<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
		>
<channel>
	<title>Comments on: Cracking CAPTCHA: Another Russian Business</title>
	<atom:link href="http://blogs.mcafee.com/mcafee-labs/2008/10/10/cracking-captcha-as-a-business/feed" rel="self" type="application/rss+xml" />
	<link>http://blogs.mcafee.com/mcafee-labs/cracking-captcha-as-a-business</link>
	<description></description>
	<lastBuildDate>Wed, 23 May 2012 15:26:06 +0000</lastBuildDate>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.1</generator>
	<item>
		<title>By: Marget</title>
		<link>http://blogs.mcafee.com/mcafee-labs/cracking-captcha-as-a-business/comment-page-1#comment-19054</link>
		<dc:creator>Marget</dc:creator>
		<pubDate>Tue, 09 Jun 2009 09:32:34 +0000</pubDate>
		<guid isPermaLink="false">http://www.labs.com/research/blog/?p=726#comment-19054</guid>
		<description>Once it successfully registers, XRumer may take steps to avoid human detection by first posting an innocuous question regarding a specific product or service. The point of all the subterfuge is to boost the Google page rank of a site by bombarding multiple forums with product/service mentions and discussions. Users that can be tricked into posting their own links (perhaps in an attempt to demonstrate where a product may be found) only help the program perform its primary function.</description>
		<content:encoded><![CDATA[<p>Once it successfully registers, XRumer may take steps to avoid human detection by first posting an innocuous question regarding a specific product or service. The point of all the subterfuge is to boost the Google page rank of a site by bombarding multiple forums with product/service mentions and discussions. Users that can be tricked into posting their own links (perhaps in an attempt to demonstrate where a product may be found) only help the program perform its primary function.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Mark S</title>
		<link>http://blogs.mcafee.com/mcafee-labs/cracking-captcha-as-a-business/comment-page-1#comment-19053</link>
		<dc:creator>Mark S</dc:creator>
		<pubDate>Wed, 11 Mar 2009 14:15:29 +0000</pubDate>
		<guid isPermaLink="false">http://www.labs.com/research/blog/?p=726#comment-19053</guid>
		<description>@BenG, obviously you have no idea how to protect forms. I don&#039;t care how much code you deploy for the bot to enumerate the form fields. If I setup100 buttons with the form with only one button visible your lousy bot now has to go through the stylesheet(s) given for the particular page and particular load and start decoding the css to find out which of the 100 buttons is the right one. Good luck with that, you have my sympathy.

I have integrated simple HTML forms for reviews on sites with thousands daily unique ips, and never had a single spam incident. But hey keep the captchas they make your pages colorful too.</description>
		<content:encoded><![CDATA[<p>@BenG, obviously you have no idea how to protect forms. I don&#8217;t care how much code you deploy for the bot to enumerate the form fields. If I setup100 buttons with the form with only one button visible your lousy bot now has to go through the stylesheet(s) given for the particular page and particular load and start decoding the css to find out which of the 100 buttons is the right one. Good luck with that, you have my sympathy.</p>
<p>I have integrated simple HTML forms for reviews on sites with thousands daily unique ips, and never had a single spam incident. But hey keep the captchas they make your pages colorful too.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Ben G</title>
		<link>http://blogs.mcafee.com/mcafee-labs/cracking-captcha-as-a-business/comment-page-1#comment-19052</link>
		<dc:creator>Ben G</dc:creator>
		<pubDate>Tue, 17 Feb 2009 13:09:29 +0000</pubDate>
		<guid isPermaLink="false">http://www.labs.com/research/blog/?p=726#comment-19052</guid>
		<description>to Mark S.
  wow.  I&#039;m not quite sure where to start, you&#039;re so off the mark.  Bots don&#039;t care how complex your html pages are, or how many fields are required, etc.  It is a _very_ simple task to write software to enumerate all of the fields on a static html page, fill in every field &amp; then submit.  The point isn&#039;t to send spam to the world, but to start a DoS attack against your protection for various reasons: spite, curiousity, making defenses fail in order to attack, etc.

