play_ Posted December 10, 2007 Share Posted December 10, 2007 why does it have to be image based? would something like "type th following numbers in the textbox: 87648" or "what is the last word of the last paragrap?" be any efficient ? Quote Link to comment Share on other sites More sharing options...
trq Posted December 10, 2007 Share Posted December 10, 2007 The whole point of a captcha is that images cannot be simply read through the html source. Quote Link to comment Share on other sites More sharing options...
helraizer Posted December 10, 2007 Share Posted December 10, 2007 why does it have to be image based? would something like "type th following numbers in the textbox: 87648" or "what is the last word of the last paragrap?" be any efficient ? As Thorpe has said, the images can't be read through the source. If it were simply '87648: Enter these numbers into the text box' the Botscould easily do that. With capture the algorithms have to be more complex since they have to, if they can, analyze the image and guess at what the letters could be. So the more complex the image. For instance, I recently made a captcha image that has 3 different images within it, layers as it were, and 5 different captcha codes, only one of which will work. So the bot will have to decifer the correct characters from the 5 codes and try them all. The more complex the image it is, the less likely it is to be broken by bots. Sam Quote Link to comment Share on other sites More sharing options...
play_ Posted December 10, 2007 Author Share Posted December 10, 2007 But what if i ask a question like "who was the first president of the United States?". i can't imagine how a bot would get past that, unless it was just inserting dictionary words into the field (kinda like bruteforce) Quote Link to comment Share on other sites More sharing options...
helraizer Posted December 10, 2007 Share Posted December 10, 2007 But what if i ask a question like "who was the first president of the United States?". i can't imagine how a bot would get past that, unless it was just inserting dictionary words into the field (kinda like bruteforce) I don't think the first president of the US' name would be in the dictionary Ease, is the answer. With a captcha image all you need is to be able to read. Whereas, with those questions you suggest not every one knows the answer (I don't think I do. =P) and most people can't be bothered to google United State presidents in order to register to your site. So it's just easier, really. Quote Link to comment Share on other sites More sharing options...
revraz Posted December 10, 2007 Share Posted December 10, 2007 That is actually even more effective. And you can change the question/answer if someone decides to spend time to make a bot for your site. What I do is just have a Activation code on another page. They enter that code and they can register. I haven't had one bot in over a year. But what if i ask a question like "who was the first president of the United States?". i can't imagine how a bot would get past that, unless it was just inserting dictionary words into the field (kinda like bruteforce) Quote Link to comment Share on other sites More sharing options...
helraizer Posted December 10, 2007 Share Posted December 10, 2007 That is actually even more effective. And you can change the question/answer if someone decides to spend time to make a bot for your site. What I do is just have a Activation code on another page. They enter that code and they can register. I haven't had one bot in over a year. But what if i ask a question like "who was the first president of the United States?". i can't imagine how a bot would get past that, unless it was just inserting dictionary words into the field (kinda like bruteforce) How would it be more effective than the captcha though, since with a captcha it is dynamically generated (uniquely) everytime the page loads/re-loads? Quote Link to comment Share on other sites More sharing options...
revraz Posted December 10, 2007 Share Posted December 10, 2007 Because people write scripts to pull the info from the image. But if you put a word somewhere on another page and you change it once in awhile, it's impossible for them to register without changing their script everytime. It's a lot of effort that they won't normally do. But once they figure out your image, their script will work everytime. Quote Link to comment Share on other sites More sharing options...
Distant_storm Posted December 10, 2007 Share Posted December 10, 2007 The more advanced you make your captchas the more advanced the bots become to get past them !.... The most effective as stated above is cognitive captchas. although for minimal security simple distorted text images are easily done. Quote Link to comment Share on other sites More sharing options...
helraizer Posted December 10, 2007 Share Posted December 10, 2007 This captcha that I made isn't very simple. It contains 3 images layered, it contains 20 different captcha codes, only one of which works. Which the bots don't 'know' that, so they have a 1 in 20 chance of getting it right each time. If they get it wrong they have to work it out again, and have another 1 in 20 chance. Do you think it'll be breakable by bot? Quote Link to comment Share on other sites More sharing options...
papaface Posted December 10, 2007 Share Posted December 10, 2007 Yes I think its easily breakable because the bot can tell the difference between green and black.... Quote Link to comment Share on other sites More sharing options...
revraz Posted December 10, 2007 Share Posted December 10, 2007 Run a OCR program across that image and see what it finds. Your code will be found very easily. It doesnt care if you use 1000 layers, it's just just an image. Quote Link to comment Share on other sites More sharing options...
helraizer Posted December 10, 2007 Share Posted December 10, 2007 Yes I think its easily breakable because the bot can tell the difference between green and black.... Oh aye. But out of the 22 captcha codes within that image, 18 of them are black. Quote Link to comment Share on other sites More sharing options...
helraizer Posted December 10, 2007 Share Posted December 10, 2007 Run a OCR program across that image and see what it finds. Your code will be found very easily. It doesnt care if you use 1000 layers, it's just just an image. Fair enough. It's not for a registration process, only for a commenting system, so it doesn't matter /that/ much. Quote Link to comment Share on other sites More sharing options...
play_ Posted December 11, 2007 Author Share Posted December 11, 2007 Okay. What if a random shape shows up each time the page loads? it would be a triangle, square or circle image, and i'd just ask the user which shape the image is. Any thoughts? ps: helraizer, when i mean't dictionary earlier, i didn't necessarily mean only dictionary words. in bruteforce, a file with dictionary words will contain names, numbers, etc. Quote Link to comment Share on other sites More sharing options...
play_ Posted December 11, 2007 Author Share Posted December 11, 2007 Or what about using ajax for drag and drop? (i know this one post isn't php related, but since we're talking about captcha's, what the heck.) User would have to drag and drop a div inside another div (kinda like those drag and drop shopping carts). there is no way a bot could get around this. Quote Link to comment Share on other sites More sharing options...
play_ Posted December 11, 2007 Author Share Posted December 11, 2007 bump Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.