From: Steven Lumos <steven@...>
Date: 2005-09-21T04:28:11+09:00
Subject: Re: Capcha in ruby

Austin Ziegler <halostatue@gmail.com> writes:

> On 9/19/05, Robbie Carlton <robbie.carlton@gmail.com> wrote:
>> But they stop the average spambot, which is what they're for I think.
>> The simplest accessible alternative would be email verification, but this
>> obviously slows the whole thing down.
>> Has anyone thought of an accessible alternative that can be embedded on the
>> page?
>
> Two things. First, they don't work against the average spambot of 2005
> or later. The average spambot of 2005 has gocr or something like that
> built in. (I'm using spambot because that's what you're using; what
> you're talking about is actually crawlers and registration bots.) The
> problem with CAPTCHA systems is that something complex enough to
> defeat a computer OCR system will be enough to lock out a significant
> portion of your potential users. Second, a lot of people *have*
> thought about it. I'm unimpressed with most solutions.

OCR isn't *that* easy. Humans--even young children--far exceed
machines in discerning even relatively clean machine-print characters.

> http://www.standards-schmandards.com/index.php?2005/01/01/11-captcha
> http://www.petefreitag.com/item/376.cfm
> http://www.w3.org/WAI/intro/captcha.php
> http://www.bestkungfu.com/archive/date/2005/01/captcha-state-of-the-union-2005/
> http://www.bestkungfu.com/?p=445

The research at Lehigh is interesting.

http://www.cse.lehigh.edu/~baird/research_hips.html

> Basically, my advice is to forget CAPTCHA and go with double
> verification. You can even provide multiple levels of user
> accessibility, allowing immediate access but nothing that could be
> construed as spam until they have verified their identity in some way
> that is accessible.
>
> -austin

I guess you're talking about email, but that is considerably less
difficult for a machine to pass than CAPTCHA.  Verifying that some
thing that gave you an email address has the ability to view messages
sent to that address doesn't prove much.

Steve

> Austin Ziegler * halostatue@gmail.com
>                * Alternate: austin@halostatue.ca