1

With the rise of google re-Captcha that is known to be the most effective one because of the use of real images that are computational hard to get distinguished from a machine. In other words a human is easily able to distinguish a truck from a duck whilst for a comptuter is rather hard or computational expensive to do that.

But I still wonder how old good text based captcha implementations like the one that gitea uses (look image bellow) are good enough to prove that the form has been submitted by a human? Or image recognition is the most efficient nowdays that these type of caphca tests has been rendered as junk?

Gitea login form

Improve this question
2
  • 2
    a quick google search for "break captcha" returns tests done over the years to measure the effectiveness. Like: independent.co.uk/life-style/gadgets-and-tech/news/…
    – schroeder ♦
    Jul 16, 2018 at 18:49
  • they 100% cut out the spam problems i faced on a few sites, i like that about them. Are they 100%? no, nothing is, but they do drastically cut down on "drivebys", any make more work for an attacker, which is always better than not.
    – dandavis
    Jul 17, 2018 at 21:28

1 Answer 1

Reset to default
1

They're useless. Alphanumeric captchas were defeated by off-the-shelf image-recognition libraries years ago.

Even Google's implementation can be bypassed by any sufficiently motivated actor by delegating the work to a click-farm for $0.01 cent per solution. There are literally pools of people who get paid pennies to solve these all day so bot traffic can be conducted unhindered.

Improve this answer
2
  • Uh, no. Just because there's lock picks doesn't mean it's useless to lock your door...
    – dandavis
    Jul 17, 2018 at 21:26
  • 1
    Captcha is the antique lock you install on a door made of straw. Its utility is easily compromised by commodity software and cannot be relied on to provide any measure of protection for production targets-- if there is quantifiable value in bypassing yours (account registration, web scraping, etc), all it takes is literally a couple dollars or a quick search on github to do so.
    – Ivan
    Jul 17, 2018 at 22:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .