Clickcha - click the biggest/smallest number for CAPTCHA | Hacker News Reader

Clickcha - click the biggest/smallest number for CAPTCHA

clickcha.com

14 pointsest34 comments

Clickcha is more secure than traditional text based CAPTCHAs which can be read via OCR software.

Because... circled numbers can't be read by OCR software?

Without some visual obfuscation, I fail to see how this is an improvement against bots. Simple OCR + location of match = 100% success rate (just click the middle). Improvement for users, perhaps, especially due to its simplicity... but I don't know if that's worth it.

> Simple OCR + location of match = 100% success rate

Sometimes it ask you to choose the biggest square, not only biggest/smallest questions. The challenge varies all the time.

For example, I can ask you to choose the biggest triangle out of some boxes, circles and stars, and the question sentence can be displayed using a line of traditional CAPTCHA

ok sure, but how many permutations of different questions are there? Once you have these, it is trivial to OCR the numbers/shapes and pick the appropriate one per the question.

And then you fall into the same problem with a race between captcha/clickcha programmers (who MUST maintain ease for human-use) and spam programmers (who can click randomly and still sometimes succeed, so they only seek to boost their chances).

I'll give them two guesses who will win most of the time.

> how many permutations of different questions are there?

Infinite! Just this of the possibilities with that kind of system. You could keep adding different questions (just minor variations) and it won't be difficult to keep ahead of spammers. Plus there is always a trade off between security and ease of use. I think the ease of use with clickcha is well worth the slight loss of security.

Having to manually add questions means that practically speaking the number of possible questions <<<<<<<< infiti. As soon as you add another question, the spammers will simply add it to their portfolio of question types. There is no way "you can keep ahead of the spammers" with this.

Well there's that and they only need to break 1 of them, adding more types doesn't really do anything when you can refresh except to slow things down by a bit. :P

I didn't catch the other question types, and the page isn't loading for me any more so I can't fiddle with it further.

I can see where that'd help (significantly), but I don't see how a captcha-reader can't also parse the key words, and interpret the image appropriately. "size-est" and "shape" / "color" is easy to rip out, and a basic OCR to detect shapes and sizes and a number is pretty basic.

And remember that the site lists Captchas as being OCR-able, and that the question sentence must be readable - quickly - by humans, so it can only be weakly obfuscated, unlike some of the shorter Captchas. That weakens an already-claimed-as-weak system, so it's easy to assume the instructions can be read. Detecting a couple key words via a smallish dictionary seems simple at worst.

A few mistakes can be ignored, because the server must allow a few - people will make them too. After all of the above, what's the success rate on a dumb interpreter? Say, one that can't understand order of words, merely their existence.

I'm not seeking to totally shoot this down - I think it's an interesting idea, and with a large number of objects and some visual obfuscation could possibly supersede Captcha. But it's achieved by adding logical complexity; to retain ease of use, visual complexity / some other form has to be sacrificed, which makes it easier to read by machines. Or, potentially, making the image quite a bit bigger, so the images / objects used can be made significantly more complex ("click the dog" when given several images).

> circled numbers can't be read by OCR software?

It doesn't have to be circled numbers (or any other text), that is just one of the possibilities.

On the plus side, this is going to cost the first motivated spammer who runs into it about $50 ~ $100 to get it broken by an Eastern European programmer who is better at OCR than probably anyone on HN.

On the minus side, it is then totally useless aside from hassling actual users.

I think he is onto something, and just needs to think it through. I think creativity should be encouraged.

On the part of clickcha or on the part of the eastern european programmer?

How does this hassle users more than regular captchas? The only additional effort it adds is a bit of thinking (too much to ask these days?). You don't have to type anything and it replaces the "Submit" button so not even any extra clicks.

It replaces the [Submit] button, so I can't tab to it and press space to submit, I have to move my hand from the keyboard to use the mouse.

Ordinary captchas exclude blind and other visually-impaired people. Audio captchas exclude deaf and hard-of-hearing people. Clickcha excludes people with muscle-control disabilities.

Most people click. But still, isn't it better than having to figure out characters and typing them?

Of course, there would be alternatives for people with disabilities.

It's different. I don't think it's particularly better or worse overall.

It suffers from the same issues of forcing commentators to stop and think about something utterly unrelated to the comment they are trying to make, and of being easily defeated by third world workers paid a pittance or first world porn addicts.

That doesn't look at all impressive. It seems easy to write a solver for it. Especially considering most spam bots are quite happy with relatively low rates of succeeding, they can just brute-force until they find one they can solve.

I think they use javascript to record the coordinate (x, y) where you clicked it

on one scenario you 'll select a 24x24 square out of a 200x100 pixel picture, the success rate is 2.8%

Bots will be happy by any success rate above 0%

I'd like to combine this with akismet. Bots will be happy with a 2% rate but I'll be more happy than them with 98% less comments to check in the spam folder

2% success rate against bots does not equal 98% fewer bot posts. Just 50x more traffic.

> Just 50x more traffic.

50x traffic is too obvious to ban :)

a five digit case-ignore number/letter success rate is 1/(36^5), it's very small but still above 0%

Hi,

I am the developer of clickcha. Appreciate the input, but you seem to be forgetting that bruteforcing can be avoided by temporarily banning the IP for some time after certain number of incorrect attempts.

Don't forget that spammers exploit botnets with tens of thousands zombie computers each one with unique IP. 2.8% from 10000 zombies = 280 first try successful breaches.

That's why they use botnets for this. Each attempt will be from a fresh ip.

Don't give up though, you are on to something. If you can make the permutation higher then yea you can definitely make it big.

You could make it much harder for bots by asking the user to click on two numbers (e.g. highest and lowest). I don't think that would be too much extra work for the user as most of the effort is in scanning through all of the numbers.

I think it's higher than that. I think we can atleast use some kinda of processing to detect where the circle/square/retangles are. So, it is more like 1/9. So in 6 tries there is a 50% chance of success.

Why would I pick a pixel at random when I could pick a black pixel and have better than 10% chance of getting it right regardless of the question with less than 10 lines of code?

Whatever happened to the idea of filtering out comments that looked spammy, or that linked to spammy web pages? E-mail spam filtering has come a long way, without captchas to hide behind.

I written to the website owner offering to do a port for ruby on rails. I think this clickcha will also cause curiosity in people and increase comments.

Edit: what's wrong with this?

Is English your first language?

Because if not you'll have a hard time understanding what I'm saying. (And if it is you have no excuse for the bad grammar.)

Basically you come across as (you sound like) a "cheerleader". You want him to hire you, so you are praising his software. But your praise is false, and doesn't add anything to the discussion.

Telling the whole world you want to do a ruby on rails port doesn't add anything to the discussion either.

English is not my first language, but I understand your point. I thought it was something nice after having read this page on his website: http://clickcha.com/faqs/

Thanks for the clarification, it indirectly helps me to understand both the culture and idioms of the english language.

Reply on news.ycombinator.com