Monday, June 11, 2007

The end of CAPTCHA? - hardly

The NYT has an article predicting the end of CAPTCHAs, or rather their replacement with a new type of test.

I don't think we have seen the end of the CAPTCHA. Like passwords they are easy to implement and have a high ratio of perceived security to cost. Designers like to sprinkle them liberally onto their Web sites as 'magical anti-bot pixie-dust'.

The problem with CAPTCHAs and their replacements is that the problems chosen are hard for computers to solve because until recently there was no incentive to solve them. Back in 2000 there was nobody who was spending their time trying to OCR on text that had been deliberately obfuscated with lines, distortion, etc. Today there are plenty of folk in Eastern Europe and Russia who have become experts at it.

Asking folk to pick out all the cats from a mixture of cats and dogs may appear hard today, but wait a couple of weeks after deployment and see if it is still so hard.

And there is also the systems attack. Methinks that Microsoft do not have a very large catalog of photographs to show to users, maybe a thousand, maybe a hundred thousand. The attackers don't need to build a machine to sort the pictures out, they can have people do that for them. They can use the man-in-the-middle porn site attack or just pay folk to do it for them. All they need to do once the pictures are sorted is to undo whatever obfustication is in place to prevent simple matching of the photographs.

Bruce Schneier often remarks that anyone can design an encryption scheme that they cannot break themselves. In the area of CAPTCHAs I can't do that. I can break every scheme I have seen and I can break every scheme I can think of.

Update: Welcome TPM visitors. Following Josh's link it turns out that the database of pet pictures has two million entries. More significant though is the rate of addition - 10,000 a day. This is an order of magnitude higher than my original guess, but I don't think it invalidates the suggested lines of attack.

The hard part is cataloging the original database - ten man years worth of effort. That is certainly going to cost more than the $5,000 the Kiev gang would charge for breaking a text CAPTCHA. Unfortunately certain organized crime rings have repeatedly demonstrated that they have the necessary level of resources to simply pay people to break the problems by brute force.

Once the main catalog is sorted it is quite easy to keep up as it turns out that Asirra has a 'tell'. If you have 90% of the catalog archived and the images are selected randomly the chances are that you will only be presented with one unknown image per test. Since Asirra requires the subject to be 100% correct a cataloging bot can tell whether the unknown image was a dog or a cat by whether it passed the test or not. A simple way to fix this tell would be to weaken the match criteria so that 9 out of 10 correct answers was sufficient, but this opens up the door to other attacks.

The other weakness I see in the approach is asking image recognition experts to estimate the difficulty of differentiating pictures of cats from pictures of dogs. It isn't the right test. The hidden assumption here is that the best attack is going to solve the problem the way a human would. Thats not the way internet criminals think. Ants solve similar problems every day with 100,000 total neurons.

Update 2: it appears that the code as implemented, as opposed to the documentation allows one wrong answer out of 12. Turns out that it does not defeat the automatic cataloging attack described earlier as I assumed. In order to use the automatic cataloging trick the attacker would have to present ten correct tries, and one deliberately wrong try together with the unknown picture.

74 comments:

Jim Heartney said...

I know there'd be copyright problems with this, but one way you could keep ahead of cats vs. dogs picture database attack would be to use celebrity pictures, as in "select all the Britneys." Since there is a massive and constantly growing collection of Britney pictures out there (many conveniently labeled with her name already) you could send a bot out to collect Britney images all the time. People trying to keep a database of images to use against your CAPCHA widget wouldn't be able to keep up.

Timothy said...

I saw an interesting technique on a blog the other day that did away with images all together. It simply prompted the user to answer a question: 'What color is an orange?' Seems like it might be difficult to design something capable of overcoming a shifting series of simple questions like that. Especially if, instead of a pre-set database of questions, the administrator simply came up with a sufficiently random question off the top of his head every so often, which doesn't seem too demanding.

Ron said...

wow, cool post, dood.

Chris said...

Microsoft is claiming over 2 million photos. That doesn't invalidate your point, but Microsoft at least is making the bar a little higher than you mention.

Dave said...
This comment has been removed by a blog administrator.
Nick said...

What everyone seems to miss is the subtitle of the original CAPTCHA paper: "How Lazy Cryptographers Do AI".

From the academic/crypto viewpoint, people breaking CAPTCHAs is good becasue the goal is to force them to solve an otherwise hard and annoying problem (eg, character recognition when things are really distorted).

