5 Comments

• Daniel 20 Apr 2010
  This post feels highly misleading. Of course a generalized OCR solution will have difficulty with simple CAPTCHAs, since that is not its intended use. A much more interesting question is whether or not software designed to attack CAPTCHAs (and to specifically attack the RadCaptcha) can successfully read the image. Considering that plenty of more complicated CAPTCHAs have been cracked, I would be very surprised if the RadCaptcha were significantly more difficult to crack.
  
  I'm disappointed that this article has been posted, as it gives a very false sense of RadCaptcha security. Yes, it's a nice and simple widget to integrate into a site, and it's one that I personally use. However, publicly making implicit claims about the security of the RadCaptcha using such poor and misleading evidence should not be acceptable.
• Jeff 20 Apr 2010
  Daniel, does "Fun with RadCaptcha" sound like "it's the most secure captcha control on the market"? Other than that I also think that you should test RadCaptcha some other way although I have no idea how. I guess people who attack captchas don't sell their "products" online.
  Still... kudos for your efforts.
• ha 20 Apr 2010
  Mr Stratev please google "Crack CAPTCHA" then tell me RadCaptcha is "unbreakable".
• Vassil Terziev 20 Apr 2010
  Guys, I don't think anyone has made claims that RadCaptcha is unbreakable. No Software is unbreakable and we would never make such a misleading claim. People break into the systems of the millitary which are highly secure so if some "bad hacker" wants to break our little captcha, by all means he will be successful. But it's all about the skill level and the resources required.
  
  We're talking about a simple way to protect your blog from spammers, not how to secure your corporate IT environment with a captcha:) Let's not miss the "fun" part of Stoyan's blog.
• Stoyan Stratev 21 Apr 2010
  Daniel and ha,
  I apologize if my post seemed misleading to you. I was not trying to imply that the RadCaptcha control is unbreakable - I am fully aware that this is not true. No CAPTCHA control is crack-proof, even the ones used to protect Google and Yahoo's email services have already been broken. Whether it is with an image recognition algorithm or by unsuspecting customers of shady "adult" sites, any CAPTCHA protection can be circumvented.
  
  That being said, I wish to explain why I made this post - strictly for fun and driven by the "what if?" curiosity. I have always wondered what would happen when you put a CAPTCHA in a commercial OCR, even though the software is not designed to work specifically with such images. Remember that such software has existed for more than 20 years and the character recognition algorithms in it are very sophisticated. When the opportunity presented itself, I decided to ask my friend to do some tests.
  
  On the question of security, my position is that one should never rely on a single solution alone. For example, in our control the CAPTCHA image can be combined with other protecttion strategies such as hidden textboxes, minimum submission time, etc. We also try to provide as many configuration options for the image itself, because having different options will make it harder for a generic algorithm to solve it.