Pitfalls in CAPTCHA design and implementation: The Math CAPTCHA, a case study

Computers and Security

Volumn 29, Issue 1, 2010, Pages 141-157

  Hernandez Castro, Carlos Javier ^a   Ribagorda, Arturo ^a  

^a UNIVERSIDAD CARLOS III DE MADRID   (Spain)

Author keywords

CAPTCHA; Design flaw; Design pitfall; Implementation flaw; Math; OCR; QRBGS; Side channel

Indexed keywords

BLACK BOXES; CAPTCHAS; DESIGN FLAW; DESIGN FLAWS; MATHEMATICAL PROBLEMS; SIDE CHANNEL ATTACK; SIDE-CHANNEL;

ARTIFICIAL INTELLIGENCE; CHARACTER RECOGNITION;

DESIGN;

EID: 71649100675     PISSN: 01674048     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.cose.2009.06.006     Document Type: Article

References (17)

1. Ahn Luis von, Dabbish Laura. Labeling Images with a Computer Game. ACM Conference on Human Factors in Computing Systems. CHI; 2004. p. 319-26.
2. Ahn L.v., Blum M., Hopper N.J., and Langford J. CAPTCHA: using hard AI problems for security. Advances in cryptology - EUROCRYPT 2003, international conference on the theory and applications of cryptographic techniques, Warsaw, Poland, May 4-8, 2003 (2003), Springer 294-311 Proceedings, volume 2656 of Lecture Notes in Computer Science
3. Chellapilla K, Larson K, Simard PY, Czerwinski M. Computers beat humans at single character recognition in reading based Human Interaction Proofs (HIPs). In: Proceedings of the Conference on Email and Anti-Spam (CEAS); 2005.
4. Chew M., and Tygar J.D. Image recognition CAPTCHAs. Proceedings of the 7th international information security conference (ISC 2004) (September 2004), Springer 268-279 A longer version appeared as UC Berkeley Computer Science Division technical report UCB/CSD-04-1333, June 2004
5. Datta Ritendra, Li Jia, Wang James Z. IMAGINATION: a robust image-based CAPTCHA generation system. In: Proceedings of ACM Multimedia Conference; 2005. p. 331-4.
6. Elson J., Douceur J.R., Howell J., and Saul J. Asirra: a CAPTCHA that exploits interest-aligned manual image categorization. Proceedings of 14th ACM conference on Computer and Communications Security (CCS) (Oct. 2007), Association for Computing Machinery, Inc.
7. Golle Phillipe. Machine learning attacks against the asirra CAPTCHA. In: Proceedings of the ACM computer and communications security conference; 2008.
8. Hernandez-Castro Julio Cesar, Sierra J.M., Hernandez-Castro Carlos Javier, Ribagorda Arturo. Compulsive voting. Proceedings of the 36th annual 2002 international carnahan conference on security technology; 2002. pp. 124-133.
9. Hernandez-Castro Carlos Javier, Ribagorda Arturo, Saez Yago. Side-channel attack on labeling CAPTCHAs. Unpublished manuscript; 2009. Available electronically at: http://arxiv.org/abs/0908.1185.
10. Mori G., and Malik J. Recognizing objects in adversarial clutter: breaking a visual CAPTCHA. Conference on Computer Vision and Pattern Recognition (CVPR 03) (2003), IEEE Computer Society 134-141
11. Naor M. Verification of a human in the loop or identification via the turing test (July, 1996). http://www.wisdom.weizmann.ac.il/naor/PAPERS/human.ps [accessed 01.01.09]
12. NewScientist entry on the QRBGS CAPTCHA. http://www.newscientist.com/blog/technology/2007/08/prove-youre-human-do-math.html
13. Stevanovic R., Topic G., Skala K., Stipcevic M., and Rogina B.M. Quantum random bit generator service for Monte Carlo and other stochastic simulations. In: Lirkov I., Margenov S., and Wasniewski J. (Eds). Lecture Notes in Computer Science vol. 4818 (2008), Springer-Verlag, Berlin Heidelberg 508-515
14. Techworld.com article on fallen CAPTCHAS. https://www.techworld.com.au/article/253015/how_captcha_got_trashed?pp=3
15. US Patent no. 6,195,698, method for selectively restricting access to computer systems. http://www.freepatentsonline.com/6195698.html
16. Warner O. Kittenauth. http://www.thepcspy.com/kittenauth
17. Wieser W. Captcha recognition via averaging. http://www.triplespark.net/misc/captcha/