Comments on: CAPTCHAs without images, part 2 http://www.xaprb.com/blog/2006/05/29/captchas-without-images-part-2/ Stay curious! Fri, 29 Aug 2008 19:17:49 +0000 http://wordpress.org/?v=2.2.2 By: Ashant http://www.xaprb.com/blog/2006/05/29/captchas-without-images-part-2/#comment-14428 Ashant Sun, 13 Apr 2008 10:37:19 +0000 http://www.xaprb.com/blog/2006/05/29/captchas-without-images-part-2/#comment-14428 Did anyone mention that the brain teasers actually have a fun-factor to them. Certainly more fun to do one of these than figuring out twisted, bent, twirled, chiseled CAPTCHA character strings. Did anyone mention that the brain teasers actually have a fun-factor to them. Certainly more fun to do one of these than figuring out twisted, bent, twirled, chiseled CAPTCHA character strings.

]]> By: vanfruniken http://www.xaprb.com/blog/2006/05/29/captchas-without-images-part-2/#comment-14264 vanfruniken Sun, 02 Mar 2008 15:56:47 +0000 http://www.xaprb.com/blog/2006/05/29/captchas-without-images-part-2/#comment-14264 One way to achieve this is to use a second domain name for the same blog and adjust the absolute links to fool Google. Hopefully Google will not resolve the IP address. If so, some more clever DNS record manipulation may do the trick (2 IP addresses as well). Come to think of it, since Google is perfectly able to distinguish between user sites that are subdirectories of the same domain, you could just create two subsites in the same domain, where one gets the google rating and the other one, to which the one with the google rating soft-redirects also contains the more sensitive info. Unfortunately this will not keep hostile humans out:) Oh, and one important detail: the mirror site that gets the highest ranking should omit the most sensitive information. One way to achieve this is to use a second domain name for the same blog and adjust the absolute links to fool Google. Hopefully Google will not resolve the IP address. If so, some more clever DNS record manipulation may do the trick (2 IP addresses as well).
Come to think of it, since Google is perfectly able to distinguish between user sites that are subdirectories of the same domain, you could just create two subsites in the same domain, where one gets the google rating and the other one, to which the one with the google rating soft-redirects also contains the more sensitive info. Unfortunately this will not keep hostile humans out:)

Oh, and one important detail: the mirror site that gets the highest ranking should omit the most sensitive information.

]]> By: vanfruniken http://www.xaprb.com/blog/2006/05/29/captchas-without-images-part-2/#comment-14263 vanfruniken Sun, 02 Mar 2008 15:45:52 +0000 http://www.xaprb.com/blog/2006/05/29/captchas-without-images-part-2/#comment-14263 You can tank your blog's Google ranking by having another one (a mirror), almost identical one, with javascripted absolute links to this blog and hard absolute back links. Google will eventually find out that both subsites are identical, and it is to be hoped that it will eliminate the correct one from its results. You can tank your blog’s Google ranking by having another one (a mirror), almost identical one, with javascripted absolute links to this blog and hard absolute back links.
Google will eventually find out that both subsites are identical, and it is to be hoped that it will eliminate the correct one from its results.

]]> By: Kim http://www.xaprb.com/blog/2006/05/29/captchas-without-images-part-2/#comment-12905 Kim Fri, 03 Aug 2007 03:27:04 +0000 http://www.xaprb.com/blog/2006/05/29/captchas-without-images-part-2/#comment-12905 I like Trios's question, it took me a while to find out what is blue. Brain twisting and spam fighting as well. Like Tim mentioned earlier, since your blog has a Google page rank of 5, obviously will attract more spammer than usual. May be there is a way to turn off the ranking indicator...perhaps someone can shine some light here. I like Trios’s question, it took me a while to find out what is blue. Brain twisting and spam fighting as well. Like Tim mentioned earlier, since your blog has a Google page rank of 5, obviously will attract more spammer than usual. May be there is a way to turn off the ranking indicator…perhaps someone can shine some light here.

]]> By: Trois http://www.xaprb.com/blog/2006/05/29/captchas-without-images-part-2/#comment-3228 Trois Wed, 17 Jan 2007 20:26:24 +0000 http://www.xaprb.com/blog/2006/05/29/captchas-without-images-part-2/#comment-3228 <p>I would Andrea's approach is good:</p> <p>Which one doesn't belong here: 1) Hand 2) Eye 3) Shoe 4) Hair</p> <p>3 - as it is no body part - so, you go to matching characteristics of objects (as in IQ tests), instead of asking for a char. of an object ("A lion is a ... (cat)").</p> <p>What about reversing questions:</p> <p>What do men like the least - 1) Coffee 2) Women 3) Dishes</p> <p>Or asking (parts) of a saying (with related incorrect answers):</p> <p>The best invention since: 1) Wheel 2) Sliced bread 3) Plane</p> <p>Or combinations:</p> <p>What is blue: 1) Grass, meat 2) Ocean, mood 3) Men, women</p> <p>And about your initial system being cracked: what about the spammer reading this blog, entering some posts to learn from it? Good training exercise - in case your system becomes more widely adopted....</p> <p>But good programming! Thanks for providing it to us with comments.</p> I would Andrea’s approach is good:

Which one doesn’t belong here:
1) Hand
2) Eye
3) Shoe
4) Hair

3 - as it is no body part - so, you go to matching characteristics of objects (as in IQ tests), instead of asking for a char. of an object (”A lion is a … (cat)”).

