In what case we should implement Captcha based security?. How accurate it is and if there exists any alternatives for Captcha based Security.
I am not going into basics of CAPTCHAs based security as you can read it from Wikipedia. But what interesting is how accurate they are and what are the evaluating parameters for them. To my knowledge CAPTCHAs has been broken in research with image processing techniques but still requires practical implementation and its just a matter of time i.e. you can read a recent Decaptcha techique . There are two ways to evaluate CAPTCHAs
- Coverage : Number of captchas a user attempts
- Precision: Number of captchas answered correctly
A very nice must read paper for understanding use of Captcha based security.
The captcha is a visual or audio challenge to the user to prevent bots and automated scripts from accessing the services protected by it.
It is valuable for:
- forums that want to prevent spambots/adbots from signing up
- protecting downloads from automated access by bots (which is not a security risk in itself, but a bandwidth drain)
- Google uses it for search queries if there have been excessive numbers of queries from a single IP adress
A CAPTCHA does not provide any other kind of security, it only provides protection from bots and the rate limiting that comes with it.
The Wikipedia article on CAPTCHAs is quite comprehensive, you might want to have a look at that.
There are alternatives to the common CAPTCHA approach that requires users to decipher warped and distorted text. Those hard-to read CAPTCHAs are easily solved by bots using optical character recognition (OCR) software and are extremely frustrating for your legitimate human website visitors. One alternative is called Confident CAPTCHA, which asks the visitor to identify specific pictures to prove they are human and not a bot. It's much easier for people to use than those hard to read text CAPTCHAs. At the same time, it's very difficult for bots to correctly solve because they have trouble understanding the semantic meaning of the instructions and then identifying the subject matter of random pictures in order to choose the right pictures.
Right from the Captcha website:
A CAPTCHA is a program that protects websites against bots by generating and grading tests that humans can pass but current computer programs cannot. For example, humans can read distorted text as the one shown below, but current computer programs can't:
Applications of CAPTCHAs CAPTCHAs have several applications for practical security, including (but not limited to):
- Preventing Comment Spam in Blogs.
- Protecting Website Registration.
- Protecting Email Addresses From Scrapers.
- Online Polls.
- Preventing Dictionary Attacks.
- Search Engine Bots.
- Worms and Spam.
They can be used in instances when you want to prevent a bot from automatically completing a process ( account registration, login after failed attempts etc)