Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
Spam Security The Internet Your Rights Online

Porn Rewards Users To Get Past Anti-Spam Captchas 420

Posted by timothy from the pull-this-lever-a-few-times dept.
Stalke writes "Spammers are now usings a new technique to circumvent the 'captchas,' the distorted text in graphics, that users must input to receive the free email account. The spammers have cracked the system by displaying the 'captchas' on free porn sites in real time. Since there are always a large number of people signing up for free porn, they do the work of decripting the 'captchas' which is then replayed back into the spammers program to create a new email account. Who thought that porn could be a hacking technique!" Sure sounds plausible, though the link here says only "someone told me."
This discussion has been archived. No new comments can be posted.

Porn Rewards Users To Get Past Anti-Spam Captchas More

Porn Rewards Users To Get Past Anti-Spam Captchas

Comments Filter:

  • I am not looking at porn (Score:5, Funny)

    by hetairoi ( 63927 ) on Wednesday January 28, 2004 @09:32AM (#8112232) Homepage
    I'm hacking ..... now go away, what I'm doing in here is private.

  • Foundation (Score:3, Insightful)

    by millahtime ( 710421 ) on Wednesday January 28, 2004 @09:33AM (#8112242) Homepage Journal
    Porn, the foundation of the internet. It will never go away or die. It has more uses then we can even imagine.

  • Nifty (Score:5, Funny)

    by turbofisk ( 602472 ) on Wednesday January 28, 2004 @09:34AM (#8112248)
    I'm not for spamming... But if I were a spammer... I would pat myself on my back... Pretty nifty... Bastards!

  • Proof! (Score:5, Funny)

    by RiscIt ( 95258 ) on Wednesday January 28, 2004 @09:34AM (#8112261) Homepage Journal

    Proof once again that porn (and it's usually associated activities... ahem) will NOT make you go blind!

  • Spam spam spam spam SPAAM! (Score:4, Insightful)

    by seidleroniman ( 740696 ) on Wednesday January 28, 2004 @09:36AM (#8112272)
    What is everyone in the Slashdot crowd gonna do? On one hand you dont want to get spammed, but on the other hand you NEED your pr0n. However, i think this will take care of itself because eventually people will be too busy deleting spam to look at pr0n online, reducing the amount of spam....Ok, i'm half kidding, but i really do think this is an ingenius way of spammers getting around certain barriers. Say what you will, but spammers have shown/proven that they can overcome many obstacles to continue their spamming.

    • Re:Spam spam spam spam SPAAM! (Score:4, Funny)

      by routerwhore ( 552333 ) * on Wednesday January 28, 2004 @09:42AM (#8112353) Homepage
      I'm sorry, you incorrectly assumed you had two hands free in this exercise to make your point. I believe one of those would be occupied...

    • Re:Spam spam spam spam SPAAM! (Score:5, Insightful)

      by thedillybar ( 677116 ) on Wednesday January 28, 2004 @09:46AM (#8112376)
      What are we going to do?

      How about type something other than what's in the box? I seriously doubt you have to sit there waiting while it verifies that what you entered is actually correct. They're probably just assuming most people will type it correctly.

      • Re:Spam spam spam spam SPAAM! (Score:4, Interesting)

        by Zeinfeld ( 263942 ) on Wednesday January 28, 2004 @09:59AM (#8112527) Homepage
        What are we going to do?

        I think half of us are going to flame on slashdot and the other half will go off to find the web site where you can get the free porn.

        I hate these C/R schemes, they are OK when they are used for mailing lists or for checking signups to Yahoo! mail or some other forum where the intent is to protect ME. I do not accept that they are at all legitimate when the only purpose is to protect some dweeb who thinks he is really important.

        Worst of all are the systems that send out C/R challenges in response to email that was a reply to something that the challenger sent. I get students asking me some question about a Web spec or something else I did. I spend time writing an answer and then get a C/R challenge. Like some student's time is much more important than mine...

        Worst of all are the C/R systems that don't whitelist after the first challenge. Dan Bernstein is the worst offender here, I answered three of his challenges and still get his robot if I make the mistake of replying to one of his mails to me. So I have his robot blacklisted in my email.