CAPTCHA are not &quot;marketing ploys&quot;, they&#039;re just a tool designed to stop bots from bringing down your site.  I suppose you think firewalls are just a salesman&#039;s gimmick &amp; you don&#039;t need &#039;em either.</description>
		<content:encoded><![CDATA[<p>to Mark S.<br />
  wow.  I&#8217;m not quite sure where to start, you&#8217;re so off the mark.  Bots don&#8217;t care how complex your html pages are, or how many fields are required, etc.  It is a _very_ simple task to write software to enumerate all of the fields on a static html page, fill in every field &amp; then submit.  The point isn&#8217;t to send spam to the world, but to start a DoS attack against your protection for various reasons: spite, curiousity, making defenses fail in order to attack, etc.</p>
<p>CAPTCHA are not &#8220;marketing ploys&#8221;, they&#8217;re just a tool designed to stop bots from bringing down your site.  I suppose you think firewalls are just a salesman&#8217;s gimmick &amp; you don&#8217;t need &#8216;em either.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Jimm B</title>
		<link>http://blogs.mcafee.com/mcafee-labs/cracking-captcha-as-a-business/comment-page-1#comment-19051</link>
		<dc:creator>Jimm B</dc:creator>
		<pubDate>Mon, 17 Nov 2008 22:51:39 +0000</pubDate>
		<guid isPermaLink="false">http://www.labs.com/research/blog/?p=726#comment-19051</guid>
		<description>here is another captcha killer
www.captchabot.com</description>
		<content:encoded><![CDATA[<p>here is another captcha killer<br />
www.captchabot.com</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Dog-man</title>
		<link>http://blogs.mcafee.com/mcafee-labs/cracking-captcha-as-a-business/comment-page-1#comment-19050</link>
		<dc:creator>Dog-man</dc:creator>
		<pubDate>Sun, 16 Nov 2008 03:10:15 +0000</pubDate>
		<guid isPermaLink="false">http://www.labs.com/research/blog/?p=726#comment-19050</guid>
		<description>intresting, it is a never-ending cat and mouse game, im working ong a program that generates random CAPTCHA ...if intrested let me know.
Dog-mn</description>
		<content:encoded><![CDATA[<p>intresting, it is a never-ending cat and mouse game, im working ong a program that generates random CAPTCHA &#8230;if intrested let me know.<br />
Dog-mn</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Mark S</title>
		<link>http://blogs.mcafee.com/mcafee-labs/cracking-captcha-as-a-business/comment-page-1#comment-19049</link>
		<dc:creator>Mark S</dc:creator>
		<pubDate>Sun, 02 Nov 2008 15:37:05 +0000</pubDate>
		<guid isPermaLink="false">http://www.labs.com/research/blog/?p=726#comment-19049</guid>
		<description>It&#039;s a total waste of time deploying captchas if it&#039;s to block automatic forms submission. You should use plain html instead. It is completely transparent to your human visitors no crossed images and no active content, no jscripts or the like.

what&#039;s this with the captchas anyways? another marketing opportunity? If forms aren&#039;t complex enough, lets add some extra lousy input boxes and images, maybe they&#039;ll attract more visitors right?</description>
		<content:encoded><![CDATA[<p>It&#8217;s a total waste of time deploying captchas if it&#8217;s to block automatic forms submission. You should use plain html instead. It is completely transparent to your human visitors no crossed images and no active content, no jscripts or the like.</p>
<p>what&#8217;s this with the captchas anyways? another marketing opportunity? If forms aren&#8217;t complex enough, lets add some extra lousy input boxes and images, maybe they&#8217;ll attract more visitors right?</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Alex</title>
		<link>http://blogs.mcafee.com/mcafee-labs/cracking-captcha-as-a-business/comment-page-1#comment-19048</link>
		<dc:creator>Alex</dc:creator>
		<pubDate>Sat, 25 Oct 2008 05:14:22 +0000</pubDate>
		<guid isPermaLink="false">http://www.labs.com/research/blog/?p=726#comment-19048</guid>
		<description>Xrumer and other programs for spam will die only when search engines will refuse link popularity. Thanks for interesting article.</description>
		<content:encoded><![CDATA[<p>Xrumer and other programs for spam will die only when search engines will refuse link popularity. Thanks for interesting article.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Simon Hunt</title>
		<link>http://blogs.mcafee.com/mcafee-labs/cracking-captcha-as-a-business/comment-page-1#comment-19047</link>
		<dc:creator>Simon Hunt</dc:creator>
		<pubDate>Tue, 14 Oct 2008 15:41:04 +0000</pubDate>
		<guid isPermaLink="false">http://www.labs.com/research/blog/?p=726#comment-19047</guid>
		<description>Very interesting article!</description>
		<content:encoded><![CDATA[<p>Very interesting article!</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Capri</title>
		<link>http://blogs.mcafee.com/mcafee-labs/cracking-captcha-as-a-business/comment-page-1#comment-19044</link>
		<dc:creator>Capri</dc:creator>
		<pubDate>Tue, 14 Oct 2008 03:11:44 +0000</pubDate>
		<guid isPermaLink="false">http://www.labs.com/research/blog/?p=726#comment-19044</guid>
		<description>Visual image captchas are bad. They block out and discriminate against visually impaired users, punishing them as spammers.

Visual verification that requires you to enter characters in an image you see, or answer a question about what&#039;s in an image you see, blocks out anyone with a visual impairment.

Clicking to get a larger image displayed does nothing at all for people with severe vision impairments who cannot even read large print.

Audio captchas are becoming available on a growing number of sites, but even they aren&#039;t good enough. The deaf-blind use braille displays and cannot see a picture or hear a corresponding sound.

Captchas force the blind to surrendor what independence they once had on site registration and forms, reducing them to begging a sighted person or site admin for help in account creation, form submittal, group creation, anywhere there is a manditory visual verification code.

