Captcha: codes, images and puzzles for spam pro­tec­tion

Text-based captchas

The oldest form of Human Veri­fic­a­tion is the text-based captcha. Known words or random com­bin­a­tions of letters and digits are alienated. In order to continue, a user has to decipher the code rep­res­en­ted in the captcha box and enter the solution into the text box. Classic tech­niques used to create text-based captchas are Gimpy, ez-Gimpy, Gimpy-r, and Simard’s HIP.

The ali­en­a­tion involves dis­tort­ing, scaling, rotating, or curving the in­di­vidu­al char­ac­ters and even combining them with ad­di­tion­al graphical elements, such as lines, arcs, dots, colors, or back­ground noises. The following graphic shows a selection of possible text-based captchas that can be en­countered online.

Text captchas only provide reliable pro­tec­tion against spam when the solution can’t be cracked by pro­grammes with automatic text re­cog­ni­tion. As a rule, however, this requires ali­en­a­tion, which also sig­ni­fic­antly limits read­ab­il­ity for human users.

This can be demon­strated with the following examples. If you want to create a free account with Microsoft, you first have to enter letters in the box, so the user would write 'SGPKDL'. Spambots, on the other hand, wouldn’t be able to recognise these contorted letters.

The correct sequence here is '1VYEJX' although the last character is difficult to read as it could either be the letter 'X' or a plus sign '+'. While the first example could pose problems for mature re­cog­ni­tion software, but not humans, the example above is even more distorted so that it might even be difficult for human users to solve. Many well-im­ple­men­ted captcha codes offer the option of skipping to the next one if the first one proves too tricky to read. In the above example, the user can click on 'Refresh con­firm­a­tion code' to be presented with the next sequence, which is hopefully easier to decipher. Despite this option, many visitors do find captcha codes trouble­some.

As a result, many al­tern­at­ives to text-based captcha tech­no­logy now exist to combat this problem. Google offers a prominent version of the classic text captcha named reCAPTCHA. Instead of gen­er­at­ing random words, reCAPTCHA pulls content from various di­git­al­isa­tion projects, such as Google Books or Google Street View. For example, users receive street names, house numbers, traffic signs, and fragments of scanned text sections, which they then have to decipher and enter into a text field. The software always offers two elements – one that is already confirmed, and one that isn’t. In principle, users only need to recognise the first element to suc­cess­fully complete the captcha. Users, who also decipher the second element, then take part in Google’s Di­git­al­iz­a­tion Project. The input is verified on a stat­ist­ic­al basis. The elements, which need to be de­ciphered, are always presented to several users. The correct answer is the one that is given most often.

The following example shows two dif­fer­ently designed reCAPTCHA queries, which users encounter, for example, as part of community ap­plic­a­tions.

Image-based captchas

An al­tern­at­ive to text captchas is the image-based method. Instead of present­ing users with an alienated solution com­pris­ing of numerals and letters, image-based captchas are based on quickly re­cog­nis­able graphical elements. As a rule, several photos of everyday objects are displayed side by side. The user has to click on the images that are similar to the original image, or to show which ones represent a semantic content.

This next example shows a cat as the main image. The user then has to decide which of the other 9 photos depict cats, and then click on them in order to complete the captcha.

Google al­tern­at­ively uses captchas from Google Street View where users are asked to enter a house number or street sign into the text box.

Audio captcha

Text and image captchas can be assigned to the graphical Human Veri­fic­a­tion process. Whether a human user can easily pass this step depends on how good their ability is to recognise the displayed text or image in­form­a­tion. How will a visually impaired person be able to read a captcha? Website operators should ensure that their selected captcha method has several solutions to increase their website’s usability.

So that visually impaired people can also suc­cess­fully solve captcha codes, text-based or image-based test methods are usually combined with so-called audio captchas. There’s often an extra button that the user can press in order to hear an audio recording, e.g. a short sequence of numbers, which is then entered into the input field.

On the example below, you can see the volume button to the right of the text box:

To ensure the captcha is as user-friendly as possible, the recorded audio should be easy to un­der­stand and adapted to the user’s language.

Math­em­at­ic­al tasks and logic captchas

A captcha al­tern­at­ive, which also takes into account the needs of the visually impaired, relies on math­em­at­ic­al tasks or puzzles to filter out spambots. A task like the following can be read out with a screen reader, if required, meaning that it can also be used by users with non-visual output devices.

These math­em­at­ic­al equations are simple to solve, but the problem is that they aren’t much of a hindrance to computers since computer people are good at dealing with numbers. This type of captcha is therefore often combined with various kinds of text ali­en­a­tion so that it’s im­possible for screen readers to make sense of it. It is much more difficult for pro­grammes if the result isn’t a figure, but rather a word, or if only a single digit of the result has to be entered (e.g. calculate 7 x 7 and only enter the first digit of the result in the box. The result would be 49, so the captcha solution would be 4).

In addition to computing tasks, logical tasks and general knowledge questions are also used as captchas. Often with thematic reference to the re­spect­ive website. In a forum about SMF (Simple Machines Forum) software, the visitor must answer two questions about the subject before they can proceed with the re­gis­tra­tion.

