A Study of CAPTCHA for Web Security

Abstract— As the increase of Internet usage in term of available services provided, user gains more convenience but also face a challenge. Online services such as Email, search engine, social networking may be abused by the automated program or web bots. To ensure the service is used by human, most of them use Completely Automated Public Turing test to tell Computers and Human Apart (CAPTCHA) methods to securing their web services. This paper will discuss the various types of CAPTCHAs and issues in designing the good CAPTCHA in term of security and usability. Keywords: CAPTCHA, TEXT-Based, GRAPHIC-Based, AUDIOBased, Robustness, Usability

Online Polls: Result of any online poll can only be trusted if the poll system ensures that only humans can vote. Preventing Dictionary Attacks: CAPTCHAs can also be used to prevent dictionary attacks in password systems. Search Engine Bots: Configuring the website as nonindexed page is important to prevent others from finding them easily. This is why CAPTCHA is important Worms and Spam: CAPTCHAs also offer a reasonable solution against email worms and spam which only accept if the sender is a human [2].





I.

INTRODUCTION



A CAPTCHA which is stand for Completely Automated Public Turing test to tell Computers and Human Apart is a challenge response test which gives a challenge to the users. It is one of Human Interaction Proofs. When the user gives accurate answer he is considered as human otherwise a web bot. Web bots are scripts or applications designed to perform predefined functions repeatedly and automatically after being triggered intentionally or through a system infection [1]. It is important to differentiate between a human and a machine in the fields of Artificial Intelligent, Internet Security and human computer interaction [3].Some web services and applications that use CAPTCHA as a defensive mechanism against automated web bots are [2]:  Preventing Comment Spam in Blogs: By using a CAPTCHA, only humans can enter comments on a blog without necessary to sign up before they enter a comment.  Protecting Website Registration: A few years ago email services provider such as Google, Yahoo, etc. were suffered from a "bots" that would sign up for thousands of email accounts every minute. By using CAPTCHA, it would ensure that only humans can obtain free accounts. Protecting Email Addresses from Spammers: CAPTCHAs provide an effective mechanism to hide your email address from Web scrapers. The idea is to require users to solve a CAPTCHA before showing your email address.

However, it give some disadvantages to user experience since CAPTCHAs increase load on servers because of requirement for image database and huge server processing. Eventually it results in delay of Web page downloads and their subsequent refreshes [5]. Besides that, some types of CAPTCHAs pose an unfriendliness, accessibility problem and annoyance to legitimate user. A good CAPTCHA minimizes these disadvantages by generating a CAPTCHA test that satisfies its various desired properties. These properties include [3, 5]:  It should be easy for human users to pass.  It should be easy for a tester machine to generate and grade.  It should be accept and suitable to all humans and disabled person  It should be hard for a software robot to pass II. TYPES OF CAPTCHA METHODS



A. TEXT-Based CAPTCHA Text CAPTCHAs are almost exclusively used in real applications since it is easy to implement and effective. In Text-based CAPTCHAs simple questions are asked [3]. Examples of such questions are [2]:  How many days in January?  What is the third letter in MALAYSIA?  If yesterday was a Sunday, what is today?

1|P age

ITT730: Norliyati Rohman (2012721487)

Such questions are very easy for a human user to solve, but it’s very difficult to program a computer to solve them. Other text CAPTCHAs involves text distortions and the user is asked to identify the text hidden. The various implementations are [2, 4]:  Gimpy: is a very reliable text CAPTCHA. It works by choosing ten words randomly from a dictionary and displaying in a distorted and overlapped manner.  Ez-Gimpy: is a simplified version of the Gimpy. It randomly picks random alphabets from a dictionary to create nonsense but pronounceable text then applies distortion to the text. MSN CAPTCHA: It is created for Microsoft which uses eight upper case character and digits. Warping is used to distort the character, to produce a ripple effect which makes computer recognition difficult.

B. GRAPHIC-Based CAPTCHA Graphics-based CAPTCHA present a visual pattern or concept that the user needs to identify an act accordingly. Different graphic-based CAPTCHA scheme use different concepts which are easy to be recognized by the users and difficult for the bot programs to stimulate. It also acts as challenge-tests in which the users have to guess those images that have some similarity like visual puzzle [3]. Examples of Graphic-based CAPTCHAs are:  Image Orientation CAPTCHA: Developed by Google and requires users to adjust randomly rotated images to their upright orientation [4].





Bongo: User has to solve visual pattern recognition which must find the characteristic that set two different series of blocks apart.



Pix: is a program that has a large database of labeled images. The program picks an object at random, present the six mages to user then ask the question “What are these images of?”

