Usability of CAPTCHAs Or usability issues in CAPTCHA design Authors: Jeff Yan and Ahmad Salah El Ahmad Presented By: Kim Giglia CSC /19/2008

Definitions  CAPTCHA – Completely Automated Public Turing Test to Tell Computers and Humans Apart  Three main types of CAPTCHAs:  Text-based schemes  Sound-based schemes  Image-based schemes (

Text-Based CAPTCHAs

Sound-Based CAPTCHAs

Image-Based CAPTCHAs  – requires users to perform some sort of image recognition task

Why CAPTCHAs?  Intuitive to users  Good security if deployed properly  Used for:  Preventing blogger spam  Protecting website registrations  Protecting addresses from scrapers  Securing Online Polls  Prevent dictionary password search attacks  Keep search engine bots out of certain web pages  Protect against worms and spam

Usability of CAPTCHAs  Robustness and usability  What issues are involved in designing usable CAPTCHAs: learnability, efficiency, memorability, errors, and satisfaction  Authors focus on framework for evaluating CAPTCHAs from an accuracy, response time, and satisfaction issues point of view

Framework for evaluating usability CategoryUsability Issue Distortion Distortion method and level Confusing characters Friendly to foreigners? Content Character Set String length – fixed or random Random chars or dictionary word Offensive word Presentation Font type and size Image size Use of Color Integration with web pages

Security issues and usability trade-offs with CAPTCHAs:  Size of a character set matters, but larger sets can present more confusing characters  String length matters, but longer or random strings may be harder for users  Suggest using a variable length string with the length info presented in the CAPTCHA  Random strings versus dictionary strings – authors state that emphasis is more on segmentation resistant design

Security issues and usability trade-offs with CAPTCHAs:  Offensive words have no security implication, but clearly affect a user’s experience  Misuse of color can actually make your CAPTCHA less secure and way more difficult to read

What is reCAPTCHA?  A free CAPTCHA service that helps to digitize books  Book pages are photographically scanned and then OCR is used to transform the images to text  Two words are given to a user: One answer is known and if user gets known text correct, other text answer is assumed correct  Note: about 60 million CAPTCHAs are solved daily, which is >150,000 hours of work daily

Authors’ Conclusions  Text based CAPTCHAs can be difficult for foreigners (study not truly large enough to conclude this)  Length of strings has security and usability implications  Use of color has security and usability implications  Have developed a framework for examining usability issues (true, but they did not provide data as to which items are most important)