18 September 2009

CAPTCHA : double-edged sword

A CAPTCHA is, in technical terms, a challenge-response authentication process. In plain english, it's simply a question on a webform that requires a correct response from the user who is filling out the form to make sure the user is human and is not a computer. The process consists of a computer generated image displaying text, usually a combination of numbers, upper case letter and lower case letters, and a text field below it. The feedback was developed by humans in order to reduce spam created by robots filling out web forms.

Upon filling out a form, the user reads the CAPTCHA (they started out as a simple words such as 'boat', 'goat' and so forth), types in the exact word or sequence of letters/numbers in the CAPTCHA field and finally submits the form.

The thought behind it was fairly simple: humans can read text in an image format whereas robots (non-humans) wouldn't have the ability to do so. However, technology has been catching up and can now easily read certain CAPTCHA images and therefore different methods now need to be used to prevent technology from reading the CAPTCHA. The only way to prevent them from reading it is by rendering the text less legible which of course make it less legible for humans as well. Methods such as striking out the text, crowding the text together and distorting the text are all currently being used and in certain instances all being used at once. which makes the CAPTCHA unreadable.

See below the latest CAPTCHA image I encountered. Can you unambiguously say what the sequence is?

Ambiguous CAPTCHA





Now what was once a solution to avoid spamming is creating a huge usability an user experience problem. My average number of attempts to validate, or get the right answer, when filling out a CAPTCHA is three attempts. Frustrating to say the least.
What have your experiences been or what solutions have you found to solve the problem?