What is a CAPTCHA?

CAPTCHA is the abbreviation of "Completely Automated Public Turing test to tell Computers and Humans Apart". It is a public fully automatic program that distinguishes between users and computers. Can prevent: malicious password cracking, ticket swiping, forum flooding, effectively preventing a hacker from making continuous login attempts with a specific program using a specific program to brute force cracking. In fact, using verification codes is a common way for many websites now. We use A relatively simple way to achieve this function. This question can be computer generated and judged, but only humans can answer it. Since the computer cannot answer the CAPTCHA question, the user who answered the question can be considered a human. ^[1]

Chinese name: Verification code
Foreign name: CAPTCHA

Specific: Programs that distinguish users from computers or people
Function: Prevent malicious password cracking, forum irrigation, etc.

Verification Code Introduction

The word captcha was first coined in 2002 by Louis von Ann, Manuel Blum, Nicholas J. Hopper, and John Langford of IBM at Carnegie Mellon University. Carnegie Mellon University tried to apply for the word to become a registered trademark, but the application was rejected on April 21, 2008. A commonly used CAPTCHA test is to allow the user to enter text or numbers displayed on a distorted picture. The distortion is to avoid being automatically recognized by a computer program such as OCR (Optical Character Recognition). Text without effect. Because this test uses a computer to test humans, rather than a human to test a computer as in the standard Turing test, people sometimes call CAPTCHA a reverse Turing test.

In order to prevent people with physical and mental disabilities from seeing the image, an alternative method is to read the numbers with speech. In order to prevent speech recognition and analysis of the sound, the content of the sound will be noisy. ^[2]

Captcha role

Prevent malicious cracking of passwords, ticket swiping, forum irrigation, and page swiping.

Effectively prevent a hacker from brute-forcing a specific registered user with a specific program

Baidu Post Bar Verification Code For continuous login attempts, in fact, the use of verification codes is a common method on many websites (such as China Merchants Bank's online personal banking and Baidu community). We have implemented this function in a relatively simple way. Although login is a bit more troublesome, this function is still necessary and important for the password security of netizens. However, we still remind everyone to protect their passwords. Try to use more than 6 digits mixed with numbers, letters, and symbols. Do not use simple passwords such as 1234 or passwords that are the same as or similar to your username. The theft of your account caused unnecessary trouble to yourself.

The verification code usually uses some lines and some irregular characters. The main function is to prevent some hackers from stealing the password data.

Verification code use process

The verification code of most websites requires one-click to fill in the box, and then the verification code picture will pop up automatically.

Click the red text next to the verification code to replace it Since the verification code is randomly generated, there is a high chance that a verification code picture that cannot be clearly identified will appear, so it should be noted that the general website will have corresponding prompts, such as "Can't see clearly, change one", etc. Tip, you can directly click on the current verification code picture to complete the replacement of the verification code.

Verification code classification

Gif Gif Animation Verification Code

The mainstream verification code is more easily recognized by OCR software by providing a static picture.

Some websites provide GIF dynamic captcha pictures, making it difficult for the recognizer to identify which layer is the real captcha picture, while providing clear pictures, it can more effectively prevent the recognition of the recognizer. According to statistics, animation The anti-spam injection of GIF verification code can reach 100%, which is a very effective innovation model of verification code. At the same time, there can be up to hundreds of gif animation effects, which can also increase the aesthetic effect of website pages.

Verification code

The mobile phone verification code is sent by the verification code to the mobile phone. Large websites, especially shopping websites, provide the function of mobile phone message verification code, which can more accurately and safely ensure the security of shopping and verify the correctness of the user. It is the most effective verification. Code system. Some verification code access providers provide mobile phone verification code service. Each website sends a request to the access provider's server through the interface. The server sends random numbers or letters to the mobile phone. The verification of the verification code is performed by the access provider's server.

Verification code

Have you ever encountered that your website users or members often do not receive the verification code of the website for various reasons, or new users do not receive the text message and have no patience, they directly give up your website, or because of the problem with the verification code What about Jia Liu losing both old and potential new customers?

