CRV2 CAPTCHA - Revision history

Larry Conklin at 03:12, 3 May 2013

2013-05-03T03:12:51Z

Larry Conklin at 03:11, 3 May 2013

2013-05-03T03:11:16Z

Larry Conklin at 03:08, 3 May 2013

2013-05-03T03:08:50Z

Larry Conklin at 03:08, 3 May 2013

2013-05-03T03:08:01Z

Larry Conklin at 03:07, 3 May 2013

2013-05-03T03:07:05Z

Larry Conklin at 03:03, 3 May 2013

2013-05-03T03:03:40Z

Larry Conklin at 03:01, 3 May 2013

2013-05-03T03:01:40Z

Larry Conklin: Created page with "CAPTCHA (an acronym for "Completely Automated Public Turing test to tell Computers and Humans Apart".) is an access control technique. CAPTCHA is used to prevent automated..."

2013-05-03T03:00:09Z

Created page with "CAPTCHA (an acronym for "Completely Automated Public Turing test to tell Computers and Humans Apart".) is an access control technique. CAPTCHA is used to prevent automated..."

New page

CAPTCHA (an acronym for "Completely Automated Public Turing test to tell Computers and Humans Apart".) is an access control technique.

CAPTCHA is used to prevent automated software from gaining access to webmail services like Gmail, Hotmail and Yahoo to create e-mail spam, automated postings to blogs, forums and wikis for the purpose of promotion(commercial, and or political) or harassment and vandalism and automated account creation.

CAPTCHA’s have proved useful and their use has been upheld in court. Circumventing CAPTCHA has been upheld in US Courts as a violation Digital Millennium Copyright Act anti-circumvention section 1201(a)(3) and European Directive 2001/29/EC.

Code review of CAPTCHA’s the reviewer needs to pay attention to the following rules to make sure the CAPTCHA is built with strong security principals.

#Do not allow the user to enter multiple guesses after an incorrect attempt.
#The software designer and code review need to understand the statics of guessing. I.e. One CAPTCHA design shows four (3 cats and 1 boat) pictures, User is requested to pick the picture where it is not in the same category of the other pictures. Automated software will have a success rate of 25% by always picking the first picture. Second depending on the fixed pool of CAPTCHA images over time an attacker can create a database of correct answers then gain 100% access.
#Consider using a key being passed to the server that uses a HMAC (Hash-based message authentication code) the answer.

Text base CAPTCHA’s should adhere to the following security design principals...

#Randomize the CAPTCHA length: Don’t use a fixed length; it gives too much information to the attacker.
#Randomize the character size: Make sure the attacker can’t make educated guesses by using several font sizes / several fonts.
#Wave the CAPTCHA: Waving the CAPTCHA increases the difficulty for the attacker.
#Don’t use a complex charset: Using a large charset does not improve significantly the CAPTCHA scheme’s security and really hurts human accuracy.
#Use anti-recognition techniques as a means of strengthening CAPTCHA security: Rotation, scaling and rotating some characters and using various font sizes will reduce the recognition efficiency and increase security by making character width less predictable.
#Keep the line within the CAPTCHAs: Lines must cross only some of the CAPTCHA letters, so that it is impossible to tell whether it is a line or a character segment.
#Use large lines: Using lines that are not as wide as the character segments gives an attacker a robust discriminator and makes the line anti-segmentation technique vulnerable to many attack techniques.

CAPTCHA does create issues for web sites that must be ADA (Americans with Disabilities Act of 1990) compliant. Code reviewer may need to be aware of web accessibilities and security to review the CAPTCHA implementation where web site is required to be ADA complaint by law.

Examples of a CAPTCHA

How do I upload an image

References:
[#] UNITED STATES of AMERICA vs KENNETH LOWSON, KRISTOFER KIRSCH, LOEL STEVENSON Federal Indictment. February 23, 2010. Retrieved 2012-01-02.
[#] http://www.google.com/recaptcha/captcha [[http://www.google.com/recaptcha/captcha]]
[#] http://www.ada.gov/anprm2010/web%20anprm_2010.htm [[http://www.ada.gov/anprm2010/web%20anprm_2010.htm]]
[#] Inaccessibility of CAPTCHA - Alternatives to Visual Turing Tests on the Web http://www.w3.org/TR/turingtest/ [[http://www.w3.org/TR/turingtest/ ]]

← Older revision		Revision as of 03:12, 3 May 2013
Line 1:		Line 1:
−	CAPTCHA (an acronym for "~~Completely Automated Public Turing~~ test to tell ~~Computers~~ and ~~Humans Apart~~".) is an access control technique.	+	CAPTCHA (an acronym for "'''C'''ompletely '''A'''utomated '''P'''ublic '''T'''uring test to tell '''C'''omputers and '''H'''umans '''A'''part".) is an access control technique.