Phill H-B said...

I just turned CAPTCHA on for posting comments, could not resist the irony.

I had not seen the final paper How Lazy Cryptographers do AI but it is worth a read and as is often the case the inventors of the scheme are more than aware of the weaknesses that later deployments blithely ignore.

The problem here is that the CAPTCHA technology was designed before professional Internet crime was widely acknowledged as a problem. Any CAPTCHA test is certainly sufficient to block vote fraud, stopping crime is quite a different matter. Whoever is paying $5,000 to break CAPTCHAs is creating one heck of a lot of accounts somewhere.

An amusing side note: if you have read Doonesbury you will know that Alex went to MIT after an online poll where the MIT students proved to be better at stuffing the ballot than CMU.

Josh Yelon said...

Actually, it's much harder to solve than you think. I'm using this captcha on our forums:

http://panda3d.org/phpbb2/

Click on the "register" link to see the captcha. The forum admin is expected to drop in their own photographs. This is as simple as copying them from your digital camera into the image directory. Furthermore, the forum admin can choose any two kinds of objects, not just cats and dogs. If you give the forum admin this range of choice, then effectively, every website has its own custom captcha.

Gadfly said...

How much more, or less, secure than capchas are things such as my one Senator's website uses, where you have to choose word No. 5, or whatever, from a list of eight, and the count varies whether top-down or bottom-up?

Phill H-B said...

In response to Gadfly, schemes like that are perfectly secure until they are used widely enough to provide an incentive to an attacker.

DrFu said...

given a large collection of search terms, couldn't this image CAPTCHA be implemented through Google images? This could save you a hell of a lot in storage, bandwidth and cataloging -- no need to index the damned things, let Google do it for you... send two queries to Google image search ('cat' and 'dog'), cache the top 5 of the resulting images to your local server, present the images, then ask the user to pick one of the images that is of a cat. No need to obfuscate the image, since the odds of you using it again are quite slight.

I think that with the image labeling business Google Image Labeler you could get even better assurance that what you present really does have something to do with your search.

Phill H-B said...

DrFu

Google images tends to be a counter-example. What Google can do automatically the attackers can do automatically.

The cost to the attacker is proportional to the cost to the defender here, there is no exponential leverage.

Search Engine Optimization said...

Aside from the complex physical connections that make up its infrastructure, the Internet is facilitated by bi- or multi-lateral commercial contracts (e.g., peering agreements), and by technical specifications or protocols that describe how to exchange data over the network. Indeed, the Internet is essentially defined by its interconnections and routing policies.

As of December 30, 2007, 1.319 billion people use the Internet according to Internet World Stats. Writing in the Harvard International Review, philosopher N.J. Slabbert, a writer on policy issues for the Washington, D.C.–based Urban Land Institute, has asserted that the Internet is fast becoming a basic feature of global civilization, so that what has traditionally been called "civil society" is now becoming identical with information technology society as defined by Internet use. - web design company, web designer, web design india

milf said...

black mold exposureblack mold symptoms of exposurewrought iron garden gatesiron garden gates find them herefine thin hair hairstylessearch hair styles for fine thin hairnight vision binocularsbuy night vision binocularslipitor reactionslipitor allergic reactionsluxury beach resort in the philippines

afordable beach resorts in the philippineshomeopathy for eczema.baby eczema.save big with great mineral makeup bargainsmineral makeup wholesalersprodam iphone Apple prodam iphone prahacect iphone manualmanual for P 168 iphonefero 52 binocularsnight vision Fero 52 binocularsThe best night vision binoculars here

night vision binoculars bargainsfree photo albums computer programsfree software to make photo albumsfree tax formsprintable tax forms for free craftmatic air bedcraftmatic air bed adjustable info hereboyd air bedboyd night air bed lowest pricefind air beds in wisconsinbest air beds in wisconsincloud air beds

best cloud inflatable air bedssealy air beds portableportables air bedsrv luggage racksaluminum made rv luggage racksair bed raisedbest form raised air bedsaircraft support equipmentsbest support equipments for aircraftsbed air informercialsbest informercials bed airmattress sized air beds

bestair bed mattress antique doorknobsantique doorknob identification tipsdvd player troubleshootingtroubleshooting with the dvd playerflat panel television lcd vs plasmaflat panel lcd television versus plasma pic the bestThe causes of economic recessionwhat are the causes of economic recessionadjustable bed air foam The best bed air foam

