[159850] in North American Network Operators' Group
Re: Suggestions for the future on your web site: (was cookies, and
daemon@ATHENA.MIT.EDU (Mike A)
Thu Jan 24 11:25:55 2013
Date: Thu, 24 Jan 2013 10:25:34 -0600
From: Mike A <mikea@mikea.ath.cx>
To: nanog@nanog.org
In-Reply-To: <20130124160050.GH10784@dyn.com>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
On Thu, Jan 24, 2013 at 11:00:50AM -0500, Andrew Sullivan wrote:
> On Thu, Jan 24, 2013 at 09:50:15AM -0600, Joe Greco wrote:
>
> > A CAPTCHA doesn't need to be successful against every possible threat,
> > it merely needs to be effective against some types of threats. For
> > example, web pages that protect resources with a CAPTCHA are great at
> > making it much more difficult for someone with l33t wget skills from
> > scraping a website.
>
> Well, yes and no. Lately, AFAICT, most CAPTCHAs have been so
> successfully attacked by wgetters that they're quite easy for machines
> to break, but difficult for humans to use. For example, I can testify
> that I now fail about 25% of the reCAPTCHA challenges I perform,
> because the images are so distorted I just can't make them out (it's
> much worse on my mobile, given the combination if its small screen and
> my middle-aged eyes).
>
> So it's now more like airport security: a big hassle for the
> legitimate users but not really much of a barrier for a real
> attacker. A poor trade-off.
"A Modest Proposal": Maybe we need to turn it around and fail on successful
recognition of the CAPTCHA, then?
--
Mike Andrews, W5EGO
mikea@mikea.ath.cx
Tired old sysadmin
