Hi all I've released a new version of my captcha:- http://www.thespanner.co.uk/2007/07/12/return-of-the-heyes-captcha/ This version works with most likely sentences, for example:- "a creepy forest" not "creepy dog". The idea is to arrange the sentence in the correct order. Sentences would be different each time and at the moment it only displays 1 sentence. My future plans include display a hint for the sentence but in a way that could only be understood by a human without mentioning the words in the sentence. It's early days with the prototype but I really think this one could work. http://sla.ckers.org/forum/read.php?7,13630,13630#msg-13630 Tue, 18 Jun 2013 01:18:11 -0500 Phorum 5.2.15a http://sla.ckers.org/forum/read.php?7,13630,15728#msg-15728 http://sla.ckers.org/forum/read.php?7,13630,15728#msg-15728 Gareth Heyes Robots/Spiders/CAPTCHAs, oh my Mon, 10 Sep 2007 06:05:49 -0500 http://sla.ckers.org/forum/read.php?7,13630,15725#msg-15725 http://sla.ckers.org/forum/read.php?7,13630,15725#msg-15725
If you think about it, in the end everything isn't 100% secure, mouseclicks, keystrokes, voices, pictures and even IRIS-scans are hackable.

EDIT: typo]]> Spyware Robots/Spiders/CAPTCHAs, oh my Mon, 10 Sep 2007 04:34:27 -0500 http://sla.ckers.org/forum/read.php?7,13630,15700#msg-15700 http://sla.ckers.org/forum/read.php?7,13630,15700#msg-15700 -------------------------------------------------------
> You can't make a machine ask a question a machine
> can't answer. It's plain logic.

Yeah that's the challenge.

I admit my CAPTCHA wasn't a success, but I haven't given up so expect a new post and I'll expect the backlash :) but hopefully not.]]> Gareth Heyes Robots/Spiders/CAPTCHAs, oh my Sun, 09 Sep 2007 13:59:36 -0500 http://sla.ckers.org/forum/read.php?7,13630,15266#msg-15266 http://sla.ckers.org/forum/read.php?7,13630,15266#msg-15266
Writing information down on a post-it and slap it on your monitor is safer then let it be guarded by a CAPTCHA.]]> Spyware Robots/Spiders/CAPTCHAs, oh my Fri, 24 Aug 2007 17:17:04 -0500 http://sla.ckers.org/forum/read.php?7,13630,14789#msg-14789 http://sla.ckers.org/forum/read.php?7,13630,14789#msg-14789 FiSh Robots/Spiders/CAPTCHAs, oh my Sat, 18 Aug 2007 13:44:31 -0500 http://sla.ckers.org/forum/read.php?7,13630,13657#msg-13657 http://sla.ckers.org/forum/read.php?7,13630,13657#msg-13657
1) you haven't changed the problem, making it easy for robots to use grammar checks still (if they encounter one that's too long they can hit refresh and get a new one).
2) you've made it so difficult to solve I can't even figure out what you want me to do anymore.

This proving that it is a failed Turing test. I think it's time for you to stop the madness.]]> rsnake Robots/Spiders/CAPTCHAs, oh my Thu, 12 Jul 2007 22:46:27 -0500 http://sla.ckers.org/forum/read.php?7,13630,13653#msg-13653 http://sla.ckers.org/forum/read.php?7,13630,13653#msg-13653
CAPTCHAs should only be used to limited protection. If you run a site which gets 15K views a month and you have a custom built forum, then in reality you will not need to have a hard CAPTCHA if one at all, because the chances of someone pointing a bot at your site to break into your account, post spam would be very unlikely. Now if you were running popular software like phpBB then yeah a bot might be more likely to target you since the bot would likely have the code to break it, but still its lower than if your site was say myspace.com and having CAPTCHA protection would actually be beneficial, but you have to say is it worth it? You are basically turning users away who can't solve them as easily, and the ease of a site determines if a visitor will come back again. Yeah we would all love to shun stupid people, but come on when you want visitors to your site you take all you can get. There are other avenues in protecting a form which will be as effective if not more which would not prohibit the site's use by the average computer illiterate user.