hoof prints antique equestrian printsantique hoof prints equestrian printsBuy air bedadjustablebuy the best adjustable air bedsair beds canadian storesCanadian stores for air beds

migraine causemigraine treatments floridaflorida headache clinicdrying dessicantair drying dessicantdessicant air dryerpediatric asthmaasthma specialistasthma children specialistcarpet cleaning dallas txcarpet cleaners dallascarpet cleaning dallas

vero beach vacationvero beach vacationsbeach vacation homes veroms beach vacationsms beach vacationms beach condosmaui beach vacationmaui beach vacationsmaui beach clubbeach vacationsyour beach vacationscheap beach vacations

bob hairstylebob haircutsbob layeredpob hairstylebobbedclassic bobCare for Curly HairTips for Curly Haircurly hair12r 22.5 best pricetires truck bustires 12r 22.5

washington new housenew house houstonnew house san antonionew house venturanew houston house houston house txstains removal dyestains removal clothesstains removalteeth whiteningteeth whiteningbright teeth

jennifer grey nosejennifer nose jobscalebrities nose jobsWomen with Big NosesWomen hairstylesBig Nose Women, hairstyles

lalit said...

Web Art Sense a web design company is here for a purpose to make art and design of your imagination alive and real on the web platform. After several months of hunting of the best talent and struggling for the name of their design company they finally reached a vertical which engages their vision of togetherness. The best talented people in web designs have joined hands to compete and provide innovative, unique concepts to users/clients all across the globe. Web Art Sense is not any design company; they take real care of having your brands be presented that invokes your revelation to others who see it.

Web Art Sense has their sales offices in London, New Jersey and New Delhi are heading towards marketing themselves to main continents of Europe, Australia and America. Web art sense already has ground foundation and is providing web based design development and SEO Services in countries like USA, UK, Australia and Italy. Web Art Sense has been growing above hundred percent every financial year since its foundation.
Web Design Company

Web Art Sense a leading web design company, affordable web design, web development, ecommerce, XHTML Services. Web Design Company offers a complete collection of web design solutions for business. Web Art Sense team of professionals with proven knowledge in the field of web design & development are skilled of providing high quality, e commerce websites, development and website redesign & maintenance solutions.

Aparna said...

Thank you for this nice post. Website Hosting | windows hosting

suparna said...

Thanks for such an informative post.
Web Developer  |   Web Design

Amrit Ray said...

Captchas are sometimes really irritating. Especially for the fact that they are at times so difficult to read. Why can't they be made for easier human reading? Web Designer Web Hosting

dhd said...

Day night,gold für wow the moon or on world of warcraft gold the tree,cheap wow gold Hao Jie pouring down the moonlight, as if accompanied by Xiaotu Feifei enter sweet dreams. In the dream, a dream Feifei about his sister to the moon night. Will open the door,wow gold kaufen go down the moon sister.mesos Xiaochanzouxia take is that they did not see the moon sister. At that time, anchored at the tree on the moon sister saw Xiaochan, they yelled loudly: "Feifei, Feifei, I tree, the tree, I." Xiaochan sit at the moon to his sister, who Daizhaoxiaochan came wow geld to the beautiful pond. Only, water,maple story mesos everywhere in the lush leaves and beautiful flowers.maple story items A frog squatting lotus leaf, see Xiaochan, surprised and said: "Xiaochan,wow gold farmen you can even sit on the moon. You simply It's amazing!maple story money I am sure that you are the first animals to the moon by the animal. good,wow leveling I envy you!Maple Story Accounts "Xiaotu listening, happy to smile. Then, with the moon sister Xiaotu to its home.powerlevel Only, the moon sister's home stars are everywhere. The eyes of a star a Zha Zha,world of warcraft power leveling like Xiaotu greeted the arrival of a mouth, like: "Xiaochan, Hello, we at the Moon Palace waiting for your arrival."maple story powerleveling Xiaotu listened

Gayathri said...

Quite informative post! Thanks!!

Regards,
photoshop masking

charles said...

Affiliate Marketing is a performance based sales technique used by companies to expand their reach into the internet at low costs. This commission based program allows affiliate marketers to place ads on their websites or other advertising efforts such as email distribution in exchange for payment of a small commission when a sale results.

www.onlineuniversalwork.com

the said...

