rangeva writes to tell us about a twist he has developed on the common Captcha technique to discourage spam bots:
HECs encode the Captcha image into HTML, thus presenting an unsolved challenge to the bots' programmers. From the writeup: "The Captcha is no longer an image and therefore not a resource they can download and process. The owner of the site can change the properties of the Captcha's HTML, making it unique,... add[ing] another layer of complication for the bot to crack." HECs are not exactly lightweight — the one on the linked page weighs in at 218K — but this GPL'd project seems like a nice advance on the state of the art.
At the end of the day, this captcha is displayed on the screen as a colorful harder-to-read mumbo-jumbo, just like jpeg captchas, so all a bot has to do is use a html renderer to turn it into a regular image that can be processed. So the added complication is linking one of the existing captcha decoders and the gecko engine for example, maybe a half day's work. Not exactly uncrackable...
Well, considering that the sample captcha is just a large table where every pixel is set as a background color, I'd say it would probably be a ten line perl script you can write in a lot less than half a day work.
Seems unfair that the parent has been modded down - the comment is very relevant in that case. While the page recommends using other methods, most other methods are going to be a lot easier to crack than doing good OCR on complex CAPTCHAs.
the trouble is finding where that set of tables is. the site can move it around on the page each time it is loaded, so the bot has to be much smarter than existing bots which just find the right URL to download the image
"so all a bot has to do is use a html renderer to turn it into a regular image that can be processed"
It's not that simple. Since the Captcha is no longer an image that you can download, the bot will first has to locate the position of the Captcha. The owner of the site can modify the layout of the page and Captcha making it unique. By rendering the image into HTML you practically modify to encoding of the image to a new and unique one - making it highly difficult to create a generic bot that will learn to decode all the HTML variations out there.
The problem today is with automated software that download the Captcha images from a pre-defined location (URL) and crack them. HECs makes it much harder to locate this resource.
While I have to agree with your "everything is crackable", doesn't HECs use a whole lot more of bandwidth (moving the HEC, even compressed) and/or processing on both sides to decompress a gzipped stream than regular CAPTCHAs?
How poorly are the CAPTCHAs doing these days against bots, anyway? I see a few that are probably easy to OCR, but there are quite a few where I have to make a effort to read them myself...
The HEC is heavy - although you can change the size of the HEC and make it smaller. The HEC should only be on the form page (registration, forum submission etc) so it won't harm the user's experience too much.
I created the HEC because I used to get about 20 spam posts a day on my phpBB forums and other forms on my sites. I also read on many boards that this is a real problem. Since I started using HECs the spam amount went to 0.
The HEC is heavy - although you can change the size of the HEC and make it smaller.
Wouldn't pretty much anything larger than a single letter in HEC be larger than a full CAPTCHA?
The HEC should only be on the form page (registration, forum submission etc) so it won't harm the user's experience too much.
My problem with the idea is that if it got popular, it'd probably be in a well-know script, at which point it'd be fairly easy to crack (even with random HTML spread around, i
even with random HTML spread around, it's a whole lot easier to analyze the text into a visible captch than doing OCR
This is still an image. Instead of sending a JPG or GIF, you are sending an actual bitmap in HTML. In my three-second preview, it just looks like a table with one-pixel cells. Then, you set the color of each cell (pixel) in HTML.
So, this still requires OCR, but there is just an extra obfuscation step in getting the image from HTML to a standard graphics format. The down side is that it is
Oh, piffle. That's not hard either. The "HTML renderer" in question will be either Mozilla or IE, both of which offer through Javascript the ability to find the absolute position of an element, and its absolute width and height. So the only "hard" part left is identifying the HTML location of the test, probably with something like XPath, or Mozilla's DOM Inspector which already allows you to just click on the element (and maybe go up in the hierarchy a bit.)
And I'm pretty sure the spammers already have progr
Locating the captcha in the rendered page can't take more than a couple seconds. You'd have to change it a lot to change that. It's a blocky, colorful, bit of screen near a form submit button. Even if you change it there are only so many ways you can change it without making it confusing to users. If a user can find it then I can write a script to find it. It's a useful tool to slow down script kiddies but it won't stop anyone that could actually write the code to grab the characters in the image in the firs
Even worse, this catcha would be -easier- than a regular one. It lists every pixel as a TD, in rows... So easy to render that it's idiotic. And the image itself is simple as well... The background letters are much lighter in color and could easily be filtered.
