Captcha security out of hand...

[Dave S]

I sometimes wonder if the security that some companies use has not got "out of hand", I'm talking about the little box at the bottom of their contact pages. This little box is sometimes so illegible that you need to make a million attempts before you get it right . The instruction stipulates that this is "case sensitive" and spacing is critical.

As one who wears glasses, I can barely see the smaller digits, let alone decide if they are upper or lower case, and how many spaces are in between them, as a result, this company will not see my business, simply because I can't contact them!

Surely there has to be a better way to stop the bogies getting through?

[HR Solutions]

lol ... I thought I was the only one

[ghostwriter]

look for the audio option if they have one

[ians]

ditto, I had the same problem yesterday trying to reset my password for a forum, it 7 of the 9 attempts available.

[AndyD]

They might as well dump these things nowadays as most the well written bots can decypher them.

[Dave S]

This particular site did not list any alternate contact number or e-mail address, the only way to contact them was to leave a message on their site and they would contact you. Then they put in this little "Bot Stopper", with no "audio" or "Change the image" option. After 7 attempts, I gave up.

[Dave A]

Years ago I had a task of typing up the constitution of an organisation from a hard copy version. The problem was it was a copy of a copy of a copy... and it was pretty much illegible. The theory was that because I had a rough idea as to what should be in there, I'd be able to decipher it. But it was hopeless.

So in desperation I ran it through an optical character recognition (OCR) program, which at that stage were at a very early stage of development. And blow me down, the OCR produced the goods with startling accuracy.

[mansuri123]

yes, There are plenty of options available. Like you can ask easy question, select image which name given below that kind of authentications are available. I think they are more easy to solve and stop bogies.

[adrianh]

I agree, the stupid things only serve to annoy me. I had to try 10 times this morning to enter one to join a forum.

[irneb]

Yep, these things are kind of useless for their intent. Even those confirmation emails aren't totally fool proof. I mean: how difficult would it be for a bot to receive an email and follow a link inside it? It could even set up dummy email accounts on any of a list of numerous free email servers. At least the confirm email idea turns it into a 2 step bot attack, unlike these captcha's which is easily circumventable by nearly any OCR library.

Methinks it's time to refocus on other ways to keep unwanted stuff out. All these attempts to stop bots automatically seem to be easily circumventable. Unfortunately that's just how it is. Until someone comes up with a better idea, I think these companies are better served by not p-ing their customers off, and rather just do a periodic manual check against bots. I wonder how much clientèle they loose due to these irritations.

My biggest gripe is usually when I'm trying to get info regarding some product I want to specify in a building project. Most manufacturers require the architect to register with them before they send you the technical specs. And nearly all of them use these stupid stuff. I know I've discontinued specifying certain products due to being unable to "log-in" on some sites - i.e. they've lost several million R in possible turnover, just due to me not wanting to waste several hours trying to get their info. So I can only guess how much they're loosing due to others giving up when similarly irritated.

I've even reverted to simply phoning suppliers instead - 9 out of 10 of their websites are less than useless due to these things.

[tec0]

Web identification. Yea like your ID will register with a service and just enter a code that will identify you. The idea isn’t new actually... Back in 2006 this system was considered, what would happen you will use your very real information to get a code. Now this Code then becomes part of your browser so basically each site you access will look for your key and authenticate automatically.

Obviously privacy was the main concern and the system was scrapped. However it would have worked... 1 code per person. No person can have more than 1 code and if they did then the law would be broken and they would end up as someone’s “toy” in prison.

Internet privacy would be dead and pear to pear sharing would go the way of the dodo. However I know for a fact that they are reconsidering the system 2010... That said example; England are now at the stage where ALL web access are monitored without a warrant.

[irneb]

And then, just to toss another flash-bang into the china-shop: http://www.informationweek.com/secur...lert/240159435

[adrianh]

There is something seriously wrong when a company implements security measures that are so absurd or complex that prospective customers simply give up and go elsewhere. I am not going to waste my time trying to guess a captcha ten times in a row to become a member of someting or the other. If they make it difficult for me then they can keep it.

The unfortunate reality is that the MD of the business is probably totally unaware the th IT whizkid thought that he was being very clever when he implemented the system. One of the biggest problems with IT is that many whizkids don't understand the consequences of their actions.