17

Is reCaptcha now basically useless?

I have read around the internet that reCaptcha has been broken and spam bots can easily overcome it. Has Google addressed this at all. Do they have any plans to fix it? I cannot find this type of info on the web, and I was hoping somebody may have some insight.

Are there any similar, reliable, more secure webservices out there for this type of thing? I do not want to have to make my own captcha type class because on-the-fly image processing is fairly resource intensive, and I do not want to make a Q&A type captcha (I do not want this class to need DB access).

Any suggestions or info about reCaptcha's problems are welcome.

Improve this question
6
  • 5
    Random thought: You could do a Q&A type system without a database, by presenting simple math puzzles: "Please type the number that you get when you multiply 7 by 3:" Could someone figure out a way to get past that? Sure, but it would take at least a little bit of work, so it might be worth it.
    – MatrixFrog
    Jul 7, 2011 at 23:31
  • or a mix of two
    – Lukasz Madon
    Jul 7, 2011 at 23:35
  • 1
    Perhaps relevant: stackoverflow.com/q/448963/590790
    – Steven Jeuris
    Jul 7, 2011 at 23:36
  • 3
    Isn't the point of reCaptcha that the text is actually scanned text from books and documents? Specifically, text which could not be read by existing OCR? I don't know how you can "break" recaptcha, since they are always including more text from more sources. The only way to truly "break" it would be to develop a "perfect" OCR, that detects what all the other fail. Outside of directly using OCR, I'd imagine any other security issues could be fixed...
    – ProdigySim
    Jul 8, 2011 at 17:21
  • There was an interesting one a while back that showed (for example) a grid of pictures of dogs, with a couple of pictures of cats salted in randomly, and you just click on the cats. I can't see how you would automate a crack for that. The only drawback is it would be unusable for blind folks.
    – Alan B
    Dec 7, 2011 at 11:39

7 Answers 7

Reset to default
12

Captcha has always been vulnerable to a simple man-in-the-middle attack where the spammer relays the images to its own captcha on a website which offers mp3 downloads or porn for free. It doesn't matter what type of captcha you use.

Detecting behaviour patterns is the way to go.

Improve this answer
1
  • Interesting, didn't know that approach.
    – Thomas Stock
    Dec 7, 2011 at 12:48
7

I never liked captcha's. I even have seen one instance 'in the field' of someone not able to solve a captcha in the first dozen attempts (don't ask).

Up till now, I've been successfull to keep spam off this one website I set up, just by checking all 'periferal requests' are actually performed (stylesheets, scripts, images), confirming it's a real 'flesh and bones' web-browser session calling the website, and denying any post with 4 or more URL's in 'em.

The few spammers that did get past I got silent by blacklisting on IP number. (for now)

But I must say this is still not waterproof, but nothing is anyway. (Then again, I guess there's nothing much to gain spamming a website with pagerank 2.)

Improve this answer
2
  • 1
    I've a coworker who is nearly blind. I've quite enough trouble deciphering some captchas with my decent eyesight, can't imagine what it'd be like for an almost blind person.
    – jwenting
    Dec 7, 2011 at 11:20
  • @jwenting: That's why reCAPTCHA and other CAPTCHA services/solutions also provide an audio option for the visually impaired.
    – Lèse majesté
    Dec 9, 2011 at 14:45
5

On a small site of mine, I blocked spam like this:

Please input the name of tomorrow's day of the week.

In fact there's a little more explanation than that, but you get the idea.

I hadn't visited the site for a year or so and hat 16000 spam entries (in comparison to 20 ham entries). I've put this sanity check there 2 years ago and haven't had one spam entry ever since.

Spam-blocking is a matter of importance of the content you are protecting. As long as your site isn't know to have at least 1000 visits a day, nobody will bother actually looking at why their spam won't work on you. You're just some non-spammable site within a vast sea of information that nobody has a chance to analyze.
So to be clear: unless you're protecting a bigger target, use something simple and unobtrusive.

Also spam can be identified based on content just as well.

Not to forget: when trying to fend of an attacker, it is much easier to make them believe that they succeeded. One technique is to accept spam content and delete it within a minute or so (I doubt spam bots have checks against that).

Lastly, you can always ask users to authenticate, which makes tracking a lot easier. Allow login through all major services (openID, facebook) and you should be fine.

Improve this answer
1

See this article from MikeBeach.com, using alternatives to captchas, and explaining in details pros/cons of some well-known captcha libs or services such as reCAPTCHA.

Quoting:

Personally, I use a combination of Bad Behavior and Defensio on my sites, and I’ve seen a big drop in the amount of spam.

Improve this answer
0

Image Identification.

Sometimes simple solutions are the easiest. All you need are some random images of objects (e.g. a horse, a cat, a dog, and a duck). Then when someone needs to validate that they are not a human, an image is displayed and the user must simply identify what it is.

You may run into a single problem with this. Not everything has the same name everywhere. What you call a horse my grandparents called a Pferd. If you're only aiming for English speakers (or German or any single language for that matter) you've got a simple solution to a simple problem.

Improve this answer
2
  • you could do this the other way round - show several images as the answer and tell the user to 'click on the horse'. The question would obviously be in the language the rest of the page was going to be displayed in.
    – gbjbaanb
    Dec 7, 2011 at 12:29
  • @gbjbaanb The only problem with that solution is if you have 3 images, the spammer could programmatically click on one of the images with a 1/3 success rate. Of course you could also use a service like Akismet, but there is still the possibility it could slip through. It is all a matter of how much risk you are willing to go with.
    – Glenn Nelson
    Dec 7, 2011 at 12:54
0

I feel that the captcha model is broken for the following reasons.

  1. Adding one to your site is telling the user that spam is their problem, not yours.
  2. Visually impaired people cannot use them.
  3. They act as an excellent attack vector for man in the middle attacks.
  4. They (normally) rely on a third party service being online for your forms to work.
  5. Sometimes they can be broken by more advanced OCR technology.

So to answer your question, I don't think it is useless, it performs it's task well most of the time, but it is broken so I would personally advise against its use.

Improve this answer
0

I've been doing R&D on a new technology that uses the semantic associations humans intuit between images to create simple validation challenges. We need to replace text based CAPTCHAs with something better... their days are clearly numbered. Even Luis Von Ahn admitted as much in 2009. It also burns me that we have so many applications on the web that depend on a technology that everyone finds annoying.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.