Posted at: 2:33 PM by Marianna
CAPTCHA (contrived acronym for: Completely Automated Public Turing test to tell Computers and Humans Apart) is a program test used in computing to protect websites against web robots by generating and grading tests that humans can pass but current computer programs cannot (captcha.net).
One of the main reasons websites use CAPTCHA is to prevent spambots to create numerous accounts through sign up forms. Other applications of CAPTCHA are:
- Preventing Comment Spam in Blogs
- Protecting E-mail Addresses from Scrapers
- Ensuring the validation of Online Polls results
- Preventing Dictionary Attacks in password systems
- Search Engine Bots
- Preventing E-mail Worms and Spam (source: captcha.net)
Though it is a useful tool for developers not all CAPTCHA are designed to be user friendly or even accessible from users who are blind, have low vision, or have a learning disability such as dyslexia. Example:
Picture 1 : Hard to read the letters due to colorful background (forums.steampowered.com)
Recommended guidelines for any CAPTCHA code:
- Accessibility. CAPTCHA's must be accessible. CAPTCHA's based solely on reading text or other visual-perception tasks prevent visually impaired users from accessing the protected resource. Any implementation of a CAPTCHA should allow blind users to get around the barrier, for example, by permitting users to opt for an audio or sound CAPTCHA.
- Image Security. CAPTCHA images of text should be distorted randomly before being presented to the user. Many implementations of CAPTCHA's use undistorted text, or text with only minor distortions. These implementations are vulnerable to simple automated attacks.
- Script Security. Building a secure CAPTCHA code is not easy. In addition to making the images unreadable by computers, the system should ensure that there are no easy ways around it at the script level.
- Security Even After Wide-Spread Adoption. There are various "CAPTCHAs" that would be insecure if a significant number of sites started using them. An example of such a puzzle is asking text-based questions, such as a mathematical question ("what is 1+1"). Since a parser could easily be written that would allow bots to bypass this test, such "CAPTCHAs" rely on the fact that few sites use them, and thus that a bot author has no incentive to program their bot to solve that challenge. True CAPTCHAs should be secure even after a significant number of websites adopt them. (source: captcha.net)
Good examples of CAPTCHA:
Picture 2: CAPTCHA with audio option (digg register form)
Picture 3: CAPTCHA with not case-sensitive letters and help for disabled (gmail sign-up form)
Picture 4: CAPTCHA with refresh button (my space form)
The CAPTCHA used in the World usability day website complies with all the guidelines mentioned earlier.
Picture 5: The website has audio CAPTCHA option for blind users / ability to refresh the CAPTCHA in case user does not find it easy to read / help section (world usability day account)
However the W3C group published an article in 2005 about the inaccessibility of CAPTCHA considering that they should not be used as there are other ways (spam filtering and/or heuristic checks) to spam control. Among their arguments were:
CAPTCHA using logic puzzles with mathematical equations prevent users with cognitive disabilities to register. Example:
Picture 6: CAPTCHA with logic test (Quantum Random Bit Generator Service: Sign up)
·Users who are deaf-blind, don't have or use a sound card, work in noisy environments, or don't have required sound plugins are likewise left in the lurch. Since this content is auditory in nature, users often have to write down the code before entering it, which is very inconvenient. Worst of all, some implementations of this technique are JavaScript-based, or designed in such a way that some blind users may not be able to access them.
·External projects such as BREAKING, AICAPTCHA and PWNTCHA have shown methodologies and results indicating that many of the systems can be defeated by computers with between 88% and 100% accuracy, using optical character recognition.
CAPTCHA should be used only where is necessary and mainly in large websites. It is advisable smaller websites to use other mechanisms to prevent spam. When used, the developers should make sure they are accessible from different categories of users.
What's your opinion about CAPTCHA? Are there any good or bad examples you came across lately?
Labels: accessibility, CAPTCHA, experience, guidelines