On 4/17/05, Frank Wiles frank@wiles.org wrote:

It would be valid, but any captcha implementation worth it's salt doesn't use flat file images. It generates a random name for the image and serves it up to the client.

Here is how it works:

1. Choose random captcha that happens to say "FooBar" which is in foobar.jpg.

2. Tell browser to load /images/AlkjsdfH293sdfhjh2234kjh.jpg

3. Have a system in place that, in the background, serves up foobar.jpg when asked for /images/AlkjsdfH293sdfhjh2234kjh.jpg

This keeps bots like you were thinking from working. Because each time the filename is different.

I had thought he was planning on using the whole file as the key to his cache, not merely the file-name. But articles I have read on generating captchas reccomend generating one-off captchas. You have a graphics library that takes one of the words on your wordlist, frobs it randomly, and produces a one-off image. You can even call the image generator captcha.png all the time, and let your session layer keep track of who got which word.

http://search.cpan.org/~unrtst/Authen-Captcha-1.023/Captcha.pm

for instance, uses the GD library to generate images as needed.

Maybe you were already aware of this, but human farming has already been documented. Apparently they get people to provide capcha answers in exchange for pornography. I doubt you'd see a capcha sweatshop, though I wouldn't be surprised to see a asian cybercafe offer discounts for capcha replies.

On 4/17/05, Oren Beck oren_beck@hotmail.com wrote:

Actually a more complex to manage but could be more effective hack may be possible. A "human decoding farm" Basic concept is the "signature" of a captchas type challenge is routed to a human - who reads and decodes it- types it in and is instantly rewarded by... The next captcha to decode. rinse lather repeat for 8 hours or more a day. But such labor gets cheap . After all when wal-mart self checkouts merchandise made in Bangladesh and stocked by robots we ALL may wind up being captcha decoders for a spam haus.