2012/7/26 Platonides <Platonides(a)gmail.com>om>: If that is the case, why don't we change the CAPTCH for random letters?

The wordlists themselves need not be secret: they are only needed to create easily-typed strings that are sufficiently large in number to provide a moderate challenge to brute force guessing.

In the conclusion: "Contrary to the common belief, text-based CAPTCHAs can be difficult for foreigners." It is worth reading and likely the same for references there in. The first sentence is similar to what I have experience in 3 classes. And people begin to get anxious and usually say "If I type wrongly again, I'll give up". I've seen 3 students saying this to me. Even if hypothetically had in an experiment that only 1% of foreigners will face difficulties with CAPTCHA in a foreign language (I bet it's much more from real life experience), how much users this would represent in one of the most accessed sites in the world? Tom

I hate the case that I'm asked with a Chinese captcha when I'm surfing some Chinese websites without IME available. Besides I don't prefer Chinese captchas personally because Chinese characters usually require more key hits.

From the UX perspective, a captcha is always an obstacle for the interaction flow. Reducing the complexity of user interaction when solving the captcha can benefit all kinds of users but also solve problems for non-English speakers. Checkbox and honeypot-based captchas avoid most of the problems of text-based captchas since interaction is simplified to the minimum for the user: http://uxmovement.com/forms/captchas-vs-spambots-why-the-checkbox-captcha-w… Simple questions where the user can select an answer (not type) will solve some of the input-related issues for non-English speakers. These questions can be of different kinds (e.g., "Which one does not belong to the group: Red, Green, Skateboard, Blue?", "Is fire hot or cold?") and they can be based on text or image selection. An example of image-based captcha is available at http://www.picatcha.com/captcha/ Tagging media can be also used as a captcha. Google has been experimenting with asking users to tag videos as a captcha: http://cups.cs.cmu.edu/soups/2009/proceedings/a14-kleuver.pdf [PDF] In any case, some experimentation would be required to determine any of the above approaches (or combination of several) provides an appropriate security-usability balance for the specific needs of the Wikipedia. Pau On Sat, Jul 28, 2012 at 8:29 PM, Platonides <Platonides(a)gmail.com> wrote: > On 28/07/12 16:55, Everton Zanella Alvarenga wrote: > > In the conclusion: > > > > "Contrary to the common belief, text-based CAPTCHAs can be difficult > > for foreigners." > > > > It is worth reading and likely the same for references there in. The > > first sentence is similar to what I have experience in 3 classes. And > > people begin to get anxious and usually say "If I type wrongly again, > > I'll give up". I've seen 3 students saying this to me. > > > > Even if hypothetically had in an experiment that only 1% of foreigners > > will face difficulties with CAPTCHA in a foreign language (I bet it's > > much more from real life experience), how much users this would > > represent in one of the most accessed sites in the world? > > > > Tom > > There are two types of "foreigners" here: > - One are speakers of another language written in latin1 (such as > Brazilians). > - Another are those who use a diferent writing script, such as Russians > or Greeks. > > In the first case, they should have little problem. Native speakers of > the language used for the wordlist have an extra help, because they are > more likely to recognise the words and it can also help them perform > error recovery. > > It would be nice to provide a captcha with a native wordlist, but by > limiting to ascii characters, it can get pretty universal. > > Distortion where a letter looks like a different one is still > problematic. Even people with English knowledge can have trouble with > it, so being a native speaker doesn't magically make you invulnerable to > captcha errors. > On 16th July of 2007 Arnomane reported a case where "o" distortion made > it look like an "a", on August I reported another where an "s" looked > like a "g". > I expect that using random characters would make it worse, though. > > People with other scripts are a different matter. > * They may not be able to recognise the latin characters. > * You may be forcing them to change the language layouts for solving the > captcha. > * Foreign visitors may not be able to pass your captcha. > ** Lack of appropiate keyboard layout. > ** Unable to differenciate the characters (you want me to differenciate > ت and ث distorted in a noisy background?) > ** No fonts installed for viewing the characters (eg. 𓀝 vs 𓀞) such as > if you were trying to browse the in character map the script characters > of the language (potentially hundreds!) looking for a visual match. > > Yet, there are reports such as this by Liangent (native Chinese speaker) > on this list on 5th February 2011: > > I hate the case that I'm asked with a Chinese captcha when I'm surfing > > some Chinese websites without IME available. > > > > Besides I don't prefer Chinese captchas personally because Chinese > > characters usually require more key hits. > > > At least for those languages I think we would need a switch to get a > captcha in the different "language". > > We should also add the "button to get a new captcha" (bug 14230), which > should help when you get the wrong captcha. > And I think we should also add a "Problems solving the captcha? Mail us" > link for those cases when people can't pass the captcha. > Not that it would solve their problems, but it would at least provide a > way to lighten their frustration.

On 30 July 2012 15:22, Platonides <Platonides(a)gmail.com> wrote: Just to jump in here, it's not actually clear that our CAPTCHAs work at all at this point (per Tim's e-mail from last year of being able to robotically break ours 75% of the time). On https://www.mediawiki.org/wiki/Admin_tools_development (created last week), we in WMF Engineering noted that we'd want to look properly at some data around these CAPTCHAs and how they're working. This might show us that it would be sensible to just turn them off (which of course would help usability for all users), as long as we're happy that the tools for preventing the vandalism they were intended to stop are working well. Yours, -

1 Август 2012 г. 6:26:02 пользователь MZMcBride (z(a)mzmcbride.com) написал: Risker wrote: Reported separately where? CAPTCHAs were designed for "test if you're human," not "test if you're spam." It's a wonder they've worked this long. I imagine better anti-spam tools are needed (which may be a new extension, new AbuseFilter filters, better user scripts, etc.). If the situation is as dire as it sounds, it shouldn't be difficult to find a few resources to throw at the problem. In a discussion like this, examples of particular problematic behavior (links!) are always most helpful to developers, I've found. "This is the bad behavior we're seeing and want to stop. How should we do that?" :-)

I've been advised some of WMF's best are already working on it; however, if you want to see examples you could look at steward Billinghurst's block logs, mostly on non=English wikis.

I think that making Russian, Korean and Arabian captcha is really bad idea. English keyboad layout is installed by default in all operation systems, as far as I know. Moreover very interesting problems can appear if this feature would be implemented. Who will decide what captcha language is used? We can look at user IP address - then sometimes the foreigners will be in trouble. We can use Ukrainian capcha for the Ukrainian wesites - thus assuming that every person who knows Ukrainian has the Ukrainian keyboard layout, which is not true. I think that the assumption that "everyone in the internet is able to print English letters loking at their noised example" is not very bold assumption.

I made some mockups to illustrate some of the ideas on captchas that could be less problematic for non-English speakers, improve the general UX and rely on images from commons. - Panorama captcha: http://commons.wikimedia.org/wiki/File:Panorama-captcha-idea.png Based on tagging parts of a panorama picture with the appropriate word (in the UI language or Basic English words). - 'Who is who' captcha: http://commons.wikimedia.org/wiki/File:Find-all-captcha-idea.png Based on finding from a set of similar images the ones that fit a specific criteria (with an image describing also the criteria). - 'Find the different' captcha: http://commons.wikimedia.org/wiki/File:Find-the-different-captcha-idea.png Based on finding the image that is different from a set of images. These captchas will probably generate new problems for the technical side, require adjustments to reduce the chance of a machine to solve them, or may just be unfeasible to generate, but I wanted to provide these ideas in case anybody else may use it as a base for improve on any technical weakness they may have and make them at least as hard to solve for a machine as text-based captchas are.