Hacker News Reader

Comment by tylermenezes | Hacker News Reader

(3) is only secure if no one bothers to write a bot for your site. It would be trivial to do so, however.

I admit that I have only thought about this for a minute or two but I am thinking of something a little more complex than a hard coded image.

More like: Hit submit when a picture of a dog is shown in the slideshow, if its a cat, your comment will be denied. And these images of dogs and cats would be picked randomly by the server from a google image search (...or something). The vulnerability so far is that a bot could just keep trying until it got in but I'm sure a crafty programmer could come up with an attempt limiter.

Still a half-baked idea, but the tech does offer some interesting possibilities. I particularly like that this may work when AJAX/JS is disabled or otherwise not an option.

I worked on CAPTCHAs at Microsoft Research in a past life, and I can tell you, most original forms won't work. In the case of the one you described, I as an attacker can just put it through Tin Eye to find the original, and then do some semantic analysis on the page containing the image, or event just the URL, to figure it out. I have working code for this as a proof of concept for Microsoft's Kitten Auth.

If that is the best attack on my idea, then I'd say that's pretty good! A spammer would have to target the site specifically (for tailor-made script) and parse an animated gif into individual images, then send every image into Tin Eye (which is awesome but the API isn't free right?).

That said, I am a complete amateur at captcha design. Cool research though and I bet a lot of HN'ers would be interested in your PoC if you haven't already submitted it.

Reply on news.ycombinator.com