Top website designing company in India, Nashik provding world class website design and solutions.
Nashik Website Designing, Nasik Webpage Design, Nashik Website Design, Nashik website company, SEO Company Nashik, Nashik Website Development Services

vishal said...

Earning money has online never been this easy and transparent. You would find great tips on how to make that dream amount every month. So go ahead and click here for more details and open floodgates to your online income. All the best.
Thanks.

jimmychooshoes said...

mcqueen shoes
alexander mcqueen heels
Alexander McQueen Store
Jimmy Choo sale
Replica jimmy choo shoes
manolo blahnik online store
manolo shoes
manolo blahnik sale
replica christian louboutin shoes
discount christian louboutin shoes
alexander mcqueen shoes
jimmy choo outlet
jimmy choos
jimmy shoes
Manolo Blahnik Shoes
christian shoes
Christian Louboutin Alta Perla Strass 100 sandals
Christian Louboutin - Declic leather pumps
Manolo Blahnik Something Blue Satin Pump
Manolo Blahnik Satin Jeweled d'Orsay Pump

Priya said...

Nice post dude, keep it up.
Price India

cheapcallstophone said...

Great Post.Web Design Company India

zcocorporation said...
This comment has been removed by the author.
Priya said...

Really nice blog, very informative. Thanks dude for wonderful posting. Keep it up in the future as well. SEO Services UK

jia said...

nice post....web designing company noida

cheapcallstophone said...

Very nice and informative article thanks for sharing

SEO UK

Pooja said...

Nice information, many thanks to the author. It is incomprehensible to me now, but in general, the usefulness and significance is overwhelming. Thanks again and good luck! Web Design Company

vishu said...

Really looking forward to the next few days when people start properly aggregating this information.Will be interesting to see if what Google reports seem to match the studies we have done on the basis of your experiments for our Seo Company India website

seouk1 said...
This comment has been removed by the author.
Alvin said...

for that awesome posting. It saved MUCH time :-)
------------------------------
numerology predictions

Web Design Company said...

These pictures are so impressive. I am sure my peers will enjoy these too.genital warts treatment

Steave said...

Thanks for taking this opportunity to discuss this, I feel fervently about this and I like learning about this subject.
------------------------
Sarrell Dental Center

Kevin said...

KidsDesk.net brings innovative products and educational resources to parents, caretakers and educators. With products ranging preschool to grade school age children.childrens furniture

Priya said...

It's hard to find quality writing like yours these days. I really appreciate people like you! Take care and see you soon
Printing Services

Vinny said...

Outstanding job! The comprehensive data delivered was very useful. I am hoping that you keep up the good job succesfully done.
Locksmith San Jose CA

SEO Services Consultants said...

Hello! I just would like to give a huge thumbs up for the great info you have here on this post. I will be coming back to your blog for more soon.

Uk Ties

SEO Services Consultants said...

This is a GREAT post! I hope you not mind.I published an excerpt on the site and linked back to your own blog for people to read the full version. Thanks for your advice.strumpfhosen

Harry said...

Forniamo ai nostri clienti servizi di sviluppo di siti web e servizi di web design.Realizzazione Sito

Harry said...

Felix Labs is a best web Design Company india, providing top flash web design services, website development services and 3d animation services. Get high quality website development and web design services from the experts.Web design company

Harry said...

ESG Appliance is an appliance repair and service company operating in the Los Angeles and Orange counties and providing Installation, Service and Maintenance for appliances like Ice Maker, Microwave Oven, Washer Dryer.Washer Dryer

Maninder Kaur said...

This is a good common sense article. Very helpful to one who is just finding the resources about this part. It will certainly help educate me. Web Designing Company

vibrams said...

The christian louboutin heels is designed for the ladies. Since the pumps was born, the ladies life become colorful. The christian louboutin evening pumps are the god's masterwork. Who invited thechristian louboutin pumps? Seldom people knew, but I think every lady would be grateful for him. Among the countless pumps, the christian louboutin peep toe is the most outstanding ones. The elegant pattern, the delicate style all mold the ladies perfect leg profile. Flowers in the spring of 2011 creeping, up from hair to clothes continue to footwear, have had a brilliant up. In such a glamor, spring and summer flowers now here. Romance is a woman's mood, exquisite flowers just right of expression in our gestures, the woman, how can we not love the romantic temperament so that they distributed the flowers do? 2011 flowers bloom will enjoy different poses! The Christian Louboutin 2011 Sandals also can adds the hright of the ladies, it bring surprise to the short lady. Especially the red sole of the louboutin heels, magic and sexy, many ladies are crazy. The red sole, the first feature of the Christian Louboutin stroe.