Gami­fic­a­tion captchas

Website operators, who are worried about scaring their visitors away with cryptic text captchas or tricky math problems, should take advantage of the gami­fic­a­tion trend. Providers such as Sweet­Captcha and Fun­Captcha offer en­ter­tain­ing mini-games, which are known as gami­fic­a­tion captchas.

Sweet­Captchas rely on people’s ability to associate and present website visitors with simple as­sign­ment tasks. The following example requires the user to drag the drum­sticks to the drum to prove that they are, in fact, human.

Sweet­Captcha uses a variation of classic puzzle captchas, in which users have to drag and drop picture elements into the correct position.

With Fun­Captcha, on the other hand, everything revolves in a circle. Use the arrows to position the dog correctly, then click on 'Done'. If the dog is the right way up, the software will allow you to move onto the next step.

Even though captchas seem to be every­where today, the methods based on the Turing test aren’t the only way to secure in­ter­act­ive websites against spam. As early on as 2005, the WAI developed a proposal catalogue without captchas: 'In­ac­cess­ib­il­ity of CAPTCHA – Al­tern­at­ives to Visual Turing Tests on the Web' with the Working Group Note 23. Over time, numerous methods have been es­tab­lished to identify automatic queries and inputs.

• Black lists: If you notice that lots of spam or automatic queries are coming from a specific source, you can block the IP address by adding it to a black list, which you can create manually via .htaccess. All IP addresses on the black list will be blocked from con­tact­ing you in the future. Al­tern­at­ively, there are various anti-spam networks as well as pro­fes­sion­al service providers, which provide cent­ral­ised, con­tinu­ally updated black lists.

• Honeypots: Some website operators expose potential black list can­did­ates by setting up online forms to lure cyber attackers in. These decoys are known as honeypots and work by providing input fields hidden from users via CSS or JavaS­cript. Simple spam bots, on the other hand, usually only read a website’s HTML code and fill in the hidden fields with auto­mat­ic­ally generated content. This is a clear in­dic­a­tion that the in­ter­ac­tion with the website isn’t through a web browser and therefore not performed by a human.

• Content filter: One way of pre­vent­ing comment spam on blogs, in online shops, and on forums, is to use a content filter. These also work with black lists. To do this, website operators need to define 'hot words', which are fre­quently used in spam content, so that the entries can be auto­mat­ic­ally iden­ti­fied as computer-generated. If content filters are used, however, there is a risk that con­tri­bu­tions by human users will also be blocked if words they’ve used appear in the black list.

• Server-side filtering: Most web servers use a filter software, which makes it possible to detect abnormal in­ter­ac­tions with certain areas of a website, which limit the damage that spambots can cause. Spam filters are based on static, heuristic, and be­ha­vi­our­al analyses in order to be able to identify unusual char­ac­ter­ist­ics and known patterns. Spam filtering analyses are based on the user agent’s technical char­ac­ter­ist­ics. The scope of the requested data, the IP address, the data entry methods used, as well as signature data and pre­vi­ously visited websites, are analysed. In addition, it is possible to calculate using time stamps how much time has passed between an online form first being displayed and being filled in. In contrast to human users, spambots are par­tic­u­larly fast when com­plet­ing forms.

A widely used al­tern­at­ive to the classic captcha, which is based on be­ha­vi­or­al analysis, was also created by Google. Google has offered the Human Veri­fic­a­tion service named 'No CAPTCHA re­Captcha' since 2013. It reliably protects in­ter­act­ive websites against spam and, in most cases, doesn’t require a captcha. Instead of providing users with a visual, auditory, or logical context, Google’s new reCAPTCHA is just a simple tick box.

If the user ticks the box next to 'I’m not a robot', the software runs a check in the back­ground to work out the prob­ab­il­ity of this being an automatic input by using advanced risk analysis. The company won’t reveal which test steps this testing algorithm includes. The following features have been discussed, however:

• Cookies
• IP addresses
• Mouse movements in the tick box area
• Length of stay

If the software concludes that it’s a human user, it lets them continue without a problem. If the result of the analysis shows that there might be a high spam risk, a captcha has to be completed. No CAPTCHA is therefore an upstream test method, which decides whether Turing test veri­fic­a­tion is necessary or can be skipped. Usability is increased, but this could lead to data pro­tec­tion problems. Website operators using the new reCAPTCHA auto­mat­ic­ally submit their users’ motion data to Google. Users must therefore be told that third-party software is being used to prevent spam. Google specifies the general con­di­tions of use as well as global data pro­tec­tion de­clar­a­tion for the new reCAPTCHA. This is also the case with other Google services. You therefore can’t rule out that Google won’t use the data collected to optimise its own services, for example, in ad­vert­ising. This issue is discussed in an article from the online magazine, Business Insider. On the current website of the reCAPTCHA project (as of January 2017), Google announced Invisible reCAPTCHA, which is a de­vel­op­ment of No CAPTCHA reCAPTCHA, but without the in­ter­act­ive tick box.