Assignment No.

A Seminar Report On
CAPTCHA
(Completely Automated Public Turing test

to tell Computers and Humans Apart)

 A CAPTCHA is a program that protects websites against bots by generating and grading
tests that humans can pass but current computer programs cannot. For example, humans can
read distorted text as the one shown below, but current computer programs can't:

A CAPTCHA or Captcha is a type of challenge-response test used in computing to ensure

that the response is not generated by a computer. The process usually involves one computer
(a server) asking a user to complete a simple test which the computer is able to generate and
grade. Because other computers are unable to solve the CAPTCHA, any user entering a correct
solution is presumed to be human. Thus, it is sometimes described as a reverse Turing test,
because it is administered by a machine and targeted to a human, in contrast to the standard
Turing test that is typically administered by a human and targeted to a machine. A common
type of CAPTCHA requires that the user type letters or digits from a distorted image that
appears on the screen.

The term "CAPTCHA" (based upon the word capture) was coined in 2000 by Luis von
Ahn, Manuel Blum, Nicholas J. Hopper (all of Carnegie Mellon University), and John Langford
(then of IBM). It is a contrived acronym for "Completely Automated Public Turing test to tell
Computers and Humans Apart." Carnegie Mellon University attempted to trademark the term,
but the trademark application was abandoned on 21 April 2008. Currently, CAPTCHA creators
recommend use of reCAPTCHA as the official implementation.

History

Moni Naor was the first person to theorize a list of ways to verify that a request comes
from a human and not a bot. Primitive CAPTCHAs seem to have been developed in 1997 by
Andrei Broder, Martin Abadi, Krishna Bharat, and Mark Lillibridge to prevent bots from adding
URLs to their search engine. In order to make the images resistant to OCR (Optical Character
Recognition), the team simulated situations that scanner manuals claimed resulted in bad OCR.
In 2000, Luis von Ahn and Manuel Blum coined the term 'CAPTCHA', improved and publicized
the notion, which included any program that can distinguish humans from computers. They
invented multiple examples of CAPTCHAs, including the first CAPTCHAs to be widely used,
which were those adopted by Yahoo!.
Applications of CAPTCHAs
CAPTCHAs have several applications for practical security, including (but not limited to):

• Preventing Comment Spam in Blogs -

Most bloggers are familiar with programs that submit bogus comments, usually
for the purpose of raising search engine ranks of some website (e.g., "buy penny stocks
here"). This is called comment spam. By using a CAPTCHA, only humans can enter
comments on a blog. There is no need to make users sign up before they enter a
comment, and no legitimate comments are ever lost!

• Protecting Website Registration –

Several companies (Yahoo!, Microsoft, etc.) offer free email services. Up until a
few years ago, most of these services suffered from a specific type of attack: "bots" that
would sign up for thousands of email accounts every minute. The solution to this
problem was to use CAPTCHAs to ensure that only humans obtain free accounts. In
general, free services should be protected with a CAPTCHA in order to prevent abuse by
automated scripts.

• Protecting Email Addresses From Scrapers –

Spammers crawl the Web in search of email addresses posted in clear text.
CAPTCHAs provide an effective mechanism to hide your email address from Web
scrapers. The idea is to require users to solve a CAPTCHA before showing your email
address. A free and secure implementation that uses CAPTCHAs to obfuscate an email
address can be found at reCAPTCHA MailHide.

• Online Polls –

In November 1999, http://www.slashdot.org released an online poll asking

“Which is the best graduate school in computer science?” (a dangerous question to ask
over the web!). As is the case with most online polls, IP addresses of voters were
recorded in order to prevent single users from voting more than once. However,
students at Carnegie Mellon found a way to stuff the ballots using programs that voted
for CMU thousands of times. CMU's score started growing rapidly. The next day,
students at MIT wrote their own program and the poll became a contest between voting
"bots." MIT finished with 21,156 votes, Carnegie Mellon with 21,032 and every other
school with less than 1,000. Can the result of any online poll be trusted? Not unless the
poll ensures that only humans can vote.
• Preventing Dictionary Attacks –

CAPTCHAs can also be used to prevent dictionary attacks in password systems.

The idea is simple: prevent a computer from being able to iterate through the entire
space of passwords by requiring it to solve a CAPTCHA after a certain number of
unsuccessful logins. This is better than the classic approach of locking an account after a
sequence of unsuccessful logins, since doing so allows an attacker to lock accounts at
will.

• Search Engine Bots –

It is sometimes desirable to keep webpages unindexed to prevent others from

finding them easily. There is an html tag to prevent search engine bots from reading
web pages. The tag, however, doesn't guarantee that bots won't read a web page; it
only serves to say "no bots, please." Search engine bots, since they usually belong to
large companies, respect web pages that don't want to allow them in. However, in order
to truly guarantee that bots won't enter a web site, CAPTCHAs are needed.

• Worms and Spam –

CAPTCHAs also offer a plausible solution against email worms and spam: "I will
only accept an email if I know there is a human behind the other computer." A few
companies are already marketing this idea.
Creating a CAPTCHA-
The first step to creating a CAPTCHA is to look at the different ways humans and
machines process information. Machines follow sets of instructions. If something falls outside
the realm of those instructions, the machine isn't able to compensate. A CAPTCHA designer has
to take this into account when creating a test. For example, it's easy to build a program that
looks at metadata -- the information on the Web that's invisible to humans but machines can
read. If you create a visual CAPTCHA and the image's metadata includes the solution, your
CAPTCHA will be broken in no time.

