Feeds

Rorschach test suggested as CAPTCHA replacement

You're a sick puppy with a secure password

Securing Web Applications Made Simple and Scalable

A group of boffins from Carnegie Mellon University is proposing that inkblot-style patterns form the basis of a system to replace CAPTHCAs, and is offering an open challenge to see how well it works.

While the CAPTCHA has been successful in preventing some forms of attack, such as comment-spam on Web forums, CAPTCHA-protected pages and passwords still come under attacks of various kinds, all the way down to paying people cents-per-hour to attack them.

The Carnegie Mellon proposal is for randomly-generated inkblots be presented instead of CAPTCHAs. Dubbed “GOTCHAs” (Generating panOptic Turing Tests to Tell Computers and Humans Apart) by the researchers, the aim is to defeat dictionary attacks, since the password cracker needs human feedback, even if it has access to the bits that generated the puzzle.

Since people are good at discovering something meaningful in patterns, a person presented with a series of inkblots will probably be able to come up with some kind of meaningful phrase to label an inkblot image.

Inkblot

Tell me what you see ... better still, don't

Image: GOTCHA Password Hackers! http://arxiv.org/pdf/1310.1137v1.pdf

As they explain in this paper at Arxiv, the idea of inkblot-based challenge-response isn't new: however, in most such schemes, once a user has associated a phrase with a challenge, he or she needs to remember that phrase exactly when presented with the prompt. In GOTCHAs, the researchers instead ask users to recognise, rather than recall, the phrases they originally applied to the inkblots.

Here's how the process works:

Create account:

  • Select username and password
  • Present random inkblots to user, requesting imaginative labels
  • Salt and store inkblots and users' responses

For password recovery, the user would be presented with the same inkblots and asked to remember the labels they gave at “create account” time.

While this is a human-attackable scheme, the researchers say it protects against computer-based dictionary attacks, since a computer reading the bits that comprise the inkblots can't assign semantic meaning to the image they would generate.

Of course, if a user failed the challenge, the system would merely generate a new password, as would be the case today.

Usability is still variable, the researchers note. The Mechanical Turk recruits they used to test the scheme could only manage 29 per cent completely accurate recall, although 69 per cent of users could recall at least five out of the ten labels they created. Interestingly and perhaps counter-intuitively, they found that long, descriptive phrases were recalled more accurately than one or two-word labels – as they write, “A happy guy on the ground, protecting himself from ticklers” is more memorable than “voodoo mask”.

The researchers present a challenge here for others to test – and try to crack – the GOTCHA scheme.

The smart choice: opportunity from uncertainty

More from The Register

next story
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.