Add in the huge size of the html and the annoyance factor of captchas in general, and this is amazingly stupid.
Yes, I see that they recommend adding in random divs and crap. If it's still a table, it's still very very easy to parse, even without a parser. If they intend for you to replace the table with 'random elements'... Do you KNOW how hard it would be to get it to show up correctly on each different browser? Another nightmare.
Gecko is absolutely overkill there: the HTML "encoding" is pretty lame, as the image is entirely made of 1px table cells, each one carrying its color information inlined in the style attribute.
Just one Perl line can extract the color matrix and pass it straight to your OCR algorithm.
Maybe if they used JavaScript to render the table on the client side, that would require Gecko or something like that (SpiderMonkey or Rhino would likely suffice), but still the complexity of a captcha cracker is noise reducti
I've had sessions that took an inordinately long time to initialize with various web service providers (it's very noticeable on dial-up.) I'm wondering whether similar techniques might be used to attack rather than defend, possibly including rogue AJAX code.
What I'm trying to get at is that with Flash and similar technologies, I can just remove the plugin or disable it in the browser. But with an AJAX or any other interface that uses ECMAScript, it might well be possible to deliver attack code. People forget it's called JavaScript because it's a similar syntax, but it is NOT sandboxed like real Java applets.
The advantage of this captcha is that it is not widespread yet and so the chances that a bot can crack it are lower.
Funny that when OCR software is supposed to work it often fails, but when there is some effort to hinder recognition then bots can deal with that. Maybe general OCR software should try to crack input instead!
A better solution might be the authentication system old 386 games had where you have to do some simple but human intelligence requiring task. "Find the word in the upper right of manual pg 4" -> "Enter the 3rd word from the following paragraph"
Maybe, but one of the few times I ever went to the effort to hack a binary was to modify one of those games to get around that sort of authentication scheme. I, at least, found to it be far more aggravating than Captchas are today.
This makes me wonder if spammers might pick up on this method to get around FuzzyOCR and the like, unless of course HTML tables are discarded anyway.
If anyone wants to produce HTML table graphics then The GIMP comes with an export plugin, good fun but don't try exporting or rendering anything too large, it can put a lot of strain on the browser.
I was wondering why I can normally see captchas but saw nothing in the sample box. Being colorblind I need to force most pages to colors I can see. Since my browser doesn't allow me to set colors for one site but not another, even the good sites get changed.
I think using a captcha like this one (html-table rendered) is bad web-manners.
The rendering of such a table, pixel by pixel, is a huge toll on browsers. Even on my (relatively) new and (relatively) powerful machine, it took Firefox a noticeable amount of time to render the image, and caused my hard drive to crunch a little. I don't even want to imagine less powerful machines or, random-fluctuation-of-time-and-space forbid, mobile devices.
All in all, I think this method severely limits the users accessing this site.
Heck it took time on my (Very) new and (Very) Powerful machine. The fastest chips available (more CPU or cores will not help because the browser calculates this on one CPU right now, maybe in the future) still needs to work on it. Makes it to slow for normal users. My mom on a iMac G3 with dialup will be painful to see.
Took next to no time at all on any of my machines in Firefox. One is modern, three would have been considered top of the line about six years ago. If it's slow in your browser, either
1: Your browser does not prerender (ie. IE) - though rendering was pretty instantaneous in IE6 for me too. 2: Something is wrong with your machine 3: You should consider looking into the purchase of a new machine if you are obviously so anal about a registration scheme that you will go through -once- taking a few extra seconds.
Brilliantly devious. Hundreds of pr0n-seeking addicts are itching at any given moment to get their fix. Only problem is that there probably aren't enough CAPTCHAs available on the web to meet the pr0n-seekers demand! Either free "inventory" will be given away for repeated CAPTCHA solving or, if repeats not used, CAPTCHA won't be available and will frustrate the frustrated seeker even more. So, PhpBB-admins do your part: enable CAPTCHAs to meet the demand!
People bring that up whenever there's news about Captchas, but I have to say I don't believe it. When it comes to porn, I'm no slouch and I can count the number of times I've seen sites that give you free access after entering a captcha on one hand. Far more Captchas are compromised because some OCR nerd has figured out how to crack it.
