Over the last years, most websites on which users can register (e.g., email providers and social networks) adopted CAPTCHAs (Completely Automated Public Turing test to tell Computers and Humans Apart) as a countermeasure against automated attacks. The battle of wits between designers and attackers of CAPTCHAs led to current ones being annoying and hard to solve for users, while still being vulnerable to automated attacks. In this paper, we propose CAPTCHaStar, a new image-based CAPTCHA that relies on user interaction. This novel CAPTCHA leverages the innate human ability to recognize shapes in a confused environment. We assess the effectiveness of our proposal for the two key aspects for CAPTCHAs, i.e., usability, and resiliency to automated attacks. In particular, we evaluated the usability, carrying out a thorough user study, and we tested the resiliency of our proposal against several types of automated attacks: traditional ones; designed ad-hoc for our proposal; and based on machine learning. Compared to the state of the art, our proposal is more user friendly (e.g., only some 35 of the users prefer current solutions, such as text-based CAPTCHAs) and more resilient to automated attacks.
A text-based CAPTCHA presents an obfuscated word in the form of an image, and asks the user to read and rewrite it, usually in a text box. @cite_28 proposed the first text-based CAPTCHA in 2002. After this first proposal, several other researchers worked on this kind of design. Several researchers focused on improving the resiliency against automated attacks @cite_26 @cite_0 @cite_44 . Currently, text-based CAPTCHAs are the most widely used @cite_36 . In the following, we report two examples of text-based CAPTCHAs that, as for CAPTCHaStar, do not require a keyboard to submit the answer: iCaptcha @cite_10 and DDIM-CAPTCHA @cite_22 .
@cite_26 @cite_22 @cite_28 @cite_36 @cite_44 @cite_0 @cite_10
2154261126 2016631059 2148425149 2105523261
Most commonly used CAPTCHAs are text-based CAPTCHAs which relay on the distortion of texts in the background image. With the development of automated computer vision techniques, which have been designed to remove noise and segment the distorted strings to make characters readable for OCR, traditional text-based CAPTHCAs are not considered safe anymore for authentication. A novel image based CAPTCHA which involves in solving a jigsaw puzzle is presented in this paper. An image is divided into an niAn (n=3, 4 or 5, depends on security level) pieces to construct the jigsaw puzzle CAPTCHA. Only two of the pieces are misplaced from their original positions. Users are required to find the two pieces and swap them. Considering the previous works which are devoted to solving jigsaw puzzles using edge matching technique, the edges of all pieces are processed with glitch treatment to prevent the computer automatic solving. Experiments and security analysis proved that human users can complete the CAPTCHA verification quickly and accurately, but computers rarely can. It is a promising substitution to the current text-based CAPTCHA. Over the past decade, text-based CAPTCHA (TBC) have become popular in preventing adversarial attacks and spam in many websites and applications including emails services, social platforms, web-based market places, and recommendation systems. However, in addition to several problems with TBC, it has become increasingly difficult to solve in recent years, to keep up with OCR technologies. Image-based CAPTCHA (IBC), on the other hand, is a relatively new concept that promises to overcome key limitations of TBC. In this paper we present an innovative IBC, DeepCAPTCHA, based on design guidelines, psychological theory and empirical experiments. DeepCAPTCHA exploits the human ability of depth preception. In our IBC users should arrange 3D objects in terms of size (or depth). In our framework for DeepCAPTCHA, we automatically mine 3D models, and use a human-machine Merge Sort algorithm to order these unknown objects. We then create new appearances for these objects at multiplication factor of 200, and present these new images to the end-users for sorting (as CAPTCHA tasks). Humans are able to apply their rapid and reliable object recognition and comparison (arise from years experience with the physical environment) to solve DeepCAPTCHA, while machines are still unable to complete these tasks. Experimental results show that humans can solve DeepCAPTCHA with a high accuracy ( 84 ) and ease, while machines perform dismally. CAPTCHA (Completely Automated Public Turing Test to Tell Computers and Humans Apart) is a simple test that is easy for humans but extremely difficult for computers to solve. CAPTCHA has been widely used in commercial websites such as web-based email providers, TicketMaster, GoDaddy, and Facebook to protect their resources from attacks initiated by automatic scripts. By design, CAPTCHA is unable to distinguish between a human attacker and a legitimate human user. This leaves websites using CAPTCHA vulnerable to 3rd party human CAPTCHA attacks. In order to demonstrate the vulnerabilities in existing CAPTCHA technologies we develop a new streamlined human-based CAPTCHA attack that uses Instant Messenger infrastructure. Facing this serious human-based attack threat, we then present a new defense system called Interactive CAPTCHA (iCAPTCHA), which is the next generation of CAPTCHA technology providing the first steps toward defending against 3rd party human CAPTCHA attacks. iCAPTCHA requires a user to solve a CAPTCHA test via a series of user interactions. The multi-step back-and-forth traffic between client and server amplifies the statistical timing difference between a legitimate user and a human solver, which enables better attack detection performance. A performance and usability study of iCAPTCHA shows the proposed scheme is effective in attack detection, is easy to use, and is a viable replacement of the current text-based CAPTCHA. We carry out a systematic study of existing visual CAPTCHAs based on distorted characters that are augmented with anti-segmentation techniques. Applying a systematic evaluation methodology to 15 current CAPTCHA schemes from popular web sites, we find that 13 are vulnerable to automated attacks. Based on this evaluation, we identify a series of recommendations for CAPTCHA designers and attackers, and possible future directions for producing more reliable human computer distinguishers.