What about reversing questions:

What do men like the least -
1) Coffee
2) Women
3) Dishes

Or asking (parts) of a saying (with related incorrect answers):

The best invention since:
1) Wheel
2) Sliced bread
3) Plane

Or combinations:

What is blue:
1) Grass, meat
2) Ocean, mood
3) Men, women

And about your initial system being cracked: what about the spammer reading this blog, entering some posts to learn from it? Good training exercise - in case your system becomes more widely adopted….

But good programming! Thanks for providing it to us with comments.

]]> By: Andrea http://www.xaprb.com/blog/2006/05/29/captchas-without-images-part-2/#comment-2871 Andrea Thu, 21 Dec 2006 17:04:35 +0000 http://www.xaprb.com/blog/2006/05/29/captchas-without-images-part-2/#comment-2871 <p>CAPTCHAS are not that bad. Because of them I moved from BlogSpot to WordPress and I think it was for good ;-)</p> <p>Your "logic puzzle" approach is good. And maybe it could be generalized and automatically generated (but not solved, I hope). Instead of a question / answer scheme you could use something like this.</p> <p>Choose one:<br /> --- o Yellow<br /> --- o Apple<br /> --- o Red</p> <p>where one option belongs to a domain F, n>1 options belong to a domain T, and F is perpendicular to T. Well, in the example I cheated a little, because I started with Water instead of Apple, but then I realized that there is added trouble for automation if all the pairs work equally well.</p> CAPTCHAS are not that bad. Because of them I moved from BlogSpot to WordPress and I think it was for good ;-)

Your “logic puzzle” approach is good. And maybe it could be generalized and automatically generated (but not solved, I hope). Instead of a question / answer scheme you could use something like this.

Choose one:
— o Yellow
— o Apple
— o Red

where one option belongs to a domain F, n>1 options belong to a domain T, and F is perpendicular to T. Well, in the example I cheated a little, because I started with Water instead of Apple, but then I realized that there is added trouble for automation if all the pairs work equally well.

]]> By: Xaprb http://www.xaprb.com/blog/2006/05/29/captchas-without-images-part-2/#comment-2328 Xaprb Tue, 31 Oct 2006 12:59:42 +0000 http://www.xaprb.com/blog/2006/05/29/captchas-without-images-part-2/#comment-2328 <p>No. I could probably look in my web server log files and get a better idea though. But really, tools to automatically drive a genuine browser are everywhere. Every now and then I get some spam that looks like someone just testing the system out -- a real human, that is. Empty comments, or comments with asdfasdf in them (but a handful at a time, not just one). It's really interesting to observe the patterns.</p> <p>At this point I get about one or two a day, which is much less than the hundreds a day I was getting when I had a few percent of the traffic I have now, so I'm fairly happy with this system. I have considered upgrading it though. (By upgrading, I mean using something I didn't hand-roll).</p> No. I could probably look in my web server log files and get a better idea though. But really, tools to automatically drive a genuine browser are everywhere. Every now and then I get some spam that looks like someone just testing the system out — a real human, that is. Empty comments, or comments with asdfasdf in them (but a handful at a time, not just one). It’s really interesting to observe the patterns.

At this point I get about one or two a day, which is much less than the hundreds a day I was getting when I had a few percent of the traffic I have now, so I’m fairly happy with this system. I have considered upgrading it though. (By upgrading, I mean using something I didn’t hand-roll).

]]> By: carpet http://www.xaprb.com/blog/2006/05/29/captchas-without-images-part-2/#comment-2326 carpet Mon, 30 Oct 2006 22:59:47 +0000 http://www.xaprb.com/blog/2006/05/29/captchas-without-images-part-2/#comment-2326 <p>Xaprb, are you sure?</p> Xaprb, are you sure?

]]> By: Xaprb http://www.xaprb.com/blog/2006/05/29/captchas-without-images-part-2/#comment-880 Xaprb Thu, 15 Jun 2006 01:06:52 +0000 http://www.xaprb.com/blog/2006/05/29/captchas-without-images-part-2/#comment-880 <p>I assume at least some of it is, though I could be wrong. I suspect GUI scripting is responsible for much of it, and perhaps the script is recorded from a hand-controlled session.</p> I assume at least some of it is, though I could be wrong. I suspect GUI scripting is responsible for much of it, and perhaps the script is recorded from a hand-controlled session.

]]> By: Tim McCormack http://www.xaprb.com/blog/2006/05/29/captchas-without-images-part-2/#comment-879 Tim McCormack Wed, 14 Jun 2006 23:04:13 +0000 http://www.xaprb.com/blog/2006/05/29/captchas-without-images-part-2/#comment-879 <p>Could some of the spam be hand-entered?</p> Could some of the spam be hand-entered?

]]>