Gimpy CAPTCHA Pix CAPTCHA

reCAPTCHA Bongo CAPTCHA

MSN CAPTCHA

Image with various orientation properties Ez-Gimpy CAPTCHA

Figure 1: Samples of TEXT-Based CAPTCHA

Figure 2: Samples of GRAPHIC-Based CAPTCHA

2|P age

ITT730: Norliyati Rohman (2012721487)

C. AUDIO-Based CAPTCHA Audio-Based CAPTCHAs are based on the sound-based systems. These CAPTCHAs are alternatively developed for visually disabled users. It contains downloadable audio-clips [3]. Other program of audio-based CAPTCHA use to picks a word or a sequence of numbers at random, renders the word or the numbers into a sound clip and distorts the sound clip; it then presents the distorted sound clip to the user and asks users to enter its contents. [2].Audio CAPTCHAs are more difficult to solve, hard to internationalize and more demanding in terms of time and efforts in comparison with text and image CAPTCHAs [1].

individual segments, mapping of segments to characters and use of dictionary to guess the correct word [5]. However, it’s hard to break all CAPTCHA test with a single type of segmentation algorithm. One of image segmentation explained by M.Tariq Banday and Nisar A.Shah is Content-Based Image Retrieval (CBIR) methods which can be used for segmentation of image in regions, identification of region of interest and extract the semantic content. The process involves use of edge detection to segment an image into region which each contains a single character [1]. 2) Character Recognition After segmenting the image into letter, it would be passed to character recognition step. Character recognition may involve use of dictionary to facilitate the character recognition process in identifying the candidate text string [5].

Figure 3: Sample of AUDIO-Based CAPTCHA D. Other CAPTCHAs Beside above types of CAPTCHA tests, some technique are used a Video-Based, Implicit CATCHA challenge, etc. Video based using animation or video in which user must give three word to describe the presentation of video [4]. However this scheme is more complex and consumes more bandwidth compare to the others. Implicit CAPTCHA proposes single click challenges distinguished as necessary browsing links which can be answered through experience of the context of the particular website [5]. III. ISSUES IN DESIGNING CAPTCHA

Newly designed CAPTCHAs use the methods of font tricks, choice of letters, noise, color model, overlap, distortion and degradation [5]. To strengthen the various CAPTCHA techniques, some researcher has proposed and designed new techniques. Shirali-Shahreja and M.H have been proposed Multilingual CAPTCHAs which user can select his/her native language then it would be translated using online translator. Besides multilingual process, user have to recognize and finding the object. Both operations cannot be done by computer appropriately, so this method can resist the computerized attacks efficiently. [3] TIME-VARIENT CAPTCHA which has been introduced by Yadava P, Sahu C and Shukla S is focused on targeting a display of CAPTCHA on the webpage for a fixed time. It will keep changes and replaces itself until the last CAPTCHA is filled by user. The automated program has to breach one more step to determine the final entered CAPTHA [3]. 3D-Dynamic CAPTCHA which has been proposed in [2] is believed a technique that difficult to crack but easy for humans to recognize them. The idea is integrating the character layer, background interference layer and foreground interference layer as one set of CAPTCHA. In character layer the attribute of character is defined in term of number of character, size, font, color, spin, twist, etc. For background layer it can include not only background color transformation, 2D static image, but also light, smoke and texture rendering and others. Foreground interference is involves character, line and point interference. In the point of security view, this new design can prevent attacks efficiently from existing algorithms as well as possible ones using multiple frames. Furthermore, transformation from 2D to 3D optimizes the visual effects, providing a new idea for the design of CAPTCHA [2]. Move-Select CAPTCHA algorithm also is one of good idea to increase the complexity of CAPTCHA on preventing

There are two major issues involved in designing a strong CAPTCHA test [4]: Robustness and Usability (human friendly) A. Robustness Developer should design the CAPTCHA based on the robustness factor to ensure the difficulty to break the test. Breaking a CAPTCHA challenge is difficult and it is very rare to find 100% success rate, however several CAPTCHA implementations have been broken and thus are proved to be inefficient [5]. Breaking a CAPTCHA means to solve a CAPTCHA challenge by writing malicious computer software. There are two step processes which mainly used to defeating the CAPTCHA technique: 1) Segmentation Segmentation can be a process of segmenting text, image and audio. The emergence of this technology make a lots of website been attacked. A simple breaking procedure of text based CAPTCHAs involve segmentation of text string into

