CAPTCHA security: a case study

Jeff Yan; Ahmad Salah El Ahmad

doi:10.1109/MSP.2009.84

CAPTCHA security: a case study

Jeff Yan^*
, Ahmad Salah El Ahmad

^*Corresponding author for this work

Research output: Contribution to journal › Article › peer-review

38 Citations (Scopus)

Abstract

A Case Study on Completely Automated Public Turing Tests to Tell Computers and Humans Apart (CAPTCHA) security systems is presented. CAPTCHA generate and grade tests that most humans can pass but current computer programs are not able to pass and such tests are called as CAPTCHA challenges that are based on hard, open artificial intelligence problems. CAPTCHA creators should consider the simple but powerful attack before deploying a CAPTCHA. CAPTCHA will go through the process of evolutionary development such as cryptography, digital watermarking, and an iterative process in which successful attacks lead to the development of more robust systems. CAPTCHA's robustness that whether it is robust enough to resist adversarial attack should be checked. A toolbox should be created that will be able to not only benchmark CAPTCHA's strength but also prevent designers from making mistakes.

Original language	English
Article number	5189558
Pages (from-to)	22-28
Number of pages	7
Journal	IEEE Security and Privacy
Volume	7
Issue number	4
Early online date	4 Aug 2009
DOIs	https://doi.org/10.1109/MSP.2009.84
Publication status	Published - 31 Aug 2009
Externally published	Yes

Funding

We’re grateful to Brian Randell and Lindsay Marshall for valuable comments. This work was partially supported by the EU-funded NoE ReSIST project.

Keywords

CAPTCHA
dictionary attacks
pixel count
security

Access to Document

10.1109/MSP.2009.84

Cite this

@article{7342f8db2f0e40bba14fe59bc8854d5a,

title = "CAPTCHA security: a case study",

abstract = "A Case Study on Completely Automated Public Turing Tests to Tell Computers and Humans Apart (CAPTCHA) security systems is presented. CAPTCHA generate and grade tests that most humans can pass but current computer programs are not able to pass and such tests are called as CAPTCHA challenges that are based on hard, open artificial intelligence problems. CAPTCHA creators should consider the simple but powerful attack before deploying a CAPTCHA. CAPTCHA will go through the process of evolutionary development such as cryptography, digital watermarking, and an iterative process in which successful attacks lead to the development of more robust systems. CAPTCHA's robustness that whether it is robust enough to resist adversarial attack should be checked. A toolbox should be created that will be able to not only benchmark CAPTCHA's strength but also prevent designers from making mistakes.",

keywords = "CAPTCHA, dictionary attacks, pixel count, security",

author = "Jeff Yan and \{El Ahmad\}, \{Ahmad Salah\}",

year = "2009",

month = aug,

day = "31",

doi = "10.1109/MSP.2009.84",

language = "English",

volume = "7",

pages = "22--28",

journal = "IEEE Security and Privacy",

issn = "1540-7993",

number = "4",

}

TY - JOUR

T1 - CAPTCHA security

T2 - a case study

AU - Yan, Jeff

AU - El Ahmad, Ahmad Salah

PY - 2009/8/31

Y1 - 2009/8/31

N2 - A Case Study on Completely Automated Public Turing Tests to Tell Computers and Humans Apart (CAPTCHA) security systems is presented. CAPTCHA generate and grade tests that most humans can pass but current computer programs are not able to pass and such tests are called as CAPTCHA challenges that are based on hard, open artificial intelligence problems. CAPTCHA creators should consider the simple but powerful attack before deploying a CAPTCHA. CAPTCHA will go through the process of evolutionary development such as cryptography, digital watermarking, and an iterative process in which successful attacks lead to the development of more robust systems. CAPTCHA's robustness that whether it is robust enough to resist adversarial attack should be checked. A toolbox should be created that will be able to not only benchmark CAPTCHA's strength but also prevent designers from making mistakes.

AB - A Case Study on Completely Automated Public Turing Tests to Tell Computers and Humans Apart (CAPTCHA) security systems is presented. CAPTCHA generate and grade tests that most humans can pass but current computer programs are not able to pass and such tests are called as CAPTCHA challenges that are based on hard, open artificial intelligence problems. CAPTCHA creators should consider the simple but powerful attack before deploying a CAPTCHA. CAPTCHA will go through the process of evolutionary development such as cryptography, digital watermarking, and an iterative process in which successful attacks lead to the development of more robust systems. CAPTCHA's robustness that whether it is robust enough to resist adversarial attack should be checked. A toolbox should be created that will be able to not only benchmark CAPTCHA's strength but also prevent designers from making mistakes.

KW - CAPTCHA

KW - dictionary attacks

KW - pixel count

KW - security

UR - https://www.scopus.com/pages/publications/70349314701

U2 - 10.1109/MSP.2009.84

DO - 10.1109/MSP.2009.84

M3 - Article

AN - SCOPUS:70349314701

SN - 1540-7993

VL - 7

SP - 22

EP - 28

JO - IEEE Security and Privacy

JF - IEEE Security and Privacy

IS - 4

M1 - 5189558

ER -

CAPTCHA security: a case study

Abstract

Funding

Keywords

Access to Document

Other files and links

Fingerprint

Cite this