        So on balance I am not at all sad that the nuisance of C/R tests looks like it will be soon ended.

        What is worrying though is that the fact such schemes have worked may well mean that hashcash and other CPU payment schemes are not viable either. The senders could run a java component on the porn viewers machine to generate message authentication ids.

        • A well designed challenge/response system won't challenge those people to whom the user has already sent email out to. I think nuisances like you have mentioned are temporary and will be refined in the future as spam becomes a greater problem (and it will).

          I use a challenge/response system myself for my email and it certainly has nothing to do with me thinking I am really important or that my time is worth more than yours. It is all about me being totally sick of spam and being willing to take extreme me

    • Re:Spam spam spam spam SPAAM! (Score:5, Insightful)

      by Anonymous Coward on Wednesday January 28, 2004 @10:17AM (#8112685)
      Why sign up for porn? Damn, isn't there enough available without signing up? It's bad enough that they can match your IP address; why give them registration info too? It's hysterical that a bunch of geeks who won't sign up to read the New York Times will gladly give name, rank, and serial number for porn.

  • Sounds like rubbish (Score:3, Insightful)

    by Snipet ( 745417 ) on Wednesday January 28, 2004 @09:36AM (#8112275) Homepage
    Two reasons this sounds like rubbish: The catchups are generated on a per session basis for the person trying to sign up for the email address . Surely if they then try and get a third party to do the decoding the session will be expired. Also The article points out that Optical Character recognition is more than adequate to break this so I can not see a situation that spammers would do this elaborate probably unworkable method over OCR. No facts and a friend of a friend source makes this sound like total BS.
    • It would not be that hard to use server-side HTTP requests with a scripting language like PHP or "compiled" language like C#/.NET and a Message Queue to accomplish this. Hey, maybe I'll write one of these I am sure the porn people pay more than my shitty company. ellis

    • Re:Sounds like rubbish (Score:5, Interesting)

      by superwiz ( 655733 ) on Wednesday January 28, 2004 @09:46AM (#8112384) Journal
      Catchups are constantly designed to be undecodable by OCR. But the porn solution doesn't sound like rubbish at all. It actually sounds quite clever. Here's how it might work: 1.An automated script tries to sign up for public emails (yahoo, hotmail, etc.). 2.At some stage during sign up a page with a catchup is "presented" to the script. 3.The script gets the catchup out of the page and adds it to a pool of catchups to be associated with their perspective words. 4. At some point, shortly after, a visitor to a porn site is presented with a catchup and enters the correct word. THIS IS, BY THE WAY, A PERFECT WAY TO FOIL SPAMMERS AND TO STILL GET YOUR PORN -- since the porn site doesn't, in fact, know what the catchup is supposed to be and is only using you, enter a wrong one. 5. The word entered by the user on the porn site is used to submit a reply to the public email system.

      • Re:Sounds like rubbish (Score:5, Insightful)

        by JDevers ( 83155 ) on Wednesday January 28, 2004 @10:07AM (#8112604)
        Think about the same thing, but in reverse. Have the script run ONLY when someone signs up for the free porn, it automatically connects to the free e-mail provider and the glyph is just tranfered to the viewer in truly real time...
        • Somebody's done this before.

      • Re:Sounds like rubbish (Score:5, Insightful)

        by druske ( 550305 ) on Wednesday January 28, 2004 @10:27AM (#8112793)
        The porn site wouldn't know what the catchup was supposed to be, but the email signup page would, and if the wrong response was provided, it'd return a page saying so. The porn site could parse that page and reject the user's answer. No valid response, no naughty bits.

        Without any facts to back the story up, I don't know if this is really happening, but it sounds plausible. I wonder if anyone's filed a patent on the method? ;)

      • Re:Sounds like rubbish (Score:5, Insightful)

        by Imperator ( 17614 ) <.slashdot2. .at. .omershenker.net.> on Wednesday January 28, 2004 @10:43AM (#8112998)
        THIS IS, BY THE WAY, A PERFECT WAY TO FOIL SPAMMERS AND TO STILL GET YOUR PORN -- since the porn site doesn't, in fact, know what the catchup is supposed to be and is only using you, enter a wrong one.

