TL;DR: This work introduces captcha, an automated test that humans can pass, but current computer programs can't pass; any program that has high success over a captcha can be used to solve an unsolved Artificial Intelligence (AI) problem; and provides several novel constructions of captchas, which imply a win-win situation.
Abstract: We introduce captcha, an automated test that humans can pass, but current computer programs can't pass: any program that has high success over a captcha can be used to solve an unsolved Artificial Intelligence (AI) problem. We provide several novel constructions of captchas. Since captchas have many applications in practical security, our approach introduces a new class of hard problems that can be exploited for security purposes. Much like research in cryptography has had a positive impact on algorithms for factoring and discrete log, we hope that the use of hard AI problems for security purposes allows us to advance the field of Artificial Intelligence. We introduce two families of AI problems that can be used to construct captchas and we show that solutions to such problems can be used for steganographic communication. captchas based on these AI problem families, then, imply a win-win situation: either the problems remain unsolved and there is a way to differentiate humans from computers, or the problems are solved and there is a way to communicate covertly on some channels.
TL;DR: In this article, the authors provided a method for user authentication, the method including receiving a username/password pair associated with a user; requesting one or more responses to a first Reverse Turing Test (RTT) and granting access to the user if a valid response to the first RTT is received and the username/ password pair is valid.
Abstract: Systems and methods are provided for authentication by combining a Reverse Turing Test (RTT) with password-based user authentication protocols to provide improved resistance to brute force attacks. In accordance with one embodiment of the invention, a method is provided for user authentication, the method including receiving a username/password pair associated with a user; requesting one or more responses to a first Reverse Turing Test (RTT); and granting access to the user if a valid response to the first RTT is received and the username/password pair is valid.
TL;DR: A new HIP algorithm based on detecting human face and facial features is proposed, suggesting that human faces are the most familiar object to humans, rendering it possibly the best candidate for HIP.
Abstract: Web services designed for human users are being abused by computer programs (bots). The bots steal thousands of free email accounts in a minute; participate in online polls to skew results; and irritate people by joining online chat rooms. These real-world issues have recently generated a new research area called Human Interactive Proofs (HIP), whose goal is to defend services from malicious attacks by differentiating bots from human users. In this paper, we propose a new HIP algorithm based on detecting human face and facial features. Human faces are the most familiar object to humans, rendering it possibly the best candidate for HIP. We conducted user studies and showed the ease of use of our system to human users. We designed attacks using the best existing face detectors and demonstrated the difficulty to bots.
TL;DR: In this article, the reverse Turing test is used to verify that the source of a potentially infected e-mail is human and not a machine, and that the message was intentionally transmitted by the apparent sender.
Abstract: E-mail which may be infected by a computer virus is advantageously filtered by incorporating a “Reverse Turing Test” to verify that the source of a potentially infected e-mail is human and not a machine, and that the message was intentionally transmitted by the apparent sender. Such a test may, for example, involve asking a question which will be easy for a human to answer correctly but quite difficult for a machine to do so. The e-mail may be deemed to be potentially infected based on an analysis of executable code which is attached to the e-mail, or merely based on the fact that executable code is attached. The e-mail may also be deemed to be potentially infected based on additional factors, such as, for example, the identity of the sender and past experiences therewith. Spam E-mail may also be advantageously filtered together with virus-containing e-mail with use of a single common filtering system.
TL;DR: The recognition rate of synthesized utterances in a noisy environment is reported to show that the performance of a HMM recognizer is not too bad even in the presence of background noise, and there seems to be a gap in the ability of understanding synthesized speech with background noise between humans and computers.
Abstract: Recognition of synthesized speech by a diphone synthesizer is thought to be easy for a machine due to the small variation of the synthesized speech. In this paper, we report the recognition rate of synthesized utterances in a noisy environment. Our experiments show that the performance of a HMM recognizer is not too bad even in the presence of background noise. These recognition results nearly approach the performance of a human. Thus, although there seems to be a gap in the ability of understanding synthesized speech with background noise between humans and computers, our results discourage using this gap to build an audio-based CAPTCHA (completely automated public Turing test to tell computers and humans apart) (i.e., a reverse Turing test which can tell computers and humans apart). Moreover, we explored the possible use of a classification and regression tree to control the hardness of our CAPTCHA.