On 9 Mar 2008, at 12:47, Per Jessen wrote:
Richard Heyes wrote:
How about this one -
http://jessen.ch/articles/captcha
Well, of course it can be broken too - it's only a matter of money
and time, both of which are critical to spammers.
Interesting. How well does this work?
Well - it's an idea I've had for a while, but I only just
implemented it
this morning.
The key thing is that in order to read the question, you need to
render
the HTML in an engine or browser with javascript support. Just
parsing
the page won't help you.
Like I said, it can be broken too (given sufficient effort).
It's not much effort - you just need to request a second URL after
you've got the form. It's not hard and really doesn't really put
anything more in the way of a bot than an image-based captcha. In fact
I'd argue that parsing the text in your questions is significantly
easier than doing OCR on an image.
I'm interested because I wrote a number to text converter which could
be used as a CAPTCHA and it was eventually broken, so I resorted to
the more traditional image based CAPTCHA. For example:
Enter the following in numbers:
Four thousand and twenty two.
And of course the answer is 4022.
Did you use javascript to do that too? Seems to me it should work just
as well as what I proposed.
Text-based captchas will never be a big hurdle for bots. Anything you
can convert from a number or numbers into text can also be parsed back
to the numbers. Fact.
The key thing to remember when securing a form is that if you do
something that's never been seen before it's unlikely that the generic
bots will be able to get past it. If someone decides to target your
site then a text-based captcha will never be good enough, and chances
are nothing you do will work. If someone is willing to put in the
effort you've got no chance.
As an example I used to have a simple text-based captcha on the
comment form on my blog. It was pitifully simple to get past because
all it asked you to do was type 'human' into a text box, but since my
blog is not very popular it's not worth the bad guys investing time to
mod their bots to get past it. I had zero spam comments while that was
in place. I've since switched to Wordpress and I have to say that
Akismet kicks the crap out of any captcha in terms of effectiveness.
-Stut
--
http://stut.net/
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
