Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

They are ridiculous, but they are so because what they are trying to achieve can no longer be easily achieved by solving the "visual acuity" problem.

Think of it as an opportunity to create something better. Personally I think shared secret with physical device has longer legs here but it does have a distribution/cost/re-authentication hump that is large. So far that has prevented its adoption but as you can see captcha systems are becoming non-functional.



I'd be curious to see the ability for a machine to solve picture based captcha systems. For example, given a lineup of 10 pictures of pets, choose the three that are cats. I've seen them before, just not widely implemented.


Well Google just talked about their code which identified kittens in Youtube videos. (http://www.nytimes.com/2012/06/26/technology/in-a-big-networ...)


That's actually pretty interesting. With time the number of computers/processors required to do these tasks will go down, but for now and based on that experiment, it almost seems more efficient to use picture based captchas.


I don't think you 'get it' Andrew :-) The folks who bust captchas, 16,000 machines is chump change, they run botnets of hundreds of thousands of machines, they dynamically buy EC2 instances, they make a lot of money.

That is the primary reason why I believe that people who use the term 'computationally unfeasible' (you see that a lot in crypto papers) never counted on the kinds of growth we've seen in computers coupled with the ease with which these folks can steal computer power from clueless users.

My claim is that you need an independent engine of computation on your side that can prove you are you with a high degree of confidence, and cannot be corrupted economically by a third party. (so local programs on your PC or Smart phone won't cut it)


Exponential CPU growth rates are factored into cryptographic protocols. As long as growth rates don't become super-exponential they're safe.


Cryptosystems that require 2^128 tries to crack aren't going to be much easier even if you have a billion machines; you really need a theoretical breakthrough. :)

Of course that doesn't apply here.


Even just randomly picking 3 images will be successful about 1% of the time which is more than enough for a bot.


Good point. 10 choose 3 = 120.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: