Very cool idea. It does seem faster than most captchas I've used. Would be cool to have the option of only one image, and be able to choose the answer in one click instead of via a drop-down menu. That would make it really fast (though probably less secure)
But more deserves to be said. A site like Hotmail is a big, focused target for spammers. They face pain if a bot can beat their CAPTCHA even 10% of the time. Smaller sites get spam too, but they generally get it from dumber bots looking for unprotected sites. A 2 panel peoplesign CAPTCHA is probably all they need.
With 2 panels at 6 labels each, a random guess has a 1/36 chance to pass. Fortunately, a large number of incorrect guesses is behavior that can be detected and blacklisted.
Futhermore, peoplesign can be customized to offer more security. Number of panels (and soon number of menu labels) and other characteristics can be modified. Check out a customization demo at http://peoplesign.com/main/pickTheLabelDemo.html
Thanks JJ. You are right about English literacy being useful to pass. Soon, I will expose an option that uses picture labels instead of natural language phrases.
But don't throw the proverbial baby out with the metaphorical bath water! The literacy requirement may be an effective defense against the armies of human sweatshop CAPTCHA solvers that we hear about in the news.
Regarding attacks, would be attackers have more important targets for now. peoplesign isn't yet protecting any major sites.
peoplesign images have been recolored using a "secret sauce" algorithm. Recoloring one of two similar pictures reduces effectiveness of color histogram matching. It even reduces effectiveness of more sophisticated color profile matching techniques. In short, the recoloration is defense against a particular type of attack.
Its true that a 2 panel peoplesign is slightly larger than most text-based CAPTCHAs. However, there will soon be an option to use only 1 panel, which will hopefully make it small enough even for space conscious sites.
If you draw the labels onto the image (make them each one word) and make the user type them, it's still an easy captcha for a person, but much harder for a bot.
If this spreads, it will be worth making a bot for, so that you can spam any of the sites that use it -- right now that bot just needs a few hits on average, and a slightly smarter bot can space them out, so that they are conceivably like commenters.
I found a misspelling in a label for a plane image. (The correct selection was 'striped plan' or something like that.)
Also, what turned out to be a hydrant looked to me like the leg of a moon lander. (I stared at that thing for a really long time, but I still saw the leg of a moon lander.)
Misspellings are deliberate and enhance security. Note that you still knew to pick the misspelled "striped plan" and passed. Another label for that picture might be "stryped plain".
Also, you correctly identified hydrant because "moon lander" fortunately was not one of the choices:)
I downloaded the PHP plugin, and applied for a private key to use the service. The key came immediately, and I've already added the captcha to my site So far I am impressed. http://www.backwardsparadigm.com
17 comments
[ 3.0 ms ] story [ 40.5 ms ] threadI know that in the past some captchas were broken at rates of 30-40% (Hotmail, I think). Is this really still the case?
But more deserves to be said. A site like Hotmail is a big, focused target for spammers. They face pain if a bot can beat their CAPTCHA even 10% of the time. Smaller sites get spam too, but they generally get it from dumber bots looking for unprotected sites. A 2 panel peoplesign CAPTCHA is probably all they need.
With 2 panels at 6 labels each, a random guess has a 1/36 chance to pass. Fortunately, a large number of incorrect guesses is behavior that can be detected and blacklisted.
Futhermore, peoplesign can be customized to offer more security. Number of panels (and soon number of menu labels) and other characteristics can be modified. Check out a customization demo at http://peoplesign.com/main/pickTheLabelDemo.html
Has this stood up to any bot attacks yet? What's the significance of the image discoloration?
But don't throw the proverbial baby out with the metaphorical bath water! The literacy requirement may be an effective defense against the armies of human sweatshop CAPTCHA solvers that we hear about in the news.
Regarding attacks, would be attackers have more important targets for now. peoplesign isn't yet protecting any major sites.
peoplesign images have been recolored using a "secret sauce" algorithm. Recoloring one of two similar pictures reduces effectiveness of color histogram matching. It even reduces effectiveness of more sophisticated color profile matching techniques. In short, the recoloration is defense against a particular type of attack.
If this spreads, it will be worth making a bot for, so that you can spam any of the sites that use it -- right now that bot just needs a few hits on average, and a slightly smarter bot can space them out, so that they are conceivably like commenters.
Also, what turned out to be a hydrant looked to me like the leg of a moon lander. (I stared at that thing for a really long time, but I still saw the leg of a moon lander.)
Also, you correctly identified hydrant because "moon lander" fortunately was not one of the choices:)
You're marketing. Not the time for balanced language.