When it comes to porn, I'm no slouch and I can count the number of times I've seen sites that give you free access after entering a captcha on one hand.
One hand eh?
Guess we don't really need to ask how you know this...
One of the main objections of a captcha is that an attacker could steal the image file and simply use it on their site (XXX sites...) to get it "cracked". A HTML generated captcha would prevent that, since there is no image file to copy. However, what prevents the attacker to simply copy the relevant HTML source and put it on his or her site, just like the image? Sure, you can make it quite complicated by adding CSS layers and whatnot, but in the end that would just merely be an extra annoyance.
And stopping the attacker on using OCR on the captcha won't really work either. It's not that hard to render HTML code to an image, which you can feed to the OCR software.
In short, this hack is just another step in the arms race, that just buys us some time.
Really? Firefox doesn't seem to have any problems downloading and processing it, and as I wasn't aware that Firefox or Gecko used voodoo magic, I'm going to assume that the same would be true of any purpose-written code...
It's a nice idea, but it's little more than a speed-bump at best. (And not a particularly high one, at that)
Really? Firefox doesn't seem to have any problems downloading and processing it, and as I wasn't aware that Firefox or Gecko used voodoo magic
Took about 5 seconds to fully render that HEC on my 1.6 GHz Powerbook running Firefox. It could just be the time associated with downloading all that HTML though I guess. It definitely seems to not be friendly compared to a 30K JPEG of the same thing.
Took about 0.5 seconds on my FreeBSD Dell 1.13 GHz P III in Konqueror while compiling KDElibs3 in the background. At every reload of the page. Or it could just be that FreeBSD/KDE has magic powers.:-)
It took my copy of FF2 "a couple of seconds"* to render it first time round on my X2 4400+ once the page had fully loaded; subsequent loads showed the captcha more or less instantaneously, despite it being different each time. By "no problems" I mean that it's right there in the page, and can be scraped out with relative ease. In fact, it's not really any harder than searching for the appropriate img tag, in either case you have to identify an enclosing block of text and pull out the relevant HTML fragment.
I tested it on my core-duo mac mini (with the crappy IMA graphics) in Safari and it was essentially instant. I will admit it was over FIOS so download speed was 15mbit, but it didn't slow down at all.
The file size is what intriques me. Just make a 'hidden' captcha that a bot would download. Now figure out how to make a jpeg decompressor uncompress that to 2 gigs or better.
It's like the old "I'll compress 2gigs of the letter A with zip and upload it to that BBS and let the virus checker gag" gag.
Or maybe a gif file. I wonder how solid black or white compress......
Lunacy! I've made apps which can do this sort of thing before, and this one is totally unoptimized! Take a look at this:
With the limited amount of colours used, it would make much more sense to a) give the table an id, then: table.tabid td { width:1px; height:1px; ) b) give some classes for each colour used td.colid { background-color: blah; }
I'm sure that would half the source code size... How can you trust a HTML solution that hasn't even been properly thought through?
While this has little to do with the original post I have a really annoying experience with captchas
I have 20/20 vision and am not color blind. Captchas are becoming so complicated and garbled that I get the code wrong about 40% of the time. Another portion of the time I take to long trying to answer the code question and type in the right characters. I typically get screwed on the number Zero and the letter 'O' and lowercase 'L' and the number 1.
It'b becoming, for me, an entry barrier to signing up and gaining access to websites. It would be much easier to simply use email authentication. What do you do with the people who are color blind? I spent some years dealing with display design and this was a legitimate concern that we addressed at the time for a specialized group of people. In the common population there are a lot more occurrences of people who are color blind.
Are captcha's really worth the effort compared to other more human friendly processes? Is anyone working on what we will be doing next? Considering that there are decades of technology in machine vision technology to pull from I think it will be fairly trivial for the bots to become better at reading captchas than humans.
It might be effective to take the email authentication process and apply everything that mail servers do to authenticate the user. What I mean by this is apply all the mail server rules like FQDN requirements for HELO, fully resolvable email domains, valid email addresses, non-open relays. Much of this would eliminate either the bots or the ISP's who are too stupid to properly configure a mail server. Similarly it might be sufficient to code the HTML/HTTP to expect a properly responding client and not some hacked up bot that can't do most of it right.
