With the rise of google re-Captcha that is known to be the most effective one because of the use of real images that are computational hard to get distinguished from a machine. In other words a human is easily able to distinguish a truck from a duck whilst for a comptuter is rather hard or computational expensive to do that.

But I still wonder how old good text based captcha implementations like the one that gitea uses (look image bellow) are good enough to prove that the form has been submitted by a human? Or image recognition is the most efficient nowdays that these type of caphca tests has been rendered as junk?

Gitea login form

  • 2
    a quick google search for "break captcha" returns tests done over the years to measure the effectiveness. Like: independent.co.uk/life-style/gadgets-and-tech/news/… – schroeder Jul 16 '18 at 18:49
  • they 100% cut out the spam problems i faced on a few sites, i like that about them. Are they 100%? no, nothing is, but they do drastically cut down on "drivebys", any make more work for an attacker, which is always better than not. – dandavis Jul 17 '18 at 21:28

They're useless. Alphanumeric captchas were defeated by off-the-shelf image-recognition libraries years ago.

Even Google's implementation can be bypassed by any sufficiently motivated actor by delegating the work to a click-farm for $0.01 cent per solution. There are literally pools of people who get paid pennies to solve these all day so bot traffic can be conducted unhindered.

  • Uh, no. Just because there's lock picks doesn't mean it's useless to lock your door... – dandavis Jul 17 '18 at 21:26
  • 1
    Captcha is the antique lock you install on a door made of straw. Its utility is easily compromised by commodity software and cannot be relied on to provide any measure of protection for production targets-- if there is quantifiable value in bypassing yours (account registration, web scraping, etc), all it takes is literally a couple dollars or a quick search on github to do so. – Ivan Jul 17 '18 at 22:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.