Over the last years, most websites on which users can register (e.g., email providers and social networks) adopted CAPTCHAs (Completely Automated Public Turing test to tell Computers and Humans Apart) as a countermeasure against automated attacks. The battle of wits between designers and attackers of CAPTCHAs led to current ones being annoying and hard to solve for users, while still being vulnerable to automated attacks. In this paper, we propose CAPTCHaStar, a new image-based CAPTCHA that relies on user interaction. This novel CAPTCHA leverages the innate human ability to recognize shapes in a confused environment. We assess the effectiveness of our proposal for the two key aspects for CAPTCHAs, i.e., usability, and resiliency to automated attacks. In particular, we evaluated the usability, carrying out a thorough user study, and we tested the resiliency of our proposal against several types of automated attacks: traditional ones; designed ad-hoc for our proposal; and based on machine learning. Compared to the state of the art, our proposal is more user friendly (e.g., only some 35 of the users prefer current solutions, such as text-based CAPTCHAs) and more resilient to automated attacks.
Image-based CAPTCHAs usually ask the user to recognize an image or to interact with on-screen objects to find a solution. Unlike text-based CAPTCHAs, every image-based design is substantially different from each other. For this reason, a user who faces a CAPTCHA design for the first time needs a little more effort to understand how it works. Studies suggest that image-based CAPTCHAs are more appreciated by users @cite_15 . Indeed, image-based CAPTCHAs usually have a high success rate and they are less challenging than text-based ones @cite_17 . In the following, we report some examples of image-based CAPTCHA that we could group in three sub-categories: static, motion, and interactive.
@cite_15 @cite_17
2105598383 2016631059 2154261126 2148425149
Some Internet Web sites for providing services to their customers, ask them to register in the Web site. Unfortunately hackers write programs to make automatic false enrollments which waste the Web site's resources. To solve this problem, systems known as CAPTCHA (completely automated public Turing test to tell computers and humans apart) have been introduced to distinguish between human user and computer program. One of the CAPTCHA methods is collage CAPTCHA. In this method some shapes are shown with distortion and the user is asked to choose a specific object. In this paper we increase the resistance of this method to attacks. For this purpose, we also show some other objects on the right of the screen. Some of these objects are same as the previous objects, but have the different shapes. Now we ask the user to choose a specific object and also its same object on the right of the screen. The user will be passed the test if he chooses the two similar objects correctly. In this method because the computer program should also recognize the similar object, the possibility of passing the test by computer is more reduced. Over the past decade, text-based CAPTCHA (TBC) have become popular in preventing adversarial attacks and spam in many websites and applications including emails services, social platforms, web-based market places, and recommendation systems. However, in addition to several problems with TBC, it has become increasingly difficult to solve in recent years, to keep up with OCR technologies. Image-based CAPTCHA (IBC), on the other hand, is a relatively new concept that promises to overcome key limitations of TBC. In this paper we present an innovative IBC, DeepCAPTCHA, based on design guidelines, psychological theory and empirical experiments. DeepCAPTCHA exploits the human ability of depth preception. In our IBC users should arrange 3D objects in terms of size (or depth). In our framework for DeepCAPTCHA, we automatically mine 3D models, and use a human-machine Merge Sort algorithm to order these unknown objects. We then create new appearances for these objects at multiplication factor of 200, and present these new images to the end-users for sorting (as CAPTCHA tasks). Humans are able to apply their rapid and reliable object recognition and comparison (arise from years experience with the physical environment) to solve DeepCAPTCHA, while machines are still unable to complete these tasks. Experimental results show that humans can solve DeepCAPTCHA with a high accuracy ( 84 ) and ease, while machines perform dismally. Most commonly used CAPTCHAs are text-based CAPTCHAs which relay on the distortion of texts in the background image. With the development of automated computer vision techniques, which have been designed to remove noise and segment the distorted strings to make characters readable for OCR, traditional text-based CAPTHCAs are not considered safe anymore for authentication. A novel image based CAPTCHA which involves in solving a jigsaw puzzle is presented in this paper. An image is divided into an niAn (n=3, 4 or 5, depends on security level) pieces to construct the jigsaw puzzle CAPTCHA. Only two of the pieces are misplaced from their original positions. Users are required to find the two pieces and swap them. Considering the previous works which are devoted to solving jigsaw puzzles using edge matching technique, the edges of all pieces are processed with glitch treatment to prevent the computer automatic solving. Experiments and security analysis proved that human users can complete the CAPTCHA verification quickly and accurately, but computers rarely can. It is a promising substitution to the current text-based CAPTCHA. CAPTCHA (Completely Automated Public Turing Test to Tell Computers and Humans Apart) is a simple test that is easy for humans but extremely difficult for computers to solve. CAPTCHA has been widely used in commercial websites such as web-based email providers, TicketMaster, GoDaddy, and Facebook to protect their resources from attacks initiated by automatic scripts. By design, CAPTCHA is unable to distinguish between a human attacker and a legitimate human user. This leaves websites using CAPTCHA vulnerable to 3rd party human CAPTCHA attacks. In order to demonstrate the vulnerabilities in existing CAPTCHA technologies we develop a new streamlined human-based CAPTCHA attack that uses Instant Messenger infrastructure. Facing this serious human-based attack threat, we then present a new defense system called Interactive CAPTCHA (iCAPTCHA), which is the next generation of CAPTCHA technology providing the first steps toward defending against 3rd party human CAPTCHA attacks. iCAPTCHA requires a user to solve a CAPTCHA test via a series of user interactions. The multi-step back-and-forth traffic between client and server amplifies the statistical timing difference between a legitimate user and a human solver, which enables better attack detection performance. A performance and usability study of iCAPTCHA shows the proposed scheme is effective in attack detection, is easy to use, and is a viable replacement of the current text-based CAPTCHA.