All text based captcha's are broken, it doesn't matter how they're rendered, they're still a pre-defined set of characters that a bot can pick out eventually. Now, the "Click three kittens" captcha, that was fucking genious, no bot on the planet will be able to tell the difference between a kitten and a ham sandwich. Why isn't it being used? People seem to think obscuring text and making it harder for humans to read is a better idea than using something a computer will not be able to identify.
which is badly redundant, the very first thing is you can make all "td"-s in the table be 1px/1px with a simple: table.captcha td {width:1px; height:1px} rule, then background-color can be shortened to just "background" and still be valid.
Furthermore you don't need table with rows and columns, if you float the pixels to left, then you only need a container of the right width and columns/rows wil naturally form, to keep it down we can style a shorter tag for our purposes, like <b>
So at this stage we arrive at the much simpler:
<b style="background:#abcdef"></b>
But this can be simplified even further by indexing the colors used as around a 40-50 css classes (fiven the image has a lot more than 40-50 pixels and 40-50 colors are enough for it, it's still a net gain), for example:.cA {background:#abcdef}.cB {background:#ffaabb}, at which point we get not only more obfuscation for the captcha crackers to solve, but much lighter code:
There's no need to download the image. Look at the source. Somewhere it says: <input type="hidden" name="hash" value="ad6ade8a0b6e2f748b80a390ff45cf31">
Now, just go to MD5Lookup.Com [md5lookup.com] and convert that little "hidden" MD5Sum back to the original text:
That page gzips down to 12k - so ~2 seconds download speed.
The larger problem would probably be load on the server - possibly you could get around this by pre-compressing and then randomly serving. I don't think this was supposed to be a perfect solution, it's just a nice little demo showing how something common can be done in a new way.
I failed to see how this'll help (Score:5, Interesting)
Re: (Score:3, Informative)
Re: (Score:2)
Re: (Score:2)
Re:I failed to see how this'll help (Score:5, Insightful)
It's not that simple. Since the Captcha is no longer an image that you can download, the bot will first has to locate the position of the Captcha. The owner of the site can modify the layout of the page and Captcha making it unique. By rendering the image into HTML you practically modify to encoding of the image to a new and unique one - making it highly difficult to create a generic bot that will learn to decode all the HTML variations out there.
The problem today is with automated software that download the Captcha images from a pre-defined location (URL) and crack them. HECs makes it much harder to locate this resource.
Oh and everything is Crackable;)
Parent
Re: (Score:2)
How poorly are the CAPTCHAs doing these days against bots, anyway? I see a few that are probably easy to OCR, but there are quite a few where I have to make a effort to read them myself...
Re: (Score:2)
The HEC should only be on the form page (registration, forum submission etc) so it won't harm the user's experience too much.
I created the HEC because I used to get about 20 spam posts a day on my phpBB forums and other forms on my sites. I also read on many boards that this is a real problem. Since I started using HECs the spam amount went to 0.
Re: (Score:2)
Wouldn't pretty much anything larger than a single letter in HEC be larger than a full CAPTCHA?
My problem with the idea is that if it got popular, it'd probably be in a well-know script, at which point it'd be fairly easy to crack (even with random HTML spread around, i
Re: (Score:2)
This is still an image. Instead of sending a JPG or GIF, you are sending an actual bitmap in HTML. In my three-second preview, it just looks like a table with one-pixel cells. Then, you set the color of each cell (pixel) in HTML.
So, this still requires OCR, but there is just an extra obfuscation step in getting the image from HTML to a standard graphics format. The down side is that it is
Re: (Score:3, Insightful)
The "HTML renderer" in question will be either Mozilla or IE, both of which offer through Javascript the ability to find the absolute position of an element, and its absolute width and height. So the only "hard" part left is identifying the HTML location of the test, probably with something like XPath, or Mozilla's DOM Inspector which already allows you to just click on the element (and maybe go up in the hierarchy a bit.)
And I'm pretty sure the spammers already have progr
Clever but no cigar. (Score:3, Insightful)
It's a useful tool to slow down script kiddies but it won't stop anyone that could actually write the code to grab the characters in the image in the firs
Re:I failed to see how this'll help (Score:4, Interesting)
Add in the huge size of the html and the annoyance factor of captchas in general, and this is amazingly stupid.
