* HTML Encoded Captcha
You know those graphics of distorted numbers and letters you find on some Web sites that you have to decode and enter in a form to gain access or open an account? The technique is called a “CAPTCHA”; an initialism for “Completely Automated Public Turing test to tell Computers and Humans Apart.”
According to Wikipedia the technique is trademarked by Carnegie Mellon University and “is a type of challenge-response test used in computing to determine whether or not the user is human.” The idea is to make it extremely hard for automated processes to do things like open accounts.
The CAPTCHA graphic is, however, a weak spot as it can be easily found by software and image recognition algorithms are getting good enough that many of the simpler CAPTCHA images can be decoded. This forces sites to use more complex CAPTCHA images, but to be complex enough to foil software they are also often too difficult for humans to decode!
Click here for a discussion of how The SANS Institute, a security training and certification consultancy, wrestled with the problem.
A new technique that gets around many of the problems associated with CAPTCHAs is HTML Encoded Captcha or HEC. HEC encodes the CAPTCHA image as an HTML table of individually colored pixels.
As the author Ran Geva notes: “I created a new kind of Captcha that presents an unsolved challenge to the bot’s programmers. What I did was to encode the Captcha image into HTML. By doing so I gave the bots programmers a few new challenges … The Captcha is no longer an image and therefore not a resource they can download and process … The owner of the site can change the properties of the Captcha’s HTML, making it unique, and by doing so add another layer of complication for the bot to crack … In an ideal demo, the Captcha would integrate [seamlessly] with the page’s HTML and will make it very hard to tell apart, therefore make it extremely hard for a bot to detect it.”
The HEC technique is very powerful and relatively simple to implement although the overhead of encoding an image into an HTML table results in a much larger page size. Geva makes the source of a PHP implementation under the GPL License.