3|P age

ITT730: Norliyati Rohman (2012721487)

various techniques to be attacked. In this paper [4] they propose a 2-layer CAPTCHA test, based on human cognitive psychology to secure web services. In first layer users need to move and place the exact block of image to make a full meaningful image from the set of images rearranged randomly. Since computer program cannot perform mouse actions as normal human it is increase difficulties to pass the test. For the second layer, user need to select events associated with image from the drop-down list to avoid miss spelling of users and improve security. These two mechanism of move and select CAPTCHA can avoid the bots to control the system. Given facts that most of designers and researchers are aware on the robustness of CAPTCHAs and increasing complexity, sometimes it become extremely difficult to identify. B. Usability Usability is concerned with making CAPTCHA tests easy to learn, use, understand and interpret. It has become difficult for automated programs to pass tests by increasing distortion or noise. Consequently, it has also become difficult for humans too [4]. High accuracy, low response time and low perceived difficultly are desired to make CAPTCHAs usable and user friendly. Accuracy is a measure of correctness with which users can respond to a CAPTCHA challenge without making mistakes. Response time is the time taken by a user to react to the CAPTCHA challenge. Perceived difficulty is the difficulty observed by the users in solving CAPTCHA challenges [5] Distortion is important in CAPTCHA to enhance the security control. However the use of excessive distortion level and methods may not only make CAPTCHAs unusable but also will reduce its security control because the system would have to allow multiple attempts for failed tests. Inappropriate or unorganized CAPTCHA or any unsolicited or offensive image or text appearing in the CAPTCHA content will considerably reduce its usability [5]. To improve the presentation of a CAPTCHA test various usability issues that must be addressed while designing a CAPTCHA challenge, are use of color, user interface and appropriate screen area so as to make the challenge simple, easy to answer, easy to integrate with the Web page and highly accurate. It is highly recommended to carry out usability tests of a CAPTCHA method against humans to ascertain its usability. The tests should analyze accuracy, response time and user satisfaction on different image sizes with different distortion levels [5]. Below are some examples of researches that focus on improving the current CAPTCHA usability: 1) Text-Based Richard Chow has proposed a generic technique for converting a textual CAPTCHA into a clickable CAPTCHA

with an aim of improving usability of text-based CAPTCHAs. It proposes placement of multiple text CAPTCHA images in a grid among which some are English words while others are not. The user must click on all valid English words to pass this CAPTCHA test 2) Image-Based The excessive of distortion levels for each sub-image may be automatically controlled by keeping track of images that genuine users have failed to recognize. To improve usability of image-based CAPTCHAs, the test should use the wellknown images which can be recognized easily by most of the users. It also will improve user friendliness and speedsup the entry of the CAPTCHA by having clickable interface. This technique is not only suitable on computer, but on devices with small displays such as in smart phone, tablets computer or portable devices [5]. A new clickable image-based CAPTCHA that proposed by M.Tariq Banday and Nisar A in [1] is called Image Flip CAPTCHA. The researchers analyzed its usability issues under distortion, content and presentation dimension. In this proposed technique, user has only identify its place and recognize any flip in it rather than understand the image fully. It shows that the visibility of distortion does not affect a user to make the correct response. This technique also uses small-sized images which result in a compact image database, thus reduce the retrieval time. In the presentation view, the Image Flip CAPTCHA use a clickable approaches which give the best experience to user in term of user friendliness and fast response. Based on the analysis, this technique presents a high success rate and effective usability. 3) Audio-Based Nowadays, the improvement of CAPTCHA methods in usability manner like audio CAPTCHA along with text or image based CAPTCHA has become an alternative for visually disabled people to gain access to the protected Web resource [5]. Besides, in order to make the Web accessible to people with disabilities, the developer should refer to the guidelines that have been provided by W3C Web Accessibility Initiative (WAI). IV. CONCLUSION

The most popular CAPTCHA method that widely implemented in major website is Text-Based CAPTCHA. It is easy to deploy beside can provide strong security if properly designed. Graphic-Based CAPTCHA and Audio-Based CHAPTCHA methods have been proposed as an alternative to text-based. However, the process of creating image or audio database and the storage requirement sometimes can cause a delay operation in term of processing the presentation. The proposed techniques that were introduced by exist researchers which can satisfies user need in security control against bots, usability, and friendliness can be implemented in future.

4|P age

ITT730: Norliyati Rohman (2012721487)

V.
[1]

REFERENCES

[3] [4]

[2]

M.Tariq Banday and Nisar A.Shah, “Image Flip CAPTCHA,” The ISC International Journal of Information Security. July 2009, Volume 1, Number 2 (pp. 105-123) Ramesh Babu .A, Praveen Kumar .K and Dr.Srinivasa Rao .V, “Implementation of Secure Multilayered CAPTCHA”, International Journal of Advanced Engineering Sciences and Technologies. Vol No. 6, Issue No. 2, 200 - 219

[5]

Baljit Singh Saini and Anju Bala, “A Review of Bot Protection using CAPTCHA for Web Security”, Volume 8, Issue 6 (Jan. - Feb. 2013) Moin Mahmud Tanvee, Mir Tafseer Nayeem and Md. Mahmudul Hasan Rafee, “Move & Select: 2-Layer CAPTCHA Based on Cognitive Psychology for Securing Web Services”, International Journal of Video & Image Processing and Network Security. Vol: 11 No: 05 M. Tariq Banday and N. A. Shah, “A Study of CAPTCHAs for Securing Web Services”, IJSDIA International Journal of Secure Digital Information Age, Vol. 1. No. 2, December 2009

5|P age