3D-based Captchas become reality
The newly implemented Captcha method that's based on 3D images.
(Credit: Dong Ngo/CNET)I wrote a blog about a new way of creating Captchas by using 3D images that Taylor Hayward, a blogger, came up with and thought it would be really cool when implemented. Now, 3D Captchas seem to have become a reality--however, not from Hayward.
Incidentally, the folks at YUNiTi.com, a social Web site, have been working on the same idea for a few weeks and have implemented the method on their Web site.
The site announced Wednesday that it has created a 3D Captcha method that is unbreakable by current computer technology, yet much easier for humans to identify.
Captchas is short for Completely Automated Public Turing tests to tell Computers and Humans Apart. This is a way to make sure the input is not generated by a computer.
Similar to Hayward's idea, this new technology relies on our ability to identify objects in 3D instead of using alphanumeric characters. YUNiti's 3D Captcha, however, has three objects in the challenge and extends the list of images to any object, not limiting it to animals as in Hayward's idea. This increases the challenge's level of complication to prevent computers from successfully making the correct guesses.
I tried a new Captcha at the Web site and it worked very well. You just need to click on the placeholders for each object, then you are presented with a list of objects to choose from. After four mouse clicks, I passed the Captcha the very first time.
Marcos Boyington, co-founder and primary software engineer of YUNiTi.com, told CNET News that he and his brother came up with the idea without knowing of Taylor Hayward's method. Boyington believes this was joint discovery of the same concept by people in different parts of the world. He said he is seeking contact with Hayward to talk about collaboration opportunities.
Dong Ngo is a CNET editor who covers networking and network storage, and writes about anything else he finds interesting. You can also listen to his podcast at insidecnetlabs.cnet.com. E-mail Dong. 
The Order and 9x9 grid are already rendered differently as it is, so that is 2 separate patterns it would have to match, and pattern matching for complex objects is in it's infancy.
On the complex scene part, even if it were, would it matter?
Not really, the bot could still detect the object due to the colour.
As i mentioned above, unless complex textures are used, there is no point to make a complex background.
The whole reason i went off Myspace was their stupidly long captchas.
Hopefully this will take off more, visual and clickable captchas are much more pleasing than having to type out things, nobody likes typing. (heh)
But on a serious note, since handhelds with touchscreens are becoming more popular, it would make sense to evolve to clickable captchas.
Also, Chrome (1.x) can't display the Order image, it displays the other images fine.
I'm not sure it likes &.png.
Not sure if that is meant to be the correct behaviour or not, but i will file a report on for it on the group.
The first of these would be to, say, have 4 boxes to fill instead of 3. That increases the probability of a correct guess to 1/104,000. Next would be to have more than 18 objects (although the user would always be given a "palette" of 18 objects to pick from, otherwise it would take too long to scan the objects). There would be, say, 100 objects, and the user would get 18 randomly picked objects to choose from (out of the 100).
Lastly, textures could be added to objects to make them even more difficult to recognize by software.
But the point here is, even with simple, basic greyscale objects like our captchas, it's still far more complex to crack than letter captchas. Being an experienced software engineer, if I had to pick the task of cracking recaptcha or cracking this new 3d-image based captcha, I'd take the former. Recognizing 2D letters is a lot simpler than making out objects from 3space which have been projected onto 2D.
First off, CAPTCHAs are inherently crackable by cheap human labour, which you can't make unprofitable without making the CAPTCHAs an unreasonable burden for legitimate users. This is not a flaw in this particular system, of course.
As regards this particular CAPTCHA scheme, if you solve it (even manually) for a few dozen, or at most a few hundred rotated views of each object, you're pretty much done, as small rotations (e.g. 10 degrees) of the 3D objects are quite close to simple 2D transformations. Since there only seem to be a few tens of objects from which the puzzles are selected, that's a small enough task to get started, and a library of easily recognisable 3D objects is unlikely to run to millions, or even to tens of thousands.
I have a few more details up at http://technobabblepro.blogspot.com/2009/04/how-theyll-break-3d-captcha.html and an earlier post there.
This link will take you to a page that demonstrates the SMS / VOICE Captcha.
http://www.hummingbytes.com/demos.aspx?PRODUCT=WebSecurity
I am not sure if you understood what we do OR I am not understanding your reasoning.
If a SMS is being sent to a phone number, which you need to read and then enter in a website to get access, how does a hacker connect their phone to the computer and use a script to hack in ?
http://spamfizzle.com/CAPTCHA.aspx
Make them simple. If someone can 'crack' them and spam is it really the end of the world? You still stop 99.99% by just using *something*
I figure if you're going to make it more difficult for a human to use your site than a script, why even bother. The idea of this 3D captcha is to make it pathetically simple for us, and insanely difficult for scripts.
This scheme requires too many clicks and must have a bypass for the blind and others with disabilities. That bypass mechanism will probably be weaker and is the more likely attack vector. Thus, I'm not sure 3D CAPTCHAs are any better.
Not sure how long it will take to come up with a method of getting computers to learn how to do it, I am sure not as long as people think it will take or required as much processing as people think.
http://www.CaptchaTheDog.com/contact.html
The images rotating with a random number of images makes odds better than 50,000 to 1
- by alexschrod April 8, 2009 9:54 PM PDT
- How does this work for the blind or visually impaired? At least some text CAPTCHAs, like reCAPTCHA, also provide an auditory alternative.
- Reply to this comment
-
(31 Comments)