        Uh, if the spammers are smart, they'll actually use the word you give them to submit the form, and if it doesn't work they'll make you enter another one. some of them are hiring smart people. Maybe if there weren't so many out-of-work programmers in the world...

    • Re:Sounds like rubbish (Score:5, Informative)

      by Z-MaxX ( 712880 ) on Wednesday January 28, 2004 @09:46AM (#8112391) Journal
      Two reasons this sounds like rubbish: The catchups are generated on a per session basis for the person trying to sign up for the email address . Surely if they then try and get a third party to do the decoding the session will be expired.
      Not neccesarily. From the writeup:
      by displaying the 'captchas' on free porn sites in
      real time.
      If you have thousands of visitors every hour, then you only have to wait a few seconds on average to have your image shown to a user and a few more seconds for the user to respond.
    • Well.... yes the facts are missing but, I could think of the progam logic.

      Load page to harvest captchas
      Save the captchas image to DB
      Maintain open page where captchas was harvested
      Serve captchas to real user on porn site
      Capture real user's response to captchas
      Re-input user's repsonse to the text field on the harvest page
      Voila.

      Still the same session on the harvest page, just multi-tasked the captchas out. A script can maintain a session just like a user can.

      Now... The band-aid (not the fix) comes by accept

    • Re:Sounds like rubbish (Score:2, Informative)

      by Anonymous Coward
      'Bot logs into the mail server and attempts to sign up for a new email address. 'Bot recieves page showing the imaged text. 'Bot grabs the image and redisplays it on the entry page for the next person accessing the free porn. That person enters the text, which is sent back to the 'bot. This only takes a few seconds if a person signs in to the porn page in the right time frame. If the porn site gets reasonably heavy traffic, one certainly will. If not and the page times out, the 'bot just tirelessly tri

    • Re:Sounds like rubbish (Score:4, Redundant)

      by (trb001) ( 224998 ) on Wednesday January 28, 2004 @10:00AM (#8112545) Homepage
      OCR aside (you're right, it's far more advanced than most of the 'captchas' I've seen), this would be easy to do. Follow:

      1) Person comes to sign up for porn
      2) Porn site requests the captcha from the free email provider
      3) Porn site presents the captcha to the user
      4) User types in the string
      5) Porn site presents the string to the free email provider.
      6) If email provider accepts, good to go. If not, throw back exception to the user. Goto step 3.

      No sessions are being expired here, you have your basic man in the middle attack.

      --trb

    • Re:Sounds like rubbish (Score:4, Informative)

      by mark-t ( 151149 ) <markt@ner[ ]at.com ['dfl' in gap]> on Wednesday January 28, 2004 @10:17AM (#8112680) Journal
      Wrong. Here's how it works.

      Porn site gets a visitor.
      The cgi or other executable on the web server's site then starts to sign up for an email account, and caches the graphic that must be decoded.
      The exact same graphic is presented to the porn site visitor.
      The porn visitor decodes the graphic and clicks "Submit"
      The program at the porn site then finishes signing up for an email account by entering the text that the porn visitor entered.
      If the email address is successfully created, the program then permits the user into the restricted area, otherwise entrance is denied and the whole process repeated.

      Yes, these images are generated on a per session basis, but the whole point is that each visitor to a porn site gives the porn sites a new potential email address with which to spam.

      It's actually quite ingenious if you ask me.

    • Re:Sounds like rubbish (Score:5, Interesting)

      by Tim Macinta ( 1052 ) <twm@alum.mit.edu> on Wednesday January 28, 2004 @10:42AM (#8112970) Homepage
      I have been letting people set up free email accounts at kmfms.com [kmfms.com] for awhile, and there has been an abnormally large surge in new accounts recently (and the sign-up process does use the distorted letters). These have been junk accounts too. I had a huge number of sign-ups just last night and only 1 person actually came through my site first (the email service is provided by everyone.net [everyone.net], so somebody was evidently going straight there without hitting my site first). Once these junk accounts are created, spammers then send email from their own servers, but with the return address of the junk account. I don't know why they are doing this - I seriously doubt they are checking the accounts, and they aren't actually sending anything from the accounts, but they are doing it nonetheless and I have been getting a lot of complaints recently about spam even though all of the headers inidicate that my network and everyone.net's network wasn't involved.

