Is reCaptcha now basically useless?

Question

Is reCaptcha now basically useless?

I have read around the internet that reCaptcha has been broken and spam bots can easily overcome it. Has Google addressed this at all. Do they have any plans to fix it? I cannot find this type of info on the web, and I was hoping somebody may have some insight.

Are there any similar, reliable, more secure webservices out there for this type of thing? I do not want to have to make my own captcha type class because on-the-fly image processing is fairly resource intensive, and I do not want to make a Q&A type captcha (I do not want this class to need DB access).

Any suggestions or info about reCaptcha's problems are welcome.

Answer 1

Captcha has always been vulnerable to a simple man-in-the-middle attack where the spammer relays the images to its own captcha on a website which offers mp3 downloads or porn for free. It doesn't matter what type of captcha you use.

Detecting behaviour patterns is the way to go.

Answer 2

I never liked captcha's. I even have seen one instance 'in the field' of someone not able to solve a captcha in the first dozen attempts (don't ask).

Up till now, I've been successfull to keep spam off this one website I set up, just by checking all 'periferal requests' are actually performed (stylesheets, scripts, images), confirming it's a real 'flesh and bones' web-browser session calling the website, and denying any post with 4 or more URL's in 'em.

The few spammers that did get past I got silent by blacklisting on IP number. (for now)

But I must say this is still not waterproof, but nothing is anyway. (Then again, I guess there's nothing much to gain spamming a website with pagerank 2.)

Answer 3

On a small site of mine, I blocked spam like this:

Please input the name of tomorrow's day of the week.

In fact there's a little more explanation than that, but you get the idea.

I hadn't visited the site for a year or so and hat 16000 spam entries (in comparison to 20 ham entries). I've put this sanity check there 2 years ago and haven't had one spam entry ever since.

Spam-blocking is a matter of importance of the content you are protecting. As long as your site isn't know to have at least 1000 visits a day, nobody will bother actually looking at why their spam won't work on you. You're just some non-spammable site within a vast sea of information that nobody has a chance to analyze.
So to be clear: unless you're protecting a bigger target, use something simple and unobtrusive.

Also spam can be identified based on content just as well.

Not to forget: when trying to fend of an attacker, it is much easier to make them believe that they succeeded. One technique is to accept spam content and delete it within a minute or so (I doubt spam bots have checks against that).

Lastly, you can always ask users to authenticate, which makes tracking a lot easier. Allow login through all major services (openID, facebook) and you should be fine.

Answer 4

See this article from MikeBeach.com, using alternatives to captchas, and explaining in details pros/cons of some well-known captcha libs or services such as reCAPTCHA.

Quoting:

Personally, I use a combination of Bad Behavior and Defensio on my sites, and I’ve seen a big drop in the amount of spam.

Answer 5

Image Identification.

Sometimes simple solutions are the easiest. All you need are some random images of objects (e.g. a horse, a cat, a dog, and a duck). Then when someone needs to validate that they are not a human, an image is displayed and the user must simply identify what it is.

You may run into a single problem with this. Not everything has the same name everywhere. What you call a horse my grandparents called a Pferd. If you're only aiming for English speakers (or German or any single language for that matter) you've got a simple solution to a simple problem.

Answer 6

I feel that the captcha model is broken for the following reasons.

1. Adding one to your site is telling the user that spam is their problem, not yours.
2. Visually impaired people cannot use them.
3. They act as an excellent attack vector for man in the middle attacks.
4. They (normally) rely on a third party service being online for your forms to work.
5. Sometimes they can be broken by more advanced OCR technology.

So to answer your question, I don't think it is useless, it performs it's task well most of the time, but it is broken so I would personally advise against its use.

Answer 7

I've been doing R&D on a new technology that uses the semantic associations humans intuit between images to create simple validation challenges. We need to replace text based CAPTCHAs with something better... their days are clearly numbered. Even Luis Von Ahn admitted as much in 2009. It also burns me that we have so many applications on the web that depend on a technology that everyone finds annoying.