Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The Asirra project is a Captcha alternative that shows you pictures of kittens and puppies to fend off bots and prove that the end user is a human.

Is anyone using Asirra (or something similar) in production? What alternatives are you aware of?

http://research.microsoft.com/en-us/um/redmond/projects/asirra/installation.aspx

Although I'd like to use images other than kittens, I noticed that from a implementation standpoint it's entirely managed though client side javascript. I would think that this type of solution would be easily cracked with a manually invoked form.submit method.

Is this technique common in the Captcha world? Is there a way to control the logic at the server side?

What are your thoughts on its implementation, alternatives, and how a more secure version could be made?

share|improve this question
    
Google can recognise what is in an image, so surely that could be done with bots. –  user2758631 Sep 29 '13 at 16:16
    
IMO the idea itself is flawed. You'd need a large categorized database to make this feasible, but I see no efficient way to generate such a database. A small database (e.g. with 3 million images) can be catagorized in its entirety by a spammer paying a few thousand dollars to people in low wage countries. After that you can use bots again. –  CodesInChaos Oct 1 '13 at 10:56

5 Answers 5

up vote 7 down vote accepted

Not relating specifically to Asirra, but wrt CAPTCHA in general, I will elaborate on @Graham's point and direct you to the following links:

In case you're lazy here are the highlights...
The 3 general ways of breaking CAPTCHAs are:

  • Broken implementation (e.g. wrong configuration, wrong settings, static images, exposing the answer, etc) - but probably does not apply to Asirra, unless its configuration-dependant
  • Inherent reverse-computability - If you can build a program to blur something that is still readable, I can build one to unblur it. I.e OCR is pretty darn good, at least if the image is readable by a human.
  • Putting a human in the mix, either by:
    • CAPTCHA farms: paying someone small amount of money, there is a MARKET for this: I've seen advertised on Ebay packages of 1000 CAPTCHAs "solved" for 4$, with a matching reliability % SLA
    • CAPTCHA Proxies, e.g. you can access pr0n if you solve this CAPTCHA... or even make a game out of it.

To sum up (as I've often done on this topic):

CAPTCHA tries to solve the wrong problem, and it does it badly: even if it worked perfectly, the problem is not "I want to identify who is a computer and who is a human and allow only humans to use my site however they want", but rather "I want to prevent misuse and flooding on my site".
We shouldnt be trying to turing-test the users, we should be limiting what they could do.

Or even better:

Authentication (or identification) is a poor replacement for authorization.

share|improve this answer
    
Also, this came up on comp.risks today: wired.com/threatlevel/2010/11/wiseguys-plead-guilty –  user185 Nov 28 '10 at 12:04

Any CAPTCHA mechanism can be subverted by finding a weak economy and giving people there a small amount of money to solve a large amount of CAPTCHAs.

share|improve this answer

Asirra does client-side validation just for convenience -- that is, so you can design a web page that prevents the form from being submitted without the captcha being solved. This prevents the annoyance of navigating away from a filled-out form only to be told the captcha failed.

In asirra, as the installation page describes, the real security comes from the fact that the code you write on the back-end to do form processing has to also hit the Asirra service and make sure that the form was submitted with a valid ticket that is given out to clients only when the challenge has been solved.

Of course as the posters above describe, this "security" only really says that someone or something has identified 12 pictures as cats/dogs. There isn't a good way to know, for example, if the photos were actually solved by some advanced AI or by a guy in China working for $3/hr (see PixProfit.com)

share|improve this answer

The MSFT Ajax Toolkit has a captcha-free implementation that uses a variety of transparent means to verify a user. EXAMPLE DEMO

This is pretty intelligent code that may be incorporated into other systems for the ultra-bot-paranoid.

share|improve this answer

Asirra is used by Microsoft's Club Bing. http://www.clubbing.com

http://decaptcher.com provides Asirra service but their service is very poor.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.