Re: Defeating CAPTCHA

[Michal Zalewski <lcamtuf () dione ids pl>]

On Fri, 26 Aug 2005, Subs wrote:

> For instance a picture of our planet, with text overlaid something like
> "3rd Rock From the Sun", "Home" or "Planet" with a question like What
> Would You Call This?

Probably a so-so idea, for a couple of reasons:

  1) Answers limited to dictionary words or trivial phrases; susceptible
     to brute force attacks with a chance of succeeding (you would
     realistically have what, 500-5000 options).

  2) The attacker who gets a hold of your image database and associated
     terms can attack all installations rather easily - whereas random
     character, random modification captchas are harder.

  3) Computers can and do succeed at recognizing simple objects on
     photographs or images, so even without the image database (but with a
     thesaurus), this can be attacked.

In the short run, sure, it sounds more impressive; in the long run, it may
be even more useless than text captchas.

Cheers,
/mz
http://lcamtuf.coredump.cx/silence/