CAPTCHA and 大象传媒 iD
Hi I'm Rowun. I work in the UX&D Prototyping team.
are a big issue for websites. Using them has the potential to exclude disabled and non-disabled users alike. Our users often tell us that they don't want to see CAPTCHAs on 大象传媒 Online and they will be pleased to see that when they use 大象传媒 iD, our single sign on service, that this is still the case. I've decided to write this post to explain why this decision was made.
Captcha image from Wikipedia
Late in 2009 Judith Garman, Pekka Toppi, Lucy Dodd and I began looking into for 大象传媒 iD and how it might affect users. We researched into cracking, implementing and the future of CAPTCHAs. We performed user tests to document the experience of using our services with CAPTCHA and tested various solutions that could be suitable for our needs.
stands for Completely Automated Public to tell Computers and Humans Apart. It's a technology that assists in discerning between human and non-human users with the goal of preventing unwanted usage of services (e.g. posting ads or spam) by non-humans.
You've probably already seen one on a registration or comment page. It's often an image of distorted text that must be typed into a box next to it. However, it could be a logic based puzzle that has to be solved or an image of an animal that needs to be selected based on a question. There are many different types of CAPTCHAs and many different variations of those types. We needed to find out which, if any, were acceptably accessible for the 大象传媒 and were a good fit for the requirements set out by 大象传媒 iD.
We started the research by looking at the CAPTCHAs most commonly available and potentially the best suited to 大象传媒 iD. The CAPTCHAs covered were distorted text and distorted images, 3D, logic and sound. We needed the research finished before 大象传媒 iD launched and with enough time for the 大象传媒 iD team to implement a solution if opted for.
We found that most image CAPTCHAs, including "select image type" and "select the one that is a..." could be by existing software or would need a database of images so numerous to prevent logging as to be impractical. There are also the obvious accessibility issues such as vision impairment that needed to be taken into account for image CAPTCHAs. The accessibility issues and the need for constant database updates discounted this CAPTCHA type.
It appears that as a technology, 3D CAPTCHA is not mature enough. More information is needed over what the easiest models to interpret are, what is the optimal position of those models, what are the best textures and positioning of lighting. Many of these questions will be answered as the technology matures. 3D CAPTCHA has potential as it requires interpretation, life experience and spatial awareness. All things that software in the near future will continue to have difficulty with.
Next we looked at distorted text and logic puzzles. We recognised that not all distorted text was appropriate and we weren't sure about logic puzzles. Distorted text has an advantage over most other CAPTCHAs. There is community support for users with accessibility needs in the form of browser plug-ins and websites that can either decipher CAPTCHA text or send it to a human volunteer to decipher and send a result back. This is a double-edged sword, it shows that it can be cracked but with the secrecy around the plug-in technology, the need to register for access and submittal limits it is an acceptable compromise.
This mock up of what Captcha might look like on 大象传媒 iD was never used
The results were not unexpected. Many users did not know what a CAPTCHA was or understand why they were needed. Most users found them annoying. Visually impaired participants expected full accessibility from the 大象传媒 and felt it would affect our reputation to use them. Elderly users had issues with the distorted text. The logic puzzles were found to be odd and patronising. The audio was struggled with. Overall, extremely negative feelings were expressed towards CAPTCHA technology.
From a cracking standpoint, we found a single factor that negated all the advanced and expensive cracking software and the most advanced and resistant CAPTCHAs: .
The negative user experience that a CAPTCHA creates and the CAPTCHA cracking companies are two factors too great for us to ignore.
With all this in mind we have decided, at least for now, not to use CAPTCHA on 大象传媒 iD.
Rowun Giles is Junior Web Developer in UXD prototyping, 大象传媒 Future Media & Technology
Comment number 1.
At 6th Oct 2010, Simon Cross wrote:Hey Rowun,
Thanks for your post, but I can't quite be believe you've actually run it.
I'm about to leave my house and, by the way, I've left my front door unlocked....
That's what you're telling us has happened to 大象传媒 iD. I agree CAPTCHA isn't perfect, and the plan for it at the 大象传媒 (as I understand it) was always only to show it to those who met some suspicious criteria - I won't, thankfully, divulge what they those criteria are, but they were the result of some excellent research by some very clever people at the 大象传媒.
However since you've said you're not using CAPTCHA anywhere in 大象传媒 iD - I'm about to write a script to completely spam your login system.
It'll take me 12 lines of Python. And I won't be the only one.
Please come to your senses, and use this technology sparingly, but where necessary.
Complain about this comment (Comment number 1)
Comment number 2.
At 6th Oct 2010, Mo McRoberts wrote:Simon 鈥 surely 鈥渨e aren't using CAPTCHAs鈥 is a piece of information that's pretty trivial for any would-be spammer to discover all by themselves?
(And also, I can't recall 鈥 is e-mail address verification a required step in the sign-up process for an iD?)
Complain about this comment (Comment number 2)
Comment number 3.
At 6th Oct 2010, Russ wrote:Rowun - just to say I think you've made the right decision. CAPTCHAs are magnets for spammers and are crackable. I run a website that had a guest book with a good CAPTCHA mechanism, and that was being hit up to 300 times a day by spambots. (I had a bit of code that preventing them going further into the system, but that's another matter.) And if my little website attracted 300 hits a day from them, the 大象传媒 site could get millions.