      I have given up that this point and as of today I am switching the email system so that all new users must be paid users. These spammers are like a swarm of locust consuming everything in their path, and now they have destroyed the free service I had been offering for years. I wish they were in the US so I could pursue legal action.

  • Easily countered (Score:4, Interesting)

    by Yggdrasil42 ( 662251 ) on Wednesday January 28, 2004 @09:36AM (#8112276) Homepage
    This can be easily countered if the free e-mail sites configure their servers, so that the 'captchas' can only be loaded into pages that they've served themselves.

    I'm not sure how that works, but I've seen it in action on some sites.

    Maybe someone else knows how it's done?

    • Re:Easily countered (Score:2, Insightful)

      by perlionex ( 703104 ) *
      I'm sure it's only loaded into pages they've served themselves. The p0rn sites just grab the image, then display from their own sites to the users directly. When the users send the correct text back to the p0rn site, the site then sends it back to the website. It's actually quite trivial, but ingenious.

    • Re:Easily countered (Score:5, Informative)

      by Violet Null ( 452694 ) on Wednesday January 28, 2004 @09:42AM (#8112339)
      Wouldn't matter.

      Automated spam script goes to sign up new email address, gets presented captcha. Downloads captcha -- as the server would expect any normal web browser to do.

      Captcha is copied to some location. Filename probably contains information that can identify the specific script that's running, since there'll undoubtedly be many going simultaneously.

      From that point, there's about 20 minutes, give or take, for the porn site to display the copy of the captcha and ask for the user's input. On a site seeing any amount of traffic at all, that should be more than enough.

      Once a user has given input, the spam script is notified, and sends the input back to the captcha server. The captcha server never sees the IP address of the human -- it only deals with the spam script -- so it'll never know anything's up.

  • good or evil (Score:3, Funny)

    by nizo ( 81281 ) on Wednesday January 28, 2004 @09:36AM (#8112278) Homepage Journal
    Now if we could only get spammers to use their ingenuity for good rather than evil, we could solve all of the worlds problems.

    • Re:good or evil (Score:3, Interesting)

      by mlush ( 620447 )
      Now if we could only get spammers to use their ingenuity for good rather than evil, we could solve all of the worlds problems.

      I could see this working for some image recognition problems. To get the next page you have to perform some small task. Salt the tasks with 10% control images for which you know the answer and a finders fee where you get a weeks free access if you find X or do Y work units. Could be used in to check survalance video images ...

  • Easy fix. (Score:4, Funny)

    by Black Parrot ( 19622 ) on Wednesday January 28, 2004 @09:37AM (#8112286)


    For your captcha, use a picture of a really ugly old woman with "click here to see more" written across it, and no one visiting a porn site will help with the decryption.

  • Valid News Sources (Score:5, Insightful)

    by akadruid ( 606405 ) * <slashdotNO@SPAMthedruid.co.uk> on Wednesday January 28, 2004 @09:37AM (#8112293) Homepage
    Is it just me or are people becoming less critical about what a valid news sources is?
    'Someone told me...' on a 'blog'?

    That doesn't carry quite the weight of the BBC and Reuters to me, but I suppose there's a good chance no-one was threatened by a 'democratic' government during the production of the article, so maybe it's less biased than some.
    • Is it just me or are people becoming less critical about what a valid news sources is? 'Someone told me...' on a 'blog'?

      Sheesh, some folk are never happy. The source is pointed out to us, proving that the Slashdot Editor did actually read the article, and now you want them to be fussy over the sources too. Next thing we know you'll be complaining again tomorrow when this story gets duped.

    • Valid News sources... on a blog. (Score:5, Insightful)

      by LinuxParanoid ( 64467 ) * on Wednesday January 28, 2004 @09:54AM (#8112470) Homepage Journal
      You're right. But. A) you're repeating what the editor already said, and B) you are overstating your case a bit for the following reasons:

      In fairness, the poster on the blog was Cory Doctorow, who is a long time, well-known net-citizen and isn't exactly some random guy, although you may not know him. For a sample of his work, see this piece in Salon [salon.com] which mentions that he won the John W. Campbell Award for best new science fiction writer at the 2000 Hugo Awards. He's not a journalist, he's a blogger, but it's an interesting tidbit nonetheless...

