Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!newsfeed.xs4all.nl!newsfeed1.news.xs4all.nl!xs4all!newsgate.cistron.nl!newsgate.news.xs4all.nl!post.news.xs4all.nl!not-for-mail
MIME-Version: 1.0
In-Reply-To: <CAPTjJmrvAbD0iVTkyrvujB=5wTizmZQNxhZ-EWjbC3KPG8ZyEw@mail.gmail.com>
References: <8c2e4bc2-4f46-4a68-83ed-469fe171de3a@googlegroups.com> <mailman.12884.1407848347.18130.python-list@python.org> <2320baf0-e097-4d67-97c1-dd37ca79fffb@googlegroups.com> <mailman.12887.1407856051.18130.python-list@python.org> <lsdce7$94t$1@dont-email.me> <mailman.12889.1407858847.18130.python-list@python.org> <376a239c-77e8-4e0e-9300-847dfa8a8547@googlegroups.com> <CAPTjJmo=Sr3Y4KaDfa4n6=bfxZFNWUohN93OtnHcvaYFT08mDA@mail.gmail.com> <53EB4E68.8050405@harvee.org> <CALvWhxtBnx2TX2VKpaoHvrr5QXpG3YMzrud3TzapCD8U7k=Fyg@mail.gmail.com> <CAPTjJmrvAbD0iVTkyrvujB=5wTizmZQNxhZ-EWjbC3KPG8ZyEw@mail.gmail.com>
From: Ian Kelly <ian.g.kelly@gmail.com>
Date: Wed, 13 Aug 2014 14:16:02 -0600
Subject: Re: Captcha identify
To: Python <python-list@python.org>
Content-Type: text/plain; charset=UTF-8
Precedence: list
Newsgroups: comp.lang.python
Message-ID: <mailman.12946.1407961336.18130.python-list@python.org>
Lines: 38
NNTP-Posting-Host: 2001:888:2000:d::a6
Xref: csiph.com comp.lang.python:76235

On Wed, Aug 13, 2014 at 1:43 PM, Chris Angelico <rosuav@gmail.com> wrote:
> There are alternatives that are both easier for legit people and
> harder for spambots. Some rely on the fact that humans read things two
> dimensionally, and scripts look at the underlying structure; so, for
> instance, random field names and cunning CSS to match them up with
> their labels can result in a form that's completely messed up in the
> source, but looks perfect to a user. Or you can put extra fields down
> that you can't see if the form's laid out properly.

Chances are that if these tricks mess up a spambot, they will also
mess up a screen reader.

> Or you can combine
> those sorts of tricks with a very simple challenge-response, like
> "What is one plus one?" that requires some specific value to be in a
> specific field - and if that value occurs in the wrong field, you
> throw the form back to the user.

If I ask my phone "What is one plus one", a very nice sounding voice
will tell me that one plus one is two. It takes some cleverness to
come up with a question that is likely to stump a machine but not
deter a human, so the pool of such questions will necessarily be
limited. Meanwhile, all the spambot has to do is flag the question for
a human to answer and store the answer somewhere, and the question is
now useless.

> For some reason, everyone's jumped on the "show some mangled
> text/numbers and ask the user to enter them" bandwagon, in the same
> way that everyone has gone for passwords that require
> lower/upper/digit/symbol and (in the most annoying cases) are actually
> length-limited to something stupid like 12 characters. Yes, maximum,
> not minimum. Grumble.

I've seen some captcha systems that I couldn't solve after a dozen
attempts, and I have no serious vision problems. It's a problem with
no easy solution, and as computers get more powerful the intersection
of {problems machines can't solve} and {problems humans can reliably
solve} grows ever smaller.