Incidentally, I've always thought the simple mechanism that some bloggers use seems to have merit - here's what Martin Belam does for example on his comment submission section:
"Alan Turing wouldn't be impressed with this crude test - but please put 'toothpaste' into this box to prove you are a human."
Russ
Complain about this comment (Comment number 3)
Comment number 4.
At 6th Oct 2010, Mark Stickley wrote:Mo, just what I was thinking. You just have to register to see that we don't use CAPTCHA. We don't require email address validation unless the service you are using requires it, however.
The super-secret criteria to trigger CAPTCHA is a nice idea but at the end of the day the determined spammer will just employ one of these services to crack CAPTCHA and if it pops up accidentally for any genuine user it will just impair their registration journey (or maybe they won't finish registering at all).
We already take steps to prevent spamming and automatic bulk form submission so it's not like the door is wide open. I'm pleased to see some of our research being published - very useful and just the sort of thing the 大象传媒 should be doing.
Complain about this comment (Comment number 4)
Comment number 5.
At 6th Oct 2010, Andrew Bowden wrote:Russ - I've always liked Martin's approach too - it does work well for a smaller site although I'm not entirely sure if it's necessary for smaller blogs to have CAPTCHAs any more when the anti-spam services are so good.
Outside of work I look after three different websites of varying sizes all with comments and none of which employ any CAPTCHAs, Turing tests etc and very few bits of spam get through the net.
Meanwhile one major website I tried about a year ago proved impossible for me to register with because, try as I might, I couldn't decipher their CAPTCHAs! True they had an audio backup but that required transcribing what seemed like a 40 word sentence! I can't remember what that site was but it's a safe assumption that I don't use it regularly.
Complain about this comment (Comment number 5)
Comment number 6.
At 6th Oct 2010, Russ wrote:Andrew - you 'ad it easy, lad. We used 't dream of transcribin 40-word sentences to get in't some places. In my day, we 'ad ter submit three essays in't latin to get through pre-mod on't Radio 3 messageboards.
Russ
Complain about this comment (Comment number 6)
Comment number 7.
At 6th Oct 2010, Robert Carnegie wrote:One trick that you missed: CAPTCHA using recognition of 大象传媒 media content. You've -got- a vast database of audio, video and image, which is familiar to your audience but not to general spammers, assuming they are separate. "This is an elephant appearing on [Blue Peter]. What happens next?" "Who is this man and why does he no longer present [Film 2010]?" "What did you just hear Melvyn Bragg / Neil Nunes / Patrick Moore saying?"
Defence in depth means having multiple counter-measures, which don't have to be each completely effective. Attacks on CAPTCHA are made when either the prize is worth the effort, and/or when getting past -all- the defences doesn't have an excessive cost.
Not that I'm -demanding- CAPTCHA to log in, but it can be fun. Or it can be impossibly difficult, which is quite annoying. At least you are usually allowed more than one CAPTCHA to try if you got the first one wrong.
Complain about this comment (Comment number 7)
Comment number 8.
At 8th Oct 2010, tristanf wrote:Have you considered reCAPTCHA? It uses the process of solving CAPTCHAs to digitise books, which with appropriate explanations could mitigate the chore. And it also seems to be in the spirit of public service and will even get those spammers doing something useful.
Complain about this comment (Comment number 8)
Comment number 9.
At 8th Oct 2010, Rowun Giles wrote:Russ - I like the idea of Martin's honey pot. On smaller sites they'd work well to combat generic spam systems. On bigger sites with custom sign in systems, chances are a custom spam system will be written that takes the honey pot into account.
Robert - We did consider using 大象传媒 content in the way that you suggest but ultimately decided against it. Many of our users may not be regular consumers of 大象传媒 content or perhaps have just immigrated to the UK and so they don't have that content association.
tristanf - Unfortunately with reCAPTCHA the accessibility issues still remain.
Complain about this comment (Comment number 9)
Comment number 10.
At 12th Oct 2010, narwhalr wrote:I believe captchas should be installed to serve a purpose other than just fighting spam. Like mentioned above, every captcha can be broken by spammers that have a small amount of skill, but I think the real reason to have them is to stop people that normally wouldn't... such as a pissed off user.
ReCAPTCHA reads books which is a step in the right direction, but I've taken the approach on submission forms at (work in progress) to make it fun. To make it fun, I've made my own word list that it pulls from. Right now there are just generic words in it like "lovely day" and "Sunday", but I'll be changing them eventually to phrases that will likely get someone to laugh.
It's not brilliant by any standards, but I think it makes the well needed captchas slightly more tolerable, and possibly something to look forward to.
Complain about this comment (Comment number 10)
Comment number 11.
At 17th Oct 2010, iopuqworiqw wrote:In case you have problems with spam, I recommend fully accessible spam filtering: Sblam! (it's a BSD-licensed server-side bayesian filter).
While no filter is 100% accurate, it can at least greatly help moderation (rejecting obvious spam outright, whitelisting benign messages and leaving rest to moderators).
大象传媒 iD registration is rather lenghty, but kudos for not using CAPTCHA!
Complain about this comment (Comment number 11)
Comment number 12.
At 18th Oct 2010, Dick Davies wrote:I've seen a couple of fake CAPTCHAs over the last year or two. Liked the idea, but not clear
on the usability:
Complain about this comment (Comment number 12)