Web Designing Company said...

This is a good common sense article. Very helpful to one who is just finding the resources about this part. It will certainly help educate me.

Web Designing Company

SEO Services Consultants said...

I just wanted to add a comment here to mention thanks for you very nice ideas. Blogs are troublesome to run and time consuming thus I appreciate when I see well written material. Your time isn’t going to waste with your posts. Thanks so much and stick with it No doubt you will definitely reach your goals! have a great day!


virtual assistant

SEO Services Consultants said...

This is a GREAT post! I hope you not mind.I published an excerpt on the site and linked back to your own blog for people to read the full version. Thanks for your advice.
Price trades

SEO Services Consultants said...

This is a good common sense article. Very helpful to one who is just finding the resources about this part. It will certainly help educate me.

Virtual Administrative Assistant

tango tango said...

Wow, Fantastic article, it’s so helpful to me, and your blog is very good,

Tango i oslo

biditcheap web said...

Wow, Fantastic article, it’s so helpful to me, and your blog is very good,

Online auctions sites

SEO Services Consultants said...

Thank you for another fantastic blog. Where else could I get this kind of information written in such an incite full way? I have a project that I am just now working on, and I have been looking for such information… Regards…
Deep Cycle Battery

Lingerie Pantyhose said...

Nice Blog
Pantyhose

Lingerie Pantyhose said...

Great Post
Pantyhose

softtrix said...

I found your website perfect for my needs. It contains wonderful and helpful posts. I have read most of them and learned a lot from them. You are doing some great work. Thank you for making such a nice websiteSEO Services

sjflksd said...

Thank you for sharing this site with us..It’s a great help for those who wants to make their website successful..application development

EmmaRichard said...

I completely agreed with you.I liked your post a lot.
Thanks a ton for this lovely information..........
SEO services London

my seo said...

you did a great job ink cartridges printer like you working ,keep it up

webdesign said...

Thanks good idea SEO company India

sem said...

good post keep it up thanks for sharing web design company India

Admin said...

Thanks for the nice information. I am sure, I will tweet this to my twitter account. This will help a lot of users.

Local Map Optimization Video

mumtaz said...

Thanks for this great informative information shared with great thoughts and ideas.
web designing company

Maxdence said...

interesting conversation you have here guys, i never know things like that happening, thanks for providing this information and letting me know all this.
Flights to New York

Admin said...

Thanks for this article. It's just what I was searching for. I am always interested in this subject.

Building Logo

forex robot said...

Yep, these Internet conditions haunt most of the people like us who live and earn their life on the Internet. I am an Internet developer for ages now and I dont seem to see good progress or awareness in this sector through the years.

British Luxury Watch

rocky case said...

Stephen Stapinski


Really your blog is very interesting.... it contains great and unique information. I enjoyed to visiting your blog. It's just amazing.... Thanks very much for the share.

Felix Smith said...

Great Site, your plugins are very useful and save me a tonne of time. Cheap Essay Writing

Felix Smith said...

Great informative post and i really likes your information, most of the peoples are likes your blog because its having the good knowledge. thanks for your good informative post. Thesis Paper Writing

Felix Smith said...

Great to read about that. I was just searching for this. Well, I love the design of your website, I will be waiting for further updates. Essay Writing Services

Allen Perry said...

Best wishes for display rather good informations. Your search engines is great.I am impressed by the info that you've on this blog. It exhibits how effectively you understand this subject. Bookmarked this method page, will come back again for additional. You, my friend, amazing! I found just the details I previously explored all over the place and just can't come across. What a perfect site. Such as this web site your web-site is one of my new most liked.I similar to this information shown and it has provided me some sort of motivation to possess good results for some reason, so maintain up the decent do the job!
Sigma Writers | custom essay writing

Felix Smith said...

Great informative post and I really likes your information, most of the peoples are likes your blog because its having the good knowledge. thanks for your good informative post. Paper Writing Services
Thesis Paper Writing
Research Paper Writing
Letter Writing Services

david paul said...

Thanks for your excellent posting. I really enjoyed reading this blog.
Cheap Essays

Arabella Simson said...


I wanted to thank you for this great read!! I definitely enjoyed every little bit of it
Airport Taxi