Not Even CAPTCHA Is Secure Any More!

For those of you that do not now, CAPTCHA is a type of challenge-response test used in computing to determine whether the user is human or not. It stands for Completely Automated Public Turing test to tell Computers and Humans Apart. I'm sure you've seen it many times while browsing the Web, but you just didn't know it was named that way. You know when you want to create an account on some site, and besides all the info, it asks you to copy some text from a somewhat distorted image? Well... that strange little image, that's CAPTCHA. See? You know it now! But just in case you want to find out more about it, click on this link.

This type of security measure is a pretty useful one since not only does it protect the sites from bots, but it also protects the users from receiving spam, since computers are not able to recognize those letters. In fact, they aren't... not on a normal basis, anyway. But CAPTCHA does have a bug that can be exploited so that bots can pass this test.

There are two things known here: one, that CAPTCHA is generated by a program; and two, that it's close to impossible for computers to recognize what letters are in that image. But they don't need to, they just need to know what letters or process in the program told the other to spell and then distort. So, if this information could be intercepted, then a bot could know what text image is going to get, before it's even loaded by the browser. Well, that's kinda nasty, isn't it?

However, I did not discover this by myself, Mark Burnett did, and posted it on his blog from where I read it. And I only said things in a nut shell. If you want to see the detailed post, click on this link.