Now, the emergence of the voice verification code solves all these problems at once, and you no longer have to worry about the problem of the verification code. As long as the user's mobile phone or landline can answer the call normally, they will definitely receive the voice verification code, which can automatically broadcast the voice message, and at the same time, the short message can be sent to the user's phone at the same time, ensuring double insurance to ensure foolproofness. If there is a dial-up failure in the voice verification code, the system can also automatically replay to ensure that none of them are missed, which fundamentally solves the problem that users of your website cannot receive the verification code. ^[1]

Captcha video captcha

Video verification code The video verification code is a newcomer in the verification code. The verification code composed of random numbers, letters, and Chinese in the video verification code is dynamically embedded in videos of MP4, flv and other formats, which increases the difficulty of cracking. Captcha video dynamic transformation and random response can effectively prevent dictionary attacks, exhaustive attacks and other attacks. The combination of verification code letters and numbers in the video, the shape, size, and speed of the font, and the dynamic change of display effects and trajectories increase the difficulty of malicious screen capture cracking. Its security is much higher than ordinary verification codes, and this form of verification codes does not make users feel boring. Because it increases the difficulty of machine recognition, it can reduce the difficulty of user recognition, making it easier for users to identify.

However, due to the need for higher technical support, such verification codes have not been popularized. There are already several companies providing such services internationally, including a Chinese company Qingdao Impressionist Information Technology Co., Ltd.'s impression code service platform.

However, I believe that with the improvement of technology, video verification codes will be popularized, and the security of websites will be effectively improved.

Verification code other information

1. Verification codes generally prevent batch registration, and human eyes seem to be strenuous, not to mention the machine. Second, like Baidu Post Bar has not become the member. Posting a verification code is probably to prevent large-scale anonymous replies. At present, many websites use verification code technology to prevent users from automatically registering, logging in, and irrigating with robots. The so-called verification code is to generate a picture from a series of randomly generated numbers or symbols, with some interference in the picture, such as randomly drawing several straight lines, and drawing some points (preventing OCR). The verification code information is recognized by the user's naked eye. Enter the form to submit your site for verification, and you can use a feature only after successful verification. ^[1]

2. The place where the user ID is usually registered and the major forums must enter the verification code.

3. Common verification codes:

(1) The four digits and letters may be both letters and numbers, and a random 4-digit string. The original verification code has almost zero verification effect. CSDN website users log in using GIF format, commonly used random digital picture verification code. The characters on the picture are quite satisfactory, and the verification function is better than the previous one.

(2) Chinese characters are the latest verification codes for registration, which are randomly generated and difficult to type, such as the QQ appeal page.

(3) MS hotmail application is in BMP format, random numbers + random capital letters + random interference pixels + random positions.

(4) Korean or Japanese, now running HF on MS registration to play Korean, increasing the difficulty.

(5) Google's Gmail registration is in JPG format, random English letters + random colors + random positions + random length.

(6) The other major forums are in XBM format with random content.

(7) Advertising verification code: You only need to enter some of the content in the advertisement, which can bring extra income to the website and also make the user refreshing.

Advertising verification code

(8) Question verification code: The question verification code is mainly filled in the form of question and answer. Its viewing is easier to identify and enter than the mode verification code. The system can generate questions such as "1 + 2 =?" For users to answer. Of course, such questions are randomly generated. Another type of question verification code is a text-based question verification code, such as generating the question "What is the full name of China?" Of course, some websites also give prompt answers or direct answers after the question.

4. Other functions of verification code:

Prevent malicious registration

Almost all formal forums require a verification code when registering. This is to prevent people who spam advertisements from using the registration machine to register maliciously. This invention from Carnegie Mellon University in the United States is called CAPTCHA (automatic Turing test to distinguish humans from computers), because the registrant needs to recognize the crooked text on the picture, and this work Only real humans can do it. There are hundreds of millions of Internet users in the world. For individuals, it takes a few seconds to recognize text, but if you use all the power of Internet users, you can complete unimaginable projects. This is the United States. What the CMU research team in Pittsburgh, Pennsylvania is doing.

The group was commissioned by a non-profit organization called "Internet Archives" to convert massive ancient books and manuscripts into electronic texts via OCR (Optical Character Recognition) software for easy computer storage and query. However, due to the poor quality of the manuscript, the poor computer will misread one for every ten words scanned. The only solution is manual verification. Such a job is obviously not a person or a group capable of. So CMU designed a powerful system called reCAPTCHA to let their computers go to humans for help. The specific method is: send the scanned images of the text that the OCR software cannot recognize to the major websites in the world to replace the original verification code images; after the users of those websites correctly recognize the text, their answers will be returned to the CMU.

To improve the accuracy of text recognition, users are often asked to recognize two words, and the answer to one of them is already known. In this way, a user who correctly recognizes the word with an answer is likely to correctly recognize another word. Sometimes, the CMU also submits an unrecognized word to different users. If you get the same answer, then this answer can be definitely correct.

Because many popular websites, such as Facebook, Twitter, and StumbleUpon, use reCAPTCHA, CMU can process about one million words per day. However, at the current rate, it will take an estimated 400 years for all texts provided by the Internet Archive to be made electronic. ^[2]