News for hackers. Stuff that matters.
Re:Ask HN: Are some signup CAPTCHAs becoming a bit ridiculou... by krapp on Tuesday May 27, 2014 @11:48AM (#7805051)
It seems to me that any captcha worth breaking is already "broken", given the existence of captcha farms - and I put broken in quotes because technically, with captcha farms, the captcha is working as designed, you're just paying human beings to break them. The assumption, of course, that there is necessarily a difference between a "spambot" and a "human being" is not as true as it used to be.

Even so, the constant war of escalation between captchas and anti-captcha measures should eventually lead to the necessity to create a captcha which is impossible for most humans to decipher, once the capability of software to decipher them passes baseline human ability. At that point, just being able to solve the captcha would more or less prove you're probably not a human being. So the basic model of "text a human can read but a computer can't" is probably obsolete, and only still works due to the inertia of programmer laziness, and the fact that breaking captchas probably doesn't have a ROI worth the trouble for most sites.

Constructing more subtle captchas present their own problems, in that they can make cultural assumptions about the user. If you're also using the captcha as a community filter, this may be a feature though (for instance - having a site about anime set up a quiz about anime as a captcha, or having users solve complex programming puzzles.) Even so, any process which a human can perform through rote UI can be automated, so even those tests will fail. Most captchas are poorly designed and leak their solutions one way or another anyway. I've even seen a few posted here which seem to add their solutions in plaintext to the form as a hidden field or something.

I haven't got a clue what Recaptcha can be replaced with once it's thoroughly useless, but i've come to believe that captchas are one of those things it's impossible to do correctly, just adequately most of the time.

Re:Ask HN: Are some signup CAPTCHAs becoming a bit ridiculou... by nmc on Tuesday May 27, 2014 @12:50PM (#7805390)
> any captcha worth breaking is already "broken", given the existence of captcha farms

Yes, but there remains a cost. The goal of a security measure is to make it so difficult/expensive that it becomes worthless doing.

Re:Ask HN: Are some signup CAPTCHAs becoming a bit ridiculou... by shubhamjain on Tuesday May 27, 2014 @01:29PM (#7805647)
This is like saying we should stop locking our doors because every door can be broken by a locksmith anyway. The purpose of captcha is not to break any attempts of automation but only to make it more harder. Considering that automating a script to break captcha with human intelligence / automation is not trivial by any means I think, they serve their purpose.
Re:Ask HN: Are some signup CAPTCHAs becoming a bit ridiculou... by Xenmen on Tuesday May 27, 2014 @09:20PM (#7807882)
The issue is that, given a little more time, we'll see a "one-size-fits-all" captcha breaker, one that needs little to no modification to break the captcha on new sites.
Re:Ask HN: Are some signup CAPTCHAs becoming a bit ridiculou... by krapp on Tuesday May 27, 2014 @07:49PM (#7807600)
A captcha is better than nothing.