      And even if he was a random blogger, his credentials are much less important than the core concept he's disclosing: that someone seeking to generate email accounts (or open bank accounts or whatever) could have porn-seeking humans workaround the turing-ish test security measures. The story is less that someone is doing it, than that someone could be doing it. At least to me.

      Plus this is a hacker-type story... I wouldn't expect Reuters, etc. to carry it first.

      I actually was glad to see the Slashdot editor point out the "someone told me" caveat... it's a sign to me that the editors here are getting better. They're warning us about the weaknesses in the story, not just slapping stuff up here without a care.

      --LP
      • Nice post...
        You're right, the concept is interesting, I was just playing Devil's Advocate with the concept of 'news' - the idea that the moon landings were faked is an interesting concept, but not 'news' as such.
        'Sides, it was attempt at the ever elusive concept of irony. On a day when the BBC is buying ads to it's coverage of the Dr Kelly case, the traditional media is on a back foot against a prominant blogger - 'news' is a concept worth a little exploration today.

    • Re:Valid News Sources (Score:3, Insightful)

      by dabadab ( 126782 )
      Well, this posting is not about "news" but more about an interesting idea - an idea's "interesting" factor does not depend on its source.
      It is intriguing and worth think about, a lot more than, say, eweek's zero-content article about the wishlist for linux 2.7.
    • I see your point, but that's the whole point of the Internet and personal publishing ("blogs"). It's time for the major publishers' granted monopoly on truth to end [slashdot.org]. Who [slashdot.org] can you trust [slashdot.org] these days?

      And anyways, that doesn't discount that this is still a very interesting idea. And that's the primary news item.
    • I'm sure this is the kind of front page stuff that BBC and Reuters would be reporting.

      "This just in...spammers are apparently using pron sites to help decrypt captchas."

      Some nuts will find a conspiracy in everything.

    • I dunno, I think rumors are as valid a news source as Reuters or the BBC. In my experience, the accuracy rate seems to be about the same.

  • I've heard of it too (Score:3, Funny)

    by Maskirovka ( 255712 ) on Wednesday January 28, 2004 @09:38AM (#8112303)
    They like to call the method called "many carrots and more sticks".

  • In related news... (Score:5, Funny)

    by Black Parrot ( 19622 ) on Wednesday January 28, 2004 @09:39AM (#8112314)


    A million new Slashdot accounts were added today.

  • pr0n isn't really my thing, so I can't say I've ever seen this done... but it's a nifty way to gather hordes of horny, sweaty human volunteers to willingly generate thousands of spamming accounts for you...

    It's just like the Anna Kournikova virus from a few years back... except this one actually gives you free pr0n. Remember the one that asked you to open an attachment to see a free picture of Anna? (yeah, I was overseas, and some lonely airman in the desert opened this virus on our military computer ne

  • Countermeasure... (Score:4, Interesting)

    by LinuxParanoid ( 64467 ) * on Wednesday January 28, 2004 @09:41AM (#8112326) Homepage Journal
    If the image ...has been inlined from Yahoo or Hotmail... as the article says, couldn't Yahoo/etc have their image generation scripts setup dynamically to check the referrer (or should I say referer? ;-)).

    I seem to recall this approach being used by online comic strips trying to prevent inline linking from elsewhere...

    --LP

    • Re:Countermeasure... (Score:2, Insightful)

      by Glog ( 303500 )
      Referer can be spoofed so that won't work. But it's very easy for a large company like Yahoo (or any company for that matter) to setup its images server as an internal server - i.e. accessible to their *own* web servers alone. However, what's to stop spammers from grabbing the image off the browser cache and literally serving it from there on other pages. I can see how the article has a point unless the images appear on a SSL page which can't be cached. But then again I think you can cache even those.
      • You could use a generated image for the captcha; something that composites two or three parts of the image. It would make copying it much harder, and your system doesn't have to be the best, it just has to be the least worst.