As if that wasn&#039;t bad enough, Many of these captcha-using sites add further insult to the visually impaired when they demand you to prove you are human by entering in a visual code. If you are blind and you cannot see an image, does that disqualify you as a member of the human race? According to captcha, yes!

This is not a tiny little inconvenience that occurs every once in a blue moon, but an ongoing, day to day problem. Trying to register, make comments, create groups, or fill out any form to completion is a crapshoot if you are visually impaired. If you are on your own, trying to make a submission on a site and you are pressed for time, you are completely out of hope when you run up against a captcha and there is no one you can get to help you.. Site administrators may or may not have time or the desire to help you.

When you find yourself running up against this cyber face-slapping half or more than half the time you try to make submissions to various sites, it is demoralizing. You are told again and again that you are not welcome, you are not human, forced to pester a site administrator or someone else for help with something you could do on your own before, and as far as the site administration goes, you do not exist and are not worth consideration.

It&#039;s infuriating and a threat to the dignity of people who are at the mercy of visual verification captchas.

In addition to blind users having the door shut in their faces at sites that use visual captchas, It is evident that spam problems still occur as much as ever on sites that use captchas, proving captcha to be a cure that&#039;s worse than the disease.

If a site administrator feels so strongly that they must employ a captcha, there is a newer, truly accessible variety that should be more effective. It prompts you with a question in text format and requires you to fill in the answer. the questions should not require a person to be able to see an image to answer.

Bad examples: Which number in the picture is red?&quot; &quot;Which animal in the picture above has four legs?&quot; How is someone who can&#039;t read print and has to rely on a screenreader supposed to know that?

Good examples: &quot;How many legs does a cat have?&quot; &quot;What&#039;s 2+2?&quot; Math questions can be asked in a number of different ways to hault a bot and still be accessible to a user. &quot;What&#039;s 6 divided by 2?&quot; What&#039;s 5 added to 3?&quot; Even &quot;What color is an orange?&quot; is still a good example, because everyone except the bots, sighted or not, knows the answer.</description>
		<content:encoded><![CDATA[<p>Visual image captchas are bad. They block out and discriminate against visually impaired users, punishing them as spammers.</p>
<p>Visual verification that requires you to enter characters in an image you see, or answer a question about what&#8217;s in an image you see, blocks out anyone with a visual impairment.</p>
<p>Clicking to get a larger image displayed does nothing at all for people with severe vision impairments who cannot even read large print.</p>
<p>Audio captchas are becoming available on a growing number of sites, but even they aren&#8217;t good enough. The deaf-blind use braille displays and cannot see a picture or hear a corresponding sound.</p>
<p>Captchas force the blind to surrendor what independence they once had on site registration and forms, reducing them to begging a sighted person or site admin for help in account creation, form submittal, group creation, anywhere there is a manditory visual verification code.</p>
<p>As if that wasn&#8217;t bad enough, Many of these captcha-using sites add further insult to the visually impaired when they demand you to prove you are human by entering in a visual code. If you are blind and you cannot see an image, does that disqualify you as a member of the human race? According to captcha, yes!</p>
<p>This is not a tiny little inconvenience that occurs every once in a blue moon, but an ongoing, day to day problem. Trying to register, make comments, create groups, or fill out any form to completion is a crapshoot if you are visually impaired. If you are on your own, trying to make a submission on a site and you are pressed for time, you are completely out of hope when you run up against a captcha and there is no one you can get to help you.. Site administrators may or may not have time or the desire to help you.</p>
<p>When you find yourself running up against this cyber face-slapping half or more than half the time you try to make submissions to various sites, it is demoralizing. You are told again and again that you are not welcome, you are not human, forced to pester a site administrator or someone else for help with something you could do on your own before, and as far as the site administration goes, you do not exist and are not worth consideration.</p>
<p>It&#8217;s infuriating and a threat to the dignity of people who are at the mercy of visual verification captchas.</p>
<p>In addition to blind users having the door shut in their faces at sites that use visual captchas, It is evident that spam problems still occur as much as ever on sites that use captchas, proving captcha to be a cure that&#8217;s worse than the disease.</p>
<p>If a site administrator feels so strongly that they must employ a captcha, there is a newer, truly accessible variety that should be more effective. It prompts you with a question in text format and requires you to fill in the answer. the questions should not require a person to be able to see an image to answer.</p>
<p>Bad examples: Which number in the picture is red?&#8221; &#8220;Which animal in the picture above has four legs?&#8221; How is someone who can&#8217;t read print and has to rely on a screenreader supposed to know that?</p>
<p>Good examples: &#8220;How many legs does a cat have?&#8221; &#8220;What&#8217;s 2+2?&#8221; Math questions can be asked in a number of different ways to hault a bot and still be accessible to a user. &#8220;What&#8217;s 6 divided by 2?&#8221; What&#8217;s 5 added to 3?&#8221; Even &#8220;What color is an orange?&#8221; is still a good example, because everyone except the bots, sighted or not, knows the answer.</p>
]]></content:encoded>
	</item>
</channel>
</rss>

