A few weeks ago I blogged that it sure looked like spammers had broken the CAPTCHA for Windows Live (Hotmail), Yahoo and Gmail. The evidence was circumstantial in that I was seeing a lot more spam from these services.
Over the past couple of weeks I have read a few articles confirming my suspicions. While spammers cannot solve 100% of these Human Interactive Proofs, they can still automate the process using a bot which is, in effect, breaking these security devices. In other words, the equivalent of solving 10% of the HIPs is from a security standpoint, completely broken.
So where do we go from here? Knowing that the anti-bot device is broken, what do we do? Here are some options that I can think of:
Those are the ones I can think of. I'm not involved in HIPs or CAPTCHAs at all, but I would think that some of the above theories would be a place to start.
PingBack from http://education.blogslog.info/?p=32039
Theoretically lockouts would help but practice isn't so clear.
Before BRNIC's whois information was integrated into LACNIC it was necessary to use BRNIC's site. At some point BRNIC added a CAPTCHA where the user had to input all the consonants or all the vowels, and definitely not all the letters being shown. Since I don't know much Portugese I failed several CAPTCHAs in a row before figuring out what they were asking for. There was no lockout so eventually I got the whois data of the spamming ISP.
If a CAPTCHA distinguishes humans from bots then maybe lockouts could be done after three failures. If a CAPTCHA distinguishes some language versions of humans from other language versions of humans then lockouts will only help spammers.
Would it be worth considering some different variation on the cats vs dogs idea? I recognise what you're saying with regards to how things might be handled in other countries. One thing you'd need to overcome with this is the language barrier.
Would it be worth looking at taking a list of categories and then picking two? So your categories might include:
Instead of cats and dogs, you might get cats and buildings - it's my feeling that this would be more obvious to some degree, but I don't think the variation/extension I've suggested above is anywhere near an ideal solution to the problem.