Simple Optical Illusion CAPTCHA
Regular readers know that I have a bit of an obsession with CAPTCHA (and all things spam-related). Every now and then, I get an idea stuck in my head for a way to improve CAPTCHA to make it more people-friendly. This is one of those posts.One of the core questions in creating a good CAPTCHA is essentially this: What capabilities do people have that machines don't? For example, can we take advantage of the human visual system somehow to make a task that's easy for people but tough for bots? Consider the sample CAPTCHA image below:
Looks like your average, everyday low-security CAPTCHA, right? To a person, yes, but looks can be deceiving. What you see above is actually two partially-transparent images laid on top of each other (with CSS). Separated, the two images actually look like this:
Interpreting the first image is easy for us humans - we don't even have to think about it. The two images merge seamlessly into one. For a bot, though, the source code clearly shows two full-sized images, neither of which contains a legible word. Of course, there are ways to programmatically combine the images, but for your average bot, who doesn't notice the dual-image trap, the task is effectively impossible.
As with all of my CAPTCHA experiments, the goal is to help make existing word-based CAPTCHA slightly more difficult for bots, without increasing the difficulty for humans. Of course, I welcome any feedback, and thank you for once again indulging my CAPTCHA obsession.
Sean
· Tuesday, August 18I was wondering the other day if there was some way of utilizing that weird human ability to interpret misspelled words so long as the first letter and last letter are the same to help stop bots. Jsut lkie ppleoe can raed tihs whoitut mcuh eorfft.
Kendall
· Tuesday, August 18This has the problem with most CAPTCHA though, accessibility. Blind users cannot solve it.
Dr. Pete
· Tuesday, August 18@Sean - I think there are quite a few abilities that we have as humans that aren't being tapped well by CAPTCHA, but defining a task that's accessible to a wide range of people and understandable in just a few seconds is definitely a challenge.
@Kendall - Sorry, it's not my intention to propose these mini-experiments as full-featured CAPTCHA, just variations on existing models. I'm assuming that any strong implementation would include alternatives for the sight-impaired and address relevant accessibility issues.
Mike Maddaloni - The Hot Iron
· Tuesday, August 18Hey Pete - This reminds me of those emails that are always sent around with mangled words, yet you can read and understand it fully.
CAPTCHA is technology, and it will always be a moving target, as technology battling technology leads to that...
mp/m
WebChecker
· Thursday, August 20Fantastic and cool :)
James
· Wednesday, August 26Very true Dr. Pete. This will beat bots. But the best CAPTCHA are you remote work forces of humans at a few dollars an hour to process thousands of these an hour. At that point you run into real trouble.
Michal Pařízek
· Tuesday, September 8Nice idea Dr. Pete ;) I consider CAPTCHAs as a big usabilty issue and this looks like a solution.
Can I mention your idea at our company's blog? With a link to this article of course.
Ed Company
· Monday, October 12That is brilliant! What a great idea... you probably have the spammers quaking in their boots now!
Capture Free
· Saturday, November 7Capture free world is the best. This technology that you've described is useless. You can program bot to just take snapshot of the screen and than run OCR. =)
Good luck!
Dr. Pete
· Monday, November 9@Capture - First off, I should say that I'm not a fan of CAPTCHA in general - I think it's a necessary evil at best. My goal is to find theoretical variations that might make it easier on humans while raising the bar for bots. Keep in mind that the example in this post is just to illustrate a technique. I don't expect that the fully implemented CAPTCHA would be this simple - the image splitting could be used with any form of existing CAPTCHA.
While there are certainly ways to crack this approach, my goal is to help expand the variety of weapons in our arsenal. Most bots, especially in places like blog comments, succeed because there's a very limited variety of CAPTCHA techniques in use. Program one CAPTCHA-cracker, and you can affect tens of thousands of blogs. By adding new techniques, we can block many of the existing programs, and spammers will continue to pluck the low-hanging fruit. You don't have to raise the bar much to be effective in these situations.
John Skirts
· Sunday, November 22Captcha is very annoying no matter where you run into it. I would like to see a standard that is used so that you can become more aquanted with one style. This would allow you to get use to one style and reduce the time it takes and strain on your eyes.
A Web Design Company
· Saturday, December 12A fantastic idea Dr. Peter. I really appreciate it. It will be really very useful for my development team. Thanks!!
menuiserie lannion
· Monday, January 4very good idea, I'll certainly use it in my following dev.
Thanks
Tim
· Sunday, January 24Interesting idea, though it's not really hard to break such captcha.
Bot opens the page in browser, than makes a screenshot of the interested region than breaks the captcha using OCR algorithms.
Martin
· Sunday, February 28That is an very good and simple way to avoid some spam. But i think there are also ways to crack this capcha with some bots. I know this is not easy to create such a bot but i am sure that there is already an bot that can break this form of capcha. Nevertheless it is a nice idea and i will try and test it soon.
arabic keyboard
· Monday, March 15I was wondering the other day if there was some way of utilizing that weird human ability to interpret misspelled words so long as the first letter and last letter are the same to help stop bots. Jsut lkie ppleoe can raed tihs whoitut mcuh eorfft..
Sajoo
· Friday, March 26I think you managed to create a good captcha : not too difficult for human, impossible for robots !
Blackjack Rules
· Wednesday, June 16There are a lot of spam software that can work with CSS. They use brouser emulators and export captcha to human-recognise services.
forex
· Wednesday, July 7this is a good idea, if you cant read it just move the upper part into the down part with your mouse.
Succeed Online
· Tuesday, July 13@Dr. Pete,
I completely agree with your statement "By adding new techniques, we can block many of the existing programs, and spammers will continue to pluck the low-hanging fruit. You don't have to raise the bar much to be effective in these situations."
Most of what we do is custom, so there aren't any "programs" that will by default crack our system. The only ones we run into are where people are "outsourcing" the cracking, but for the most part we don't run into problems because of cost/value for the spammer.