    • Re:Countermeasure... (Score:5, Insightful)

      by leoboiko ( 462141 ) <leoboiko@nosPaM.gmail.com> on Wednesday January 28, 2004 @09:57AM (#8112504) Homepage
      The referrer field is easily forged.

  • Technology Review (Score:2, Informative)

    by Anonymous Coward
    This was suggested in an old issue of Technology Review [technologyreview.com]

  • It really is true (Score:5, Funny)

    by The Night Watchman ( 170430 ) <{moc.liamg} {ta} {attorams}> on Wednesday January 28, 2004 @09:42AM (#8112344)
    Someone told me once that most technologies that have become successful are those technologies that assist in the dissemination of porn and/or voyeurism. Thinking about it, that's very true. Radio gave way quickly to television, which gave way to cable, and BAM! You get porn. Radio also gave way to the telephone, which gave way to party lines, and BAM! Advances in optics have brought us photography (BAM!), telescopes (BAM!), and eyeglasses (the... the porn is so CLEAR now!), to name a few. Look at the primary achievement of the 90s. The commercialization of the Internet. That's essentially a porn revolution!

    So porn is being used to break encryption. Personally, I feel there can be no other way. Porn will lead us to the greatest achievements of our day, and conversely, all roads lead to porn.

    It's our past, our present, and our future. Embrace it, or be left behind.

    • Re:It really is true (Score:3, Interesting)

      by whterbt ( 211035 )

      Parent was modded funny, but there's an odd truth to this. Consider Burt Rutan [scaled.com]'s comment [popsci.com] that porn will be the driving force behind eliminating business travel. Read it and you'll understand :).

    • There is more to what you point at. Porn is the driving force behind technology. Or, at the very least it is one of the early adopters.

      Another reply mentioned the printing press; when it was invented we started dirty books. Coincidently, there was a link [tijuanabibles.org] to some olde style smut on BoingBoing [boingboing.net] (Cory's blog) the other day.

      It goes back further. Since we started drawing on cave walls, we've been drawing titties and dicks. Ditto scupture and art. Sex lines, late night porn on TV, erotism has always been the c

  • Make it copyrighted (Score:2, Insightful)

    by sabri ( 584428 ) *
    This is a challenge for the HABEAS [habeas.com] idea (HABEAS uses a copyrighted poem to sue spammers who send spam). The pornspammers are quite obviously circumventing a security-measure. Based on the sending-IP address, aol/hotmail etc should be able to do some sueing.

  • Computer Program (Score:5, Interesting)

    by UPAAntilles ( 693635 ) on Wednesday January 28, 2004 @09:48AM (#8112408)
    The computer science department at Berkeley has already broken the Yahoo-like Captcha [berkeley.edu]. They use an algorithm to break it. They recommend "Gimpy" as a replacement, which their software has yet to crack. The blog is full of crap, the captcha is generated every session, so you can't make a link to the image like they would like because the session would end.
    • No, but you can download the image, rehost it, and keep the session open until the user enters its meaning in. Writing a proxy server isn't exactly rocket science.
      • Problem is, they have random file names like this one... sJbUl.dZFemXCqu1f8qeOpy.ugB1Ey31UpybWhHN.6lMOdVy1q P0CA-- Hard to program for methinks.
        • The html-code is there to tell what to download.

          <img src="http://reg.yimg.com/i/6L7daOdZFelAv7alu_PI4aN Moa.Vb3Xp4HKN17.f2QT8QWcAPVQdCl_XcA--.jpg" width=290 height=80 alt="" border="0">

          Then you just download the image and re-host it and show it to the user. User dechiphers the image, sends in his "registration" form and the script forwards the user's answer to the original server.

          To me this is one of those "That's so simple, why didn't I think of that" things.

    • Re:Computer Program (Score:5, Informative)

      by wedg ( 145806 ) on Wednesday January 28, 2004 @10:42AM (#8112969) Homepage Journal
      No. It's quite simple. You get the HTML (open a session), and instead of retrieving the image for the Captcha right away, you wait until someone's signing up for free porn (a few nanoseconds), then show *them* the inline image, which only needs to be loaded once in this case, they enter the code, which your script sends back as the form reply.

      I wish I'd thought of it first, I could've patented it. Or maybe someone should, so the spammers can't use it.

