[Infowarrior] - Codes on Sites 'Captcha' Anger of Web Users

[Richard Forno]

Codes on Sites 'Captcha' Anger of Web Users
By DAVID KESMODEL
May 31, 2006; Page B1
http://online.wsj.com/public/article/SB114903737427467003-BFXQeLeq3RdZ5Icuyb
8gkda47DA_20070530.html?mod=blogs

Dave Simmer is a computer-savvy graphic designer. Yet when he surfs the
Internet, he often gets stumped by the distorted jumbles of letters and
numbers that some Web sites ask users to retype to gain access.

"They keep warping them and making them longer," says the 40-year-old from
Cashmere, Wash.

The visually impaired have long decried these codes, which protect sites
such as Yahoo.com and Ticketmaster.com from computer programs that create
scores of email accounts for spammers or buy hundreds of concert tickets for
scalpers. Now, the quizzes are irritating a wider array of Web surfers as
companies toughen them as part of their arms race with the spam crowd.

The codes, called captchas, are also showing up more often amid a boom in
new Web services, ranging from blogging tools to social-networking sites.
The trickiest ones "make you not want to go to those sites anymore," says
Scott Reynolds, a 29-year-old software architect in Ocala, Fla., who
lambasted the devices on his blog last year.
[Captcha Examples]

The captchas' flaws are prompting academics, independent computer
programmers and some Web companies to craft new variations that they hope
will be easier for humans to decipher but harder for computer programs. The
World Wide Web Consortium, an international group that encourages improved
standards for Web programming, published a paper last November that
advocates the creation of alternatives, saying the tests "fail to properly
recognize users with disabilities as human" and are vulnerable to defeat by
astute programmers.

Internet companies defend their use of the codes, saying they face a
difficult balancing act of trying to fend off attackers while providing a
good experience for users. "We know there's no perfect panacea, but we think
this is a great tool to prevent malicious activity," says David Jeske, an
engineering director at Google Inc. Google uses captchas for its free email
service and its blog-writing service, among others. It is among companies
that recently added an audio version, which lets the visually impaired
listen to a series of letters or numbers and type them into their computer.

Some captchas have been solved with more than 90% accuracy by scientists
specializing in computer vision research at the University of California,
Berkeley, and elsewhere. Hobbyists also regularly write code to solve
captchas on commercial sites with a high degree of accuracy.

But several Internet companies say their captchas appeared to be highly
effective at thwarting spammers. "Researchers are really good, and the
attackers really are not," says Mr. Jeske of Google, based in Mountain View,
Calif. "Having these methods in place we find extremely effective against
automated malicious attackers."

Ticketmaster, a unit of IAC/Interactive Corp., has altered its captchas over
the years in response to automated computer programs, called "bots," that
have cracked certain codes, says Brian Pike, Ticketmaster's chief technology
officer. He says the robust resale market for tickets gives people a high
incentive to try to swiftly snare tickets on its site.

Spam companies sometimes get around the challenge of captchas by hiring
workers to fill out the forms for them instead of relying on bots, according
to the World Wide Web Consortium. The group said in its paper last year that
"it is a logical fallacy...to hail captcha as a spam-busting panacea."

Captcha is an acronym for Completely Automated Public Turing Test to Tell
Computers and Humans Apart. Computer scientists at Carnegie Mellon
University coined the term in 2000 to describe codes they created to help
Internet giant Yahoo Inc. thwart a spam problem. "Turing" refers to Alan
Turing, a mathematician famous for his codebreaking work during World War II
and, later, as a pioneer in artificial intelligence. In 1950, Turing wrote a
paper that proposed a test in which a person in one room would ask questions
of both a human and a computer in another to try to determine which of the
respondents was human. If the judge couldn't tell which was which, the
computer could be said to be able to think.

Captchas deployed by commercial Web sites vary widely. For example,
Microsoft Corp.'s Hotmail email service requires registrants to read a long
series of twisted letters or numbers, obscured by several lines of varying
shape. In contrast, eBay Inc.'s PayPal payment service shows simple
block-style letters or numbers against a grid. Other sites use complex
multicolored backgrounds.

Mr. Reynolds, the Florida software architect, says he has been confused by
captchas shown by everyone from Microsoft to Apple Computer Inc. "The ones
they make hard for a computer bot to break are also really hard for us to
read," he says. "It kind of defeats the purpose."

Henry Baird, a professor of computer science at Lehigh University who
studies PC users' responses to the codes, has been working with colleagues
to develop new generations of captchas that are designed to be easier on
humans but baffling for computers. One, called "scattertype," shatters each
letter shown to users into pieces.

Some Internet companies have changed their captchas to make them simpler for
users. Digg.com, a news Web site, changed the background to gray from
multicolored earlier this year and now allows users to type in either
capital or lower-case versions of the letters, says Steve Williams, a
computer programmer for the company.

The difficulty of deciphering the visual codes is prompting even those who
don't have a vision problem to begin clicking audio captchas whenever sites
make them available. A growing number of sites, including Hotmail.com and
PayPal.com, offer audio captchas. Google added it for its email service in
March and for its blogging and Google Groups service in April.
(Alternatively, some Web sites urge users having trouble to call a phone
number for customer service or send an email to the company.)

The World Wide Web Consortium is urging programmers to devise viable
alternatives to visual captchas because they affect people with a wide range
of disabilities, including people with dyslexia and short-term memory
problems, says Judy Brewer, director of the group's Web Accessibility
Initiative, who is based in Cambridge, Mass. Captchas, "in their current
form, are a misnomer," she says. They "don't tell humans and computers
apart; instead, they tell able-bodied humans and computers, along with
disabled humans, apart."

Some Web sites and independent computer programmers have rolled out new
types of captchas. They generally involve solving simple equations or
answering simple questions and could be adapted for use by the blind,
although they would still present problems for people with learning
disabilities.

Write to David Kesmodel at david.kesmodel at wsj.com