uses it for search queries if there have been excessive numbers of queries from a single IP adress

A CAPTCHA does not provide any other kind of security, it only provides protection from bots and the rate limiting that comes with it.

The Wikipedia article on CAPTCHAs is quite comprehensive, you might want to have a look at that.

share|improve this answer
up vote 3 down vote

Right from the Captcha website:

A CAPTCHA is a program that protects websites against bots by generating and grading tests that humans can pass but current computer programs cannot. For example, humans can read distorted text as the one shown below, but current computer programs can't:

Applications of CAPTCHAs CAPTCHAs have several applications for practical security, including (but not limited to):

  • Preventing Comment Spam in Blogs.
  • Protecting Website Registration.
  • Protecting Email Addresses From Scrapers.
  • Online Polls.
  • Preventing Dictionary Attacks.
  • Search Engine Bots.
  • Worms and Spam.

They can be used in instances when you want to prevent a bot from automatically completing a process ( account registration, login after failed attempts etc)

share|improve this answer
up vote 2 down vote

There are alternatives to the common CAPTCHA approach that requires users to decipher warped and distorted text. Those hard-to read CAPTCHAs are easily solved by bots using optical character recognition (OCR) software and are extremely frustrating for your legitimate human website visitors. One alternative is called Confident CAPTCHA, which asks the visitor to identify specific pictures to prove they are human and not a bot. It's much easier for people to use than those hard to read text CAPTCHAs. At the same time, it's very difficult for bots to correctly solve because they have trouble understanding the semantic meaning of the instructions and then identifying the subject matter of random pictures in order to choose the right pictures.

share|improve this answer
I don't know if I'd go so far as saying they are easily solved by OCR. It's a constant back and forth and systems such as reCaptcha do a pretty good job of staying ahead of OCR efforts, but I still gave you a +1 because they can be hard to read for people and semantically complex instructions that can be machine generated and are resistant to a dictionary approach to identification can work well also. The main problem I could see with something like Confident CAPTCHA is that that a spammer could theoretically make a DB of all the photos which would make identification easy. – AJ Henderson Jan 3 at 19:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.