	CAPTCHA is used to prevent automated software from gaining access to webmail services like Gmail, Hotmail and Yahoo to create e-mail spam, automated postings to blogs, forums and wikis for the purpose of promotion(commercial, and or political) or harassment and vandalism and automated account creation.		CAPTCHA is used to prevent automated software from gaining access to webmail services like Gmail, Hotmail and Yahoo to create e-mail spam, automated postings to blogs, forums and wikis for the purpose of promotion(commercial, and or political) or harassment and vandalism and automated account creation.

@@ Line 33: / Line 33: @@
 # Inaccessibility of CAPTCHA - Alternatives to Visual Turing Tests on the Web http://www.w3.org/TR/turingtest/ [[http://www.w3.org/TR/turingtest/ ]]
-''''Notes from Renchie Joan...'''
+'''Notes from Renchie Joan...'''
 If we can add a small section like, what are the uses of CAPTCHA  when mapped to vulnerability categories.

@@ Line 33: / Line 33: @@
 # Inaccessibility of CAPTCHA - Alternatives to Visual Turing Tests on the Web http://www.w3.org/TR/turingtest/ [[http://www.w3.org/TR/turingtest/ ]]
-''''Notes from Renchie Joan...''''
+''''Notes from Renchie Joan...'''
 If we can add a small section like, what are the uses of CAPTCHA  when mapped to vulnerability categories.

@@ Line 25: / Line 25: @@
 Examples of a CAPTCHA
-'''''How do I upload an image'''''
+'''''How do I upload an image(s)'''''
 References:
@@ Line 32: / Line 32: @@
 # http://www.ada.gov/anprm2010/web%20anprm_2010.htm [[http://www.ada.gov/anprm2010/web%20anprm_2010.htm]]
 # Inaccessibility of CAPTCHA - Alternatives to Visual Turing Tests on the Web http://www.w3.org/TR/turingtest/ [[http://www.w3.org/TR/turingtest/ ]]

@@ Line 10: / Line 10: @@
 #The software designer and code review need to understand the statics of guessing. I.e. One CAPTCHA design shows four (3 cats and 1 boat) pictures, User is requested to pick the  picture where it is not in the same category of the other pictures.  Automated software will have a success rate of 25% by always picking the first picture. Second depending on the fixed pool of CAPTCHA images over time an attacker can create a database of correct answers then gain 100% access.
 #Consider using a key being passed to the server that uses a HMAC (Hash-based message authentication code) the answer.
 Text base CAPTCHA’s should adhere to the following security design principals...

@@ Line 28: / Line 28: @@
 References:
-[#] UNITED STATES of AMERICA vs KENNETH LOWSON, KRISTOFER KIRSCH, LOEL STEVENSON Federal Indictment. February 23, 2010. Retrieved 2012-01-02.
+# UNITED STATES of AMERICA vs KENNETH LOWSON, KRISTOFER KIRSCH, LOEL STEVENSON Federal Indictment. February 23, 2010. Retrieved 2012-01-02.
-[#]  http://www.google.com/recaptcha/captcha [[http://www.google.com/recaptcha/captcha]]
+# http://www.google.com/recaptcha/captcha [[http://www.google.com/recaptcha/captcha]]
-[#] http://www.ada.gov/anprm2010/web%20anprm_2010.htm [[http://www.ada.gov/anprm2010/web%20anprm_2010.htm]]
+# http://www.ada.gov/anprm2010/web%20anprm_2010.htm [[http://www.ada.gov/anprm2010/web%20anprm_2010.htm]]
-[#] Inaccessibility of CAPTCHA - Alternatives to Visual Turing Tests on the Web http://www.w3.org/TR/turingtest/ [[http://www.w3.org/TR/turingtest/ ]]
+# Inaccessibility of CAPTCHA - Alternatives to Visual Turing Tests on the Web http://www.w3.org/TR/turingtest/ [[http://www.w3.org/TR/turingtest/ ]]