Friday, July 17, 2009

Turning away from CAPTCHA

When I first encountered CAPTCHA I thought it was a grand idea. My opinion has changed.

First of all I believed it allowed humans and machines to be differentiated on the web. Sadly, cracking CAPTCHA is done on a regular basis, and there are white papers on how to do it in lots of different languages (such as this one in Python). Bugs in the submission system or cheap human labor works as well. There are enough ongoing issues that most registration systems still include some sort of email system to help filter out the robots.

Second, CAPTCHA fails on accessibility. Yes, you can provide an audio alternative, but what if your users are blind AND deaf? Well, I've actually been told by accessibility experts that a non-CAPTCHA form should be provided for those people. Yes, when I said 'experts', I meant plural!

So where does that leave us for weeding out the humans from the computers?

Right now I'm a fan of logic based CAPTCHA alternatives. The idea is to provide simple questions that are relatively easy for humans to solve and hard for computers to answer. A good example would be, 'Today is Saturday. Yesterday was ___', and the idea is that you should have hundreds or thousands of questions. In fact, I came up with a Plone widget package called humanator to support this concept. There will be a Django version shortly.

There are some issues to overcome:
  • We need to cook up a few thousand questions to make it a bit harder on the brute force people.
  • Internationalization will require translators from many languages to support the projects.
  • There is also the issue of the cultural context of the questions. Since this is supposed to be user friendly we don't want to ask any inappropriate questions. I can police English pretty well, but I'll have little control over what happens in other languages.
  • Some people thing the logic method is weaker from a security perspective than CAPTCHA. Both arguably rely on a form of security through obfuscation, and I think with about the same amount of work both can be hacked. But a logic based system is easier to set up. ;)

Wednesday, July 8, 2009

NOVA-DUG meeting notice for July 8th

Tonight, July 8th, we are planning to get together from 7:30-9:00 pm at the Ballston Commons mall in Arlington, VA.

Location
Ballston Commons Mall Panera (ignore google maps and just go into the front entrance of the Mall). Email or twitter me (pydanny) if you have difficulties finding the place.

Agenda
  • Meet and greet!
  • Present the rules of NOVA-DUG meetings
  • Plan future sessions of NOVA-DUG
  • Discuss DjangoCon
  • Show and Tell
  • Socialize!

Thursday, July 2, 2009

Quitting Caffeine Fail

In the crazy heady days of May two months ago I decided to quit consuming caffeine.

I cut out coffee, soda, and black tea. It was surprisingly easy. Hooray!

So I happily went along drinking herbal teas like chamomile, cinnamon-orange, peach, and of course, green tea. Life was great! I was getting my anti-oxidants and none of the bad stuff. I could hang with my co-worker Katie and be one of those 'cool non-caffeine drinkers'.

So one day weeks ago I mention to Katie at some point that I was going to make some green tea and offered her some. She said she couldn't have it because of the caffeine, then she blinked.

Which means she just figured something out. Then she declared:

OH MY GOD YOU HAD NO IDEA GREEN TEA HAD CAFFEINE!!!

That was followed by a bit more of mockery.

So yeah, I failed to quit drinking caffeine then. However, today, while I'm home being sick, I'm trying to quit again. Wish me luck.