Parent
Re:I failed to see how this'll help (Score:4, Insightful)
Yes, I see that they recommend adding in random divs and crap. If it's still a table, it's still very very easy to parse, even without a parser. If they intend for you to replace the table with 'random elements'
Parent
Re: (Score:2, Informative)
Gecko is absolutely overkill there: the HTML "encoding" is pretty lame, as the image is entirely made of 1px table cells, each one carrying its color information inlined in the style attribute.
Just one Perl line can extract the color matrix and pass it straight to your OCR algorithm.
Maybe if they used JavaScript to render the table on the client side, that would require Gecko or something like that (SpiderMonkey or Rhino would likely suffice), but still the complexity of a captcha cracker is noise reducti
Do others use such spam-bot blockers? (Score:3, Interesting)
I've had sessions that took an inordinately long time to initialize with various web service providers (it's very noticeable on dial-up.) I'm wondering whether similar techniques might be used to attack rather than defend, possibly including rogue AJAX code.
Re: (Score:2)
What I'm trying to get at is that with Flash and similar technologies, I can just remove the plugin or disable it in the browser. But with an AJAX or any other interface that uses ECMAScript, it might well be possible to deliver attack code. People forget it's called JavaScript because it's a similar syntax, but it is NOT sandboxed like real Java applets.
A matter of time (Score:2, Interesting)
The advantage of this captcha is that it is not widespread yet and so the chances that a bot can crack it are lower.
Funny that when OCR software is supposed to work it often fails, but when there is some effort to hinder recognition then bots can deal with that. Maybe general OCR software should try to crack input instead!
Render, PrintScr, OCR? (Score:3, Interesting)
A better solution might be the authentication system old 386 games had where you have to do some simple but human intelligence requiring task. "Find the word in the upper right of manual pg 4" -> "Enter the 3rd word from the following paragraph"
Re: (Score:2)
Re: (Score:2)
If anyone wants to produce HTML table graphics then The GIMP comes with an export plugin, good fun but don't try exporting or rendering anything too large, it can put a lot of strain on the browser.
Re: (Score:3, Funny)
"Prove or disprove P=NP. (You have 500 characters remaining.)"
Re: (Score:2)
Chance are that if you make something that joe sixpack can pass... so can a bot written by an Einstein.
watermarking (Score:3, Interesting)
What are the gotchas with these captchas (Score:2)
Re:What are the gotchas with these captchas (Score:5, Insightful)
Parent
Re: (Score:3, Insightful)
Nyh
Re: (Score:2)
I was wondering why I can normally see captchas but saw nothing in the sample box. Being colorblind I need to force most pages to colors I can see. Since my browser doesn't allow me to set colors for one site but not another, even the good sites get changed.
Bad form (Score:5, Insightful)
Re: (Score:2)
Re: (Score:2)
1: Your browser does not prerender (ie. IE) - though rendering was pretty instantaneous in IE6 for me too.
2: Something is wrong with your machine
3: You should consider looking into the purchase of a new machine if you are obviously so anal about a registration scheme that you will go through -once- taking a few extra seconds.
Re:Bad form (Score:4, Informative)
Parent
workaround... (Score:5, Informative)
1. Show the image in an alternate pornographic/warez/whatever website
2. Ask the user to type it in to access the site
3. Use the user's input to access the original protected site
4. There is no step 4.
Re: (Score:2, Funny)
Re: (Score:2)
Re:workaround... (Score:5, Funny)
One hand eh?
Guess we don't really need to ask how you know this...
Parent
A captcha is still a captcha (Score:5, Interesting)
A HTML generated captcha would prevent that, since there is no image file to copy.
However, what prevents the attacker to simply copy the relevant HTML source and put it on his or her site, just like the image? Sure, you can make it quite complicated by adding CSS layers and whatnot, but in the end that would just merely be an extra annoyance.
And stopping the attacker on using OCR on the captcha won't really work either. It's not that hard to render HTML code to an image, which you can feed to the OCR software.
In short, this hack is just another step in the arms race, that just buys us some time.
