To CAPTCHA or not to CAPTCHA? Gartner analyst says OK — but don’t be robotic about it
- Reference: 1624349170
- News link: https://www.theregister.co.uk/2021/06/22/to_use_captcha_or_not/
- Source link:
The firm’s opinion is contained in a post by senior director analyst Akif Khan, who noted that CAPTCHAs create friction for humans but remain an imperfect defence against bots.
Despite all this, Khan argued in support of them, with exceptions.
[1]
“Just don’t use the ‘pick a street sign from this matrix of images’ Google version of a CAPTCHA,” [2]Khan wrote . He advised trying what he called “more evolved” versions out there, like those from Arkose Labs, GeeTest or PerimeterX.
[3]
[4]
The analyst suggested that good CAPTCHAs should do more than ensure users provide a correct answer to a challenge, and also determine if answers are given too quickly — as would be the case for a professional paid per correct CAPTCHA test. The test should also dynamically increase in complexity when bot or professional CAPTCHA-cracking activity is detected.
[5]Cloudflare network outage disrupts Discord, Shopify
[6]Google reCAPTCHA service under the microscope: Questions raised over privacy promises, cookie use
[7]Multi-part Android spyware lurked on Google Play Store for 4 years, posing as a bunch of legit-looking apps
Khan also recommended only using CAPTCHAs for less than five per cent of all sessions — and then only in true grey areas, leaving the bulk of spam detection to a vendor. He also suggested assessing CAPTCHA effectiveness with A/B testing across any sites you tend.
While Khan sees a role for CAPTCHAs, Cloudflare recently launched an [8]anti-CAPTCHA manifesto . The web security company estimated that the world collectively spends 500 years every day completing the frustrating automated Turing tests that often rely on cultural nuance and hold people to physical and cognitive performance thresholds.
The Cloudfare [9]blog post suggested using Cryptographic Attestation of Personhood (CAP), essentially a hardware security key, as superior to CAPTCHAs.
[10]
The Register knows readers just adore CAPTCHAs — let us know the extent of your ardour in the poll below. ®
JavaScript Disabled Please Enable JavaScript to use this feature.
Get our [11]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YNG0vglReGmst0fPbW02NQAAAEU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://blogs.gartner.com/akif-khan/to-captcha-or-not-to-captcha/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YNG0vglReGmst0fPbW02NQAAAEU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YNG0vglReGmst0fPbW02NQAAAEU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2021/06/11/cloudflare_outage_captcha/
[6] https://www.theregister.com/2020/11/02/google_ad_privacy/
[7] https://www.theregister.com/2020/05/14/bitdefender_mandrake_malware/
[8] https://www.theregister.com/2021/05/14/cloudflare_cryptographic_attestation_of_personhood_captcha_killer/
[9] https://blog.cloudflare.com/introducing-cryptographic-attestation-of-personhood/
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YNG0vglReGmst0fPbW02NQAAAEU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[11] https://whitepapers.theregister.com/
Re: Complex CAPTCHA
Saying as I have no idea who Sarah Connor is, the only way I can solve that is to do a Google image search to see what Sarah Connor looks like. The third result is that very photo.
I'm pretty sure a computer could do that faster than a human. Then it is just a case of picking out the squares that include a picture of a human. Photoshop got the ability to do that about 10 years ago, so I'm pretty sure that would again be no problem for a computer.
Stevie Martin
https://youtu.be/LButXcZ57pc
A reasonably simple solution for smaller sites is to add an invisible field (e.g. a passwordConfirm text field or acceptAlllCookies checkbox) to forms, and then throw away any submissions where the invisible field is not the default value. This generally works because robots don't parse the css.
Robots will quicikly learn to parse css if people start doing that.
Already there.
While a Human using a screen reader gets stopped by CAPTCHA's, the bots sail past them without even pausing. Humans get filtered out while the bots get in, the exact opposite result of the desired one. *Sigh*
Unfortunately no.
Because another thing that doesn't parse CSS is a screen reader for the blind. Such a system would auto-determine any such user is no longer Human & lock us out.
"Here is advice about CAPTCHAs from somebody who knows jack about CAPTCHAs"
This is a blog post of somebody who happens to be employed at notorious "50% chance our prediction will happen" Gartner.
Re: "Here is advice about CAPTCHAs from somebody who knows jack about CAPTCHAs"
Oh c'mon that's unfair. They never make it as high as 50%
Re: "Here is advice about CAPTCHAs from somebody who knows jack about CAPTCHAs"
I'd be in favour of a GARTNER test that ensures none of their "predictions" ever get any attention
Causes problems when travelling
I don't find captcha tests too bad, a little annoying - except when I'm travelling in, say, mainland China, stuck behind the great firewall, and unable to log in to my email provider's webmail page because all google services including the sodding captcha test are blocked.
Re: Causes problems when travelling
I believe that is now its official name: the Sodding Captcha Test.
Re: Causes problems when travelling
Related (google blocked): I block everything javascript and googlely per default - so the stupid websites that insist on doing the stupid captchas don't bloody work, or only after I grudgingly accept some sites. And even then the stuff sometimes just fails. And yes, in some cases you really just have to use these websites, so sod off if "don't use those websites" was your suggestion.
I hate captchas. A Lot (as Brian of Nazareth said about the Romans). I'll refrain from complaining more, it is not good for my blood pressure...
Street signs
What gets my back up, is that google seem to think every street sign, fire hydrant and traffic light everywhere in the world looks like the ones in their own country.
GOOGLE - there is a whole world outside the f*cking USA you know? And it doesn't all look like your tiny little bit of the world. You could try, I dunno, maybe googling it sometime? Try "what does the rest of the world look like" for starters.
Re: Street signs
There are countries where the fire hydrants are not above ground, but under a floor plate - so they don't really exist. Traffic lights are less.... diverse I would say.
Street signs are a mess, especially if they are in a language or writing style (alphabet and other systems, like in China, Korea, Japan, ...) you don't understand: is that a street sign or ad ad for something?
Re: Street signs
I hate the traffic light ones - does it include the pole or just the lights? In the US you seem to have traffic lights mounted on poles that are 2 hundred feet long! (And every single one of them is included in the captcha test)
Captcha.
Ah the great invention.
Click on the crosswalk. A what?
Click on the apartments. Well those shops, do they have apartments on them?
Click on traffic lights. Do I include the posts?
Click on the sidewalk. A what?
Click on mountains. Well is that a hill or a mountain?
Click on buses. Well I can see one in the background, does that count?
Re: Captcha.
Click on the hideous lying bastard: (Picture 1 is of Trump) (P2 is of a cat) (P3 is of a dog) (p4 is of a pig).
Click on the image of a baby throwing a temper tantrum: (p1 is of Trump) (p2 is of a monkey) (p3 is of a slice of buttered toast) (p4 is of a rock with a smiley face painted on it).
Click on the failed waste of oxygen: (p1 is of Trump) (p2 is of a blackhole) (p3 is of a vacuume cleaner) (p4 is of a field of grass & flowers).
Click on...
=-D
*Runs away*
Isn't the added complexity of CAPTCHA just making the internet less and less accessible for people with disabilities? This actually could be considered discriminatory under the UK Equalities Act.
Obligatory XKCD
I suspect this whole thing is just another way of training AIs
https://xkcd.com/2228/
Complex CAPTCHA
https://me.me/i/google-is-really-getting-serious-with-their-al-training-select-10656732