Similarly, it's unwise to build a CAPTCHA that doesn't distort letters and numbers in
some way. An undistorted series of characters isn't very secure. Many computer programs can
scan an image and recognize simple shapes like letters and numbers.

One way to create a CAPTCHA is to pre-determine the images and solutions it will use.
This approach requires a database that includes all the CAPTCHA solutions, which can
compromise the reliability of the test. According to Microsoft Research experts Kumar
Chellapilla and Patrice Simard, humans should have an 80 percent success rate at solving any
particular CAPTCHA, but machines should only have a 0.01 success rate. If a spammer managed
to find a list of all CAPTCHA solutions, he or she could create an application that bombards the
CAPTCHA with every possible answer in a brute force attack. The database would need more
than 10,000 possible CAPTCHAs to meet the qualifications of a good CAPTCHA.

Other CAPTCHA applications create random strings of letters and numbers. You aren't
likely to ever get the same series twice. Using randomization eliminates the possibility of a
brute force attack -- the odds of a bot entering the correct series of random letters are very
low. The longer the string of characters, the less likely a bot will get lucky.

CAPTCHAs take different approaches to distorting words. Some stretch and bend letters
in weird ways, as if you're looking at the word through melted glass. Others put the word
behind a crosshatched pattern of bars to break up the shape of the letters. A few use different
colors or a field of dots to achieve the same effect. In the end, the goal is the same: to make it
really hard for a computer to figure out what's in the CAPTCHA.

Designers can also create puzzles or problems that are easy for humans to solve. Some
CAPTCHAs rely on pattern recognition and extrapolation. For example, a CAPTCHA might
include a series of shapes and ask the user which shape among several choices would logically
come next. The problem with this approach is that not all humans are good with these kinds of
problems and the success rate for a human user can drop below 80 percent.

Next, we'll take a look at how computers can break CAPTCHAs.

Breaking a CAPTCHA-
The challenge in breaking a CAPTCHA isn't figuring out what a message says -- after all,
humans should have at least an 80 percent success rate. The really hard task is teaching a
computer how to process information in a way similar to how humans think. In many cases,
people who break CAPTCHAs concentrate not on making computers smarter, but reducing the
complexity of the problem posed by the CAPTCHA.

Let's assume you've protected an online form using a CAPTCHA that displays English
words. The application warps the font slightly, stretching and bending the letters in
unpredictable ways. In addition, the CAPTCHA includes a randomly generated background
behind the word.

A programmer wishing to break this CAPTCHA could approach the problem in phases.
He or she would need to write an algorithm -- a set of instructions that directs a machine to
follow a certain series of steps. In this scenario, one step might be to convert the image in
grayscale. That means the application removes all the color from the image, taking away one of
the levels of obfuscation the CAPTCHA employs.

Next, the algorithm might tell the computer to detect patterns in the black and white
image. The program compares each pattern to a normal letter, looking for matches. If the
program can only match a few of the letters, it might cross reference those letters with a
database of English words. Then it would plug in likely candidates into the submit field. This
approach can be surprisingly effective. It might not work 100 percent of the time, but it can
work often enough to be worthwhile to spammers.
 The Gimpy CAPTCHA displays 10 words, but you only have to type three in correctly to pass the test.

What about more complex CAPTCHAs? The Gimpy CAPTCHA displays 10 English words
with warped fonts across an irregular background. The CAPTCHA arranges the words in pairs
and the words of each pair overlap one another. Users have to type in three correct words in
order to move forward. How reliable is this approach?

As it turns out, with the right CAPTCHA-cracking algorithm, it's not terribly reliable. Greg
Mori and Jitendra Malik published a paper detailing their approach to cracking the Gimpy
version of CAPTCHA. One thing that helped them was that the Gimpy approach uses actual
words rather than random strings of letters and numbers. With this in mind, Mori and Malik
designed an algorithm that tried to identify words by examining the beginning and end of the
string of letters. They also used the Gimpy's 500-word dictionary.

Mori and Malik ran a series of tests using their algorithm. They found that their
algorithm could correctly identify the words in a Gimpy CAPTCHA 33 percent of the time
[source: Mori and Malik]. While that's far from perfect, it's also significant. Spammers can
afford to have only one-third of their attempts succeed if they set bots to break CAPTCHAs
several hundred times every minute.

Accessibility-
Because CAPTCHAs rely on visual perception, users unable to view a CAPTCHA (for
example, due to a disability or because it is difficult to read) will be unable to perform the task
protected by a CAPTCHA. Therefore, sites implementing CAPTCHAs may provide an audio
version of the CAPTCHA in addition to the visual method. The official CAPTCHA site
recommends providing an audio CAPTCHA for accessibility reasons. This combination
represents the most accessible CAPTCHA currently known to exist.

Attempts at more accessible CAPTCHAs Even an audio and visual CAPTCHA will require
manual intervention for some users, such as those who have visual disabilities and also are
deaf. There have been various attempts at creating CAPTCHAs that are more accessible.
Attempts include the use of JavaScript, mathematical questions ("what is 1+1"), or "common
sense" questions ("what color is the sky on a clear day"). However they do not meet both the
criteria of being able to be automatically generated and not relying on the type of CAPTCHA
being new to the attacker.

Conclusion-
In this way, we have seen that the CAPTCHA is very useful in terms of security purpose,
spammers and other things. So, we can use “CAPTCHA” in our website to avoid these things.