Not a resource they can download and process? (Score:2)
It's a nice idea, but it's little more than a speed-bump at best. (And not a particularly high one, at that)
Re: (Score:2)
Re: (Score:2)
Or it could just be that FreeBSD/KDE has magic powers.
Re: (Score:2)
By "no problems" I mean that it's right there in the page, and can be scraped out with relative ease. In fact, it's not really any harder than searching for the appropriate img tag, in either case you have to identify an enclosing block of text and pull out the relevant HTML fragment.
I
Re: (Score:2)
Screen Captcha! (Score:3, Interesting)
The file size is what intriques me. Just make a 'hidden' captcha that a bot would download. Now figure out how to make a jpeg decompressor uncompress that to 2 gigs or better.
It's like the old "I'll compress 2gigs of the letter A with zip and upload it to that BBS and let the virus checker gag" gag.
Or maybe a gif file. I wonder how solid black or white compress......
Lunacy (Score:4, Interesting)
With the limited amount of colours used, it would make much more sense to
a) give the table an id, then:
table.tabid td { width:1px; height:1px; )
b) give some classes for each colour used
td.colid { background-color: blah; }
I'm sure that would half the source code size... How can you trust a HTML solution that hasn't even been properly thought through?
Processing (Score:2, Interesting)
The Captcha is no longer an image and therefore not a resource they can download and process.
Err...but the HTML captcha is a resource they can download and process.
Re: (Score:2)
The Captcha is no longer an image and therefore not a resource they can download and process.
Err...but the HTML captcha is a resource they can download and process.
You still need to separate the captcha from the rest of the page.
Captcha's are annoying (Score:5, Insightful)
While this has little to do with the original post I have a really annoying experience with captchas
I have 20/20 vision and am not color blind. Captchas are becoming so complicated and garbled that I get the code wrong about 40% of the time. Another portion of the time I take to long trying to answer the code question and type in the right characters. I typically get screwed on the number Zero and the letter 'O' and lowercase 'L' and the number 1.
It'b becoming, for me, an entry barrier to signing up and gaining access to websites. It would be much easier to simply use email authentication. What do you do with the people who are color blind? I spent some years dealing with display design and this was a legitimate concern that we addressed at the time for a specialized group of people. In the common population there are a lot more occurrences of people who are color blind.
Are captcha's really worth the effort compared to other more human friendly processes? Is anyone working on what we will be doing next? Considering that there are decades of technology in machine vision technology to pull from I think it will be fairly trivial for the bots to become better at reading captchas than humans.
It might be effective to take the email authentication process and apply everything that mail servers do to authenticate the user. What I mean by this is apply all the mail server rules like FQDN requirements for HELO, fully resolvable email domains, valid email addresses, non-open relays. Much of this would eliminate either the bots or the ISP's who are too stupid to properly configure a mail server. Similarly it might be sufficient to code the HTML/HTTP to expect a properly responding client and not some hacked up bot that can't do most of it right.
Broken (Score:5, Interesting)
218k of junk (Score:3, Informative)
Also on the subject of it being 218k, each pixel looks like:
which is badly redundant, the very first thing is you can make all "td"-s in the table be 1px/1px with a simple: table.captcha td {width:1px; height:1px} rule, then background-color can be shortened to just "background" and still be valid.
Furthermore you don't need table with rows and columns, if you float the pixels to left, then you only need a container of the right width and columns/rows wil naturally form, to keep it down we can style a shorter tag for our purposes, like <b>
So at this stage we arrive at the much simpler:
<b style="background:#abcdef"></b>
But this can be simplified even further by indexing the colors used as around a 40-50 css classes (fiven the image has a lot more than 40-50 pixels and 40-50 colors are enough for it, it's still a net gain), for example:
<b class="cA"></;b>
and again the original:
And this is before we start putting JavaScript in the picture...
No need to download the image (Score:5, Interesting)
Now, just go to MD5Lookup.Com [md5lookup.com] and convert that little "hidden" MD5Sum back to the original text:
ad6ade8a0b6e2f748b80a390ff45cf31 - &NMTB
Maybe the author should add some salt.
You must have a very poor dialup connection. (Score:2)
The larger problem would probably be load on the server - possibly you could get around this by pre-compressing and then randomly serving. I don't think this was supposed to be a perfect solution, it's just a nice little demo showing how something common can be done in a new way.