  • Holy crap (Score:5, Funny)

    by osgeek ( 239988 ) on Wednesday January 28, 2004 @09:50AM (#8112417) Homepage Journal
    They've harnessed the power of horniness, but for evil. If only that unlimited power could be harnessed for good -- it would be like having controlable fusion and all of the heavy water we'd ever need.

    Amazingly clever, those evil spamming bastards.
    • Well, no, you're missing the point--the people who would be generating all the energy from porn, let's just say that part of the reason this happens is that "fusion" doesn't enter anywhere into the picture.

      And as for "heavy water", well, it may be heavy and liquid, but water it ain't...
    • We should have SETI data embedded into pr0n. Free CPU cycles are nothing compaired to the yearning of the adult human.

      "Wait I think I see a pattern ... no, just another set of boobies."

  • Where? (Score:2, Insightful)

    by Bazman ( 4849 )
    Can someone show me a real example of this being used? Please. Pretty please....

  • From an insider... (Score:2, Interesting)

    by Mazzie ( 672533 )
    I can tell you that 99% of the illegal or 'gray area' activities like SPAM that go on in the online porn community are likely performed by less than 1% of the companies.

    A vast majority of operators I speak with are firmly against SPAM because it simply doesn't result in profit. For one, customers who join up as a result of SPAM, result is a much higher chargeback rate on credit card purchases, and in general being on the receiving end of traffic from SPAM is more than a nightamre dealing with 1000s of pis

  • Someone asked for a real example of this... (Score:4, Funny)

    by johnthorensen ( 539527 ) on Wednesday January 28, 2004 @09:55AM (#8112483)
    Well I don't have an example of the page, but I do happen to have one of the captcha tests they were using... :)

    Click here to decode pr0n captcha [fastsilicon.com]

    -JT

  • Countermeasure: URL in Image (Score:4, Interesting)

    by G4from128k ( 686170 ) on Wednesday January 28, 2004 @10:04AM (#8112582)
    If the captcha contained a background of additional instructions such as "To get your free account, please type in www.free-email.com/username/captchawords", then it would prevent the porn site/ spammer from seeing the results.

  • Ok new "captcha" test... (Score:5, Insightful)

    by tekiegreg ( 674773 ) * <tekieg1-slashdot@yahoo.com> on Wednesday January 28, 2004 @10:06AM (#8112602) Homepage Journal
    Rather than guess a single image, how about a feature on the page at random? For example Yahoo Mail can ask "What is the menu to the immediate right of Addresses. (which according to my Yahoo Mail screen would be "Calendar"), Or even "What company is the banner ad up top advertising" which serves 2 purposes 1) Captcha Test and 2) Ensuring the advertising is looked at :-)

    Unless a Spammer plans on building a porno site exactly like Yahoo (and incur the wrath of a zillion lawyers consequently), this would be a difficult one to counter attack (unless someone here could prove otherwise). Thoughts?
  • From the article: My cow-orker Seth Schoen points out that human-generated captchas are much harder to solve: say, picking out a photo of an animal, at a funny angle, in a cage, and challenging attackers to correctly identify it. People can do so readily, machines probably can't.

    I guess that with all the "Mad Cow Disease" threats bovines have had to turn to other professions other than being hamburgers. Clever these Holsteins!

  • I've never understood people that pay or subscribe for porn. There is simply no need. The air outside isn't really that dirty. The creepy crawlies will not bite you. You cannot get infected by talking to other people. Girls don't generally mind any of the Linux t-shirt (apart from the "I WANT TO ROOT YOU" shirts, but then, that is a scary thought). I appreciate the hands-on people of the world *arf*, but if you're the stereotypical geek who's girlfriend's surname is MPG, try looking around, it really isn't

  • Copyrights are a good thing here! (Score:3, Insightful)

    by earthforce_1 ( 454968 ) <earthforce_1&yahoo,com> on Wednesday January 28, 2004 @10:15AM (#8112671) Journal
    All they have to do is copyright the capta image, and sue the pants off anybody who uses it without permission.

    Any lawyers want to comment on this?
  • This problem would be resolved if online services charged a nominal fee for e-mail accounts. Say $1 a year, with a huge charge if the account is blatantly abused.