Just my 2 cents.]]> CrYpTiC_MauleR Robots/Spiders/CAPTCHAs, oh my Thu, 12 Jul 2007 22:21:54 -0500 http://sla.ckers.org/forum/read.php?7,13630,13652#msg-13652 http://sla.ckers.org/forum/read.php?7,13630,13652#msg-13652
http://www.businessinfo.co.uk/labs/HeyesCaptcha3.2/heyes_captcha_test.php

It's still early stages but it grabs 2 random sentences from a story stored in a table. Then it displays the first sentence and mixes up the second which is related to the first.

There are a few problems with it, at the moment it returns either too long or too short sentences sometimes which I need to fix.]]> Gareth Heyes Robots/Spiders/CAPTCHAs, oh my Thu, 12 Jul 2007 20:33:17 -0500 http://sla.ckers.org/forum/read.php?7,13630,13651#msg-13651 http://sla.ckers.org/forum/read.php?7,13630,13651#msg-13651 rsnake Robots/Spiders/CAPTCHAs, oh my Thu, 12 Jul 2007 20:08:03 -0500 http://sla.ckers.org/forum/read.php?7,13630,13646#msg-13646 http://sla.ckers.org/forum/read.php?7,13630,13646#msg-13646
Thanks for your great feedback though, the information you provided will be very helpful to me when I create my next release. Stay tuned :)]]> Gareth Heyes Robots/Spiders/CAPTCHAs, oh my Thu, 12 Jul 2007 18:46:10 -0500 http://sla.ckers.org/forum/read.php?7,13630,13643#msg-13643 http://sla.ckers.org/forum/read.php?7,13630,13643#msg-13643
Firstly, lots of people will never solve this correctly. Sorry, it's a fact. People just aren't very good at solving things. For instance "Sarah ran through the grassy fields" is proper english, but so is "the Sarah ran through grassy fields" depending on what a "Sarah" is. Clearly the second is non-nonsensical but not everyone is a native English speaker either, or paying enough attention to what they are doing to get it right.

Secondly, you have one of the highest probabilities of brute force solving I've ever seen in a CAPTCHA - 1/720 with six words and 1/5040 with seven words. That's less than a normal CAPTCHA of 4 digit characters. The numbers listed actually makes an assumption that each word is unique - which in several of your examples they were not ("the" is used twice in the sentences more than once). In that case your probability of guessing the correct answer skyrockets to 1/120-1/720). That's worse than a three digit CAPTCHA.

Third, to actually break this would require only a split second with all possible combinations against a grammar checker since there are so few combinations.

Fourthly, I can refresh until I get an old (known/solved) CAPTCHA.

Lastly, since you have to build each sentence you can only have a limited number of sentence structures that are short enough to be easily solvable, making it incredibly easy to build a lookup table of solved CAPTCHAs.

Sorry, this CAPTCHA has serious security implications. I'd never implement this as-is.]]> rsnake Robots/Spiders/CAPTCHAs, oh my Thu, 12 Jul 2007 17:54:29 -0500 http://sla.ckers.org/forum/read.php?7,13630,13635#msg-13635 http://sla.ckers.org/forum/read.php?7,13630,13635#msg-13635 Gareth Heyes Robots/Spiders/CAPTCHAs, oh my Thu, 12 Jul 2007 16:15:26 -0500 http://sla.ckers.org/forum/read.php?7,13630,13631#msg-13631 http://sla.ckers.org/forum/read.php?7,13630,13631#msg-13631 i keep thinking captcha is not the solution, but well, as long nobody find something way better...]]> nEUrOO Robots/Spiders/CAPTCHAs, oh my Thu, 12 Jul 2007 15:12:37 -0500 http://sla.ckers.org/forum/read.php?7,13630,13630#msg-13630 http://sla.ckers.org/forum/read.php?7,13630,13630#msg-13630
I've released a new version of my captcha:-
http://www.thespanner.co.uk/2007/07/12/return-of-the-heyes-captcha/

This version works with most likely sentences, for example:- "a creepy forest" not "creepy dog". The idea is to arrange the sentence in the correct order. Sentences would be different each time and at the moment it only displays 1 sentence.

My future plans include display a hint for the sentence but in a way that could only be understood by a human without mentioning the words in the sentence.

It's early days with the prototype but I really think this one could work.]]> Gareth Heyes Robots/Spiders/CAPTCHAs, oh my Thu, 12 Jul 2007 14:27:28 -0500