Friday | 10 July, 2009
CSO
How CAPTCHA got trashed
The wiggly words are now most useful for malware authors

So with all these problems, all these new ways to attack users both by e-mail and on social networks and blogs, is there any hope for CAPTCHA?

No, not really.

"I think my view on this now is that time is definitely running out for current CAPTCHA systems; already they are not as effective as they once were," says Wood. "It's already becoming more difficult for real customers to use them successfully, and they continue to come under increasing pressure from spammers."

Chenette goes further: "CAPTCHA has been broken for the last year and a half. The technology has really not progressed. They've got a little bit harder but the hackers have made programs that can easily break them. This works both with print and audio CAPTCHA. All of these have been broken in one way or the other."

Chenette says it's a "fundamental problem with no simple answer." After all, "harder CAPTCHA solutions mean harder problems for people as well." And he believes that "the idea behind CAPTCHA may need to be part of a solution."

Chenette doesn't expect that a one-size-fits-all solution will emerge, however. "Each site will have to choose its own answer. Financial sector sites, for example, will be more difficult than a free social-networking site," he notes.

Wood expects to see CAPTCHA replaced soon. "I would expect to see some sites introducing new techniques to replace the existing CAPTCHA models, maybe as early as the beginning of next year, perhaps involving 3-D spatial perception, such as the one created by SpamFizzle," he says.

And if that fails in its turn, well, there's always CAPTCHAs like the one used by Quantum Random Bit Generator Service. You do know your math through at least calculus ... right?

Comments

Post new comment

Login or register to link comments to your user profile, or you may also post a comment without being logged in.
The content of this field is kept private and will not be shown publicly.
Enter the fully qualified URL, eg. http://www.example.com/
  • Web page addresses and e-mail addresses turn into links automatically.
  • Allowed HTML tags: <a> <em> <strong> <cite> <code> <ul> <ol> <li> <dl> <dt> <dd>
  • Lines and paragraphs break automatically.

More information about formatting options

Additional Resources
Newsletter Subscription
Sign up for our CSO Online newsletters!
RSS Feeds
Syndicate content
 
Whitepaper

Extensible Threat Management

Unified threat management (UTM) spawned a new era of IT security. The promise of these integrated security appliances proved to be an exceptional and efficient way of securing commercial networks. However, businesses today face an inflection point, dictated by changing market trends and new technologies that demand more of today’s UTM. Hence the need is for eXtensible threat management (XTM) solutions, the next generation of UTM appliances.

Sponsored Links