    Spammers who don't traffic in stolen credit cards will be shut out.

    As a countermeasure, credit card companies should monitor the $1 e-mail charges and do a courtesy call to customers. They do this already when unusual charges appear on a bill. So, most of these $1 e-mail account spammers will be shut down the first day when the credit card comp

  • Wow (Score:4, Interesting)

    by Illserve ( 56215 ) on Wednesday January 28, 2004 @10:28AM (#8112816)
    That's genius. Much as I hate spammers, I have to admire this very clever solution.

  • just added captcha (Score:5, Interesting)

    by jqh1 ( 212455 ) on Wednesday January 28, 2004 @10:35AM (#8112901) Homepage
    We *just* added captcha functionality at spamgourmet [spamgourmet.com] but we're using a random number at the end of each quizword, and we use a random filename for each image. The code just went up on sourceforge [sourceforge.net] if you want to take a look.

  • It's really true, I've seen them (Score:3, Funny)

    by mst76 ( 629405 ) on Wednesday January 28, 2004 @10:53AM (#8113105)
    Yes, I've hundreds of seen these 'captchas' in the last weeks when I was surfing, ..., uhm, ah, well, never mind.

  • Old news and incorrect data (Score:5, Informative)

    by shaftek ( 725549 ) on Wednesday January 28, 2004 @11:05AM (#8113242) Homepage
    This is ancient news, it has been mentioned by me [ietf.org] on the ASRG list in November and on my blog [blogspot.com]. The original new article was published by the Post Gazette [post-gazette.com], and found by Matt McCay in his blog [bestkungfu.com]. Liudvikas Bukys mentioned it in his blog [rochester.edu] also. You might also want to take a look at the W3C draft [w3.org] on why these visual tests do not work for disabled people. And to end this off, the basic premise of C/R is that the return address is valid. Even if spammers break these visual tests, in order to do that, they must have a valid return address - ergo, making them traceable.

    • And to end this off, the basic premise of C/R is that the return address is valid. Even if spammers break these visual tests, in order to do that, they must have a valid return address - ergo, making them traceable.

      But why do "captcha"-style visual puzzles, then? If your big concern is traceability, it seems that any old challenge/response, including a 3 digit ASCII number, would do.

      IMHO the news here is that the visual puzzles don't add anything for a clever and determined adversary. It's apparently

  • The Meatrixator (Score:3, Funny)

    by Doc Ruby ( 173196 ) on Wednesday January 28, 2004 @11:40AM (#8113595) Homepage Journal
    This brilliant design is the frontier of human/computer interaction. It creates a P2P network of human brains to crack an intractibly compute-intensive problem. We are now in the nascent Matrix, as it feeds off our organic energy. It's only a matter of time before CaptchaNet becomes selfaware. At least it has a use for us - we'll make great pets.

  • Outsourcing (Score:3, Funny)

    by Anonymous Coward on Wednesday January 28, 2004 @11:50AM (#8113704)
    I expect that soon all porn viewing jobs will be outsourced to India.

  • Hmm.. this could open a new world for Open Source (Score:3, Funny)

    by donutello ( 88309 ) on Wednesday January 28, 2004 @02:07PM (#8115126) Homepage
    We can work around IBMs patent if we come up with a way to pay Open Source developers with porn.

    Submit a patch and you'll be rewarded with 5 minutes of unlimited access.

  • Captchas can only prove human-ness (Score:4, Insightful)

    by AnotherBlackHat ( 265897 ) on Wednesday January 28, 2004 @04:30PM (#8116993) Homepage
    It's a clever idea (even if nobody has actually done it yet) but I think Captchas will always be ahead in the arms race.

    Cut and paste my Captchas? Ok, I'll embed it in a java program.
    Screen capture? I'll make it dependant on the web-site you're visiting.
    (which of these objects starts with the same letter as the third letter of my website?)

    In the end though, the best a captchas can do is prove there's a human somewhere in the loop.
    A spammer (or anyone else for that matter) could hire real people to answer them.
    Automate the non-captcha part of the signup, and you could generate several hundred accounts per hour.

    -- this is not a .sig

Slashdot Top Deals

Fast, cheap, good: pick two.

Close