Re:Ask HN: Are some signup CAPTCHAs becoming a bit ridiculou...
by nmc on Tuesday May 27, 2014 @12:50PM
(#7805390)
> any captcha worth breaking is already "broken", given the existence of captcha farms
Yes, but there remains a cost. The goal of a security measure is to make it so difficult/expensive that it becomes worthless doing.
Re:Ask HN: Are some signup CAPTCHAs becoming a bit ridiculou...
by shubhamjain on Tuesday May 27, 2014 @01:29PM
(#7805647)
This is like saying we should stop locking our doors because every door can be broken by a locksmith anyway. The purpose of captcha is not to break any attempts of automation but only to make it more harder. Considering that automating a script to break captcha with human intelligence / automation is not trivial by any means I think, they serve their purpose.
Even so, the constant war of escalation between captchas and anti-captcha measures should eventually lead to the necessity to create a captcha which is impossible for most humans to decipher, once the capability of software to decipher them passes baseline human ability. At that point, just being able to solve the captcha would more or less prove you're probably not a human being. So the basic model of "text a human can read but a computer can't" is probably obsolete, and only still works due to the inertia of programmer laziness, and the fact that breaking captchas probably doesn't have a ROI worth the trouble for most sites.
Constructing more subtle captchas present their own problems, in that they can make cultural assumptions about the user. If you're also using the captcha as a community filter, this may be a feature though (for instance - having a site about anime set up a quiz about anime as a captcha, or having users solve complex programming puzzles.) Even so, any process which a human can perform through rote UI can be automated, so even those tests will fail. Most captchas are poorly designed and leak their solutions one way or another anyway. I've even seen a few posted here which seem to add their solutions in plaintext to the form as a hidden field or something.
I haven't got a clue what Recaptcha can be replaced with once it's thoroughly useless, but i've come to believe that captchas are one of those things it's impossible to do correctly, just adequately most of the time.