Re: [cryptography] CAPTCHA as a Security System?

2012-01-03 Thread Marcus Brinkmann
On 01/03/2012 04:08 AM, John Levine wrote: unsusual, so if I were a scalper, I'd have a network of web proxies, to make it hard to tell that they're all me, a farm of human CAPTCHA breakers in Asia who cost maybe 5c per CAPTCHA, a large set of employees, friends, and relatives who will let me

Re: [cryptography] CAPTCHA as a Security System?

2012-01-03 Thread Darren J Moffat
On 01/03/12 06:54, Peter Gutmann wrote: =?UTF-8?Q?lodewijk_andr=C3=A9_de_la_porte?=lodewijka...@gmail.com writes: Our cozy dutch supermarkets are trying self-checkout systems themselves. They sometimes check carts with what's scanned. My dad's theory was that people are so afraid to have

[cryptography] CAPTCHA as a Security System?

2012-01-02 Thread Jeffrey Walton
Hi All, I was reading CAPTCHA: Using Hard AI Problems For Security by Ahn, Blum, Hopper, and Langford (www.captcha.net/captcha_crypt.pdf). I understand how recognition is easy for humans and hard for computer programs. Where is the leap made that CAPTCHA is a [sufficient?] security device to

Re: [cryptography] CAPTCHA as a Security System?

2012-01-02 Thread Marcus Brinkmann
On 01/02/2012 06:58 PM, Jeffrey Walton wrote: I was reading CAPTCHA: Using Hard AI Problems For Security by Ahn, Blum, Hopper, and Langford (www.captcha.net/captcha_crypt.pdf). I understand how recognition is easy for humans and hard for computer programs. But is that really true? My

Re: [cryptography] CAPTCHA as a Security System?

2012-01-02 Thread Jack Lloyd
On Mon, Jan 02, 2012 at 08:03:07PM +0100, Marcus Brinkmann wrote: Computer programs today are limited by attention of experts (programmers, researchers). What does hard for computer programs actually mean then? Is there a theoretical boundary that limits the abilities of computer programs to

Re: [cryptography] CAPTCHA as a Security System?

2012-01-02 Thread John Levine
The reason I ask is Wiseguy Tickets Inc and their gaming of Ticketmaster's CAPTCHA system to buy tickets [1]. Eventually, Wiseguy Tickets was indicted, and the indictment included a an assertion, [Wiseguy Tickets Inc] defeated online ticket vendors' security mechanisms [2]. I'm not convinced

Re: [cryptography] CAPTCHA as a Security System?

2012-01-02 Thread Sampo Syreeni
On 2012-01-02, Marcus Brinkmann wrote: My personal experience with CAPTCHAs is that they are increasingly hard to decipher for humans. Has the scale already tipped over in favor of computer programs? On this one I'm not ready to take any sides, but I'd like to remind you, too, that a given

Re: [cryptography] CAPTCHA as a Security System?

2012-01-02 Thread lodewijk andré de la porte
Would a security system that does not model a human attacker really qualify as a security system? If it's man-controlled it certainly does, like a ballistic missile blocking device is also security/safety. In real life security is also an analog kind of thing. Something becomes more secure.

Re: [cryptography] CAPTCHA as a Security System?

2012-01-02 Thread lodewijk andré de la porte
I'd like to add to this conversation, as a side note, that a new type of security has (fairly) recently emerged: legal security. It's illegal to break in, so we don't need security. Quite common in convenience stores, people's homes and now, the Internet. Some will find that this sort of security

Re: [cryptography] CAPTCHA as a Security System?

2012-01-02 Thread Randall Webmail
From: lodewijk andré de la porte lodewijka...@gmail.com I'd like to add to this conversation, as a side note, that a new type of security has (fairly) recently emerged: legal security. It's illegal to break in, so we don't need security. Quite common in convenience stores, people's homes and

Re: [cryptography] CAPTCHA as a Security System?

2012-01-02 Thread lodewijk andré de la porte
My neighborhood Wal*Mart has pretty much eliminated cashiers in favor of self-checkouts. Anyone so inclined could walk in, load up a cart, walk up to a self-checkout, check maybe half the items in the cart, pay for them and leave, with no one the wiser until the physical inventory didn't

Re: [cryptography] CAPTCHA as a Security System?

2012-01-02 Thread ianG
On 3/01/12 09:06 AM, lodewijk andré de la porte wrote: I'd like to add to this conversation, as a side note, that a new type of security has (fairly) recently emerged: legal security. It's illegal to break in, so we don't need security. Right. But it needs to be a break in, not a trespass.

Re: [cryptography] CAPTCHA as a Security System?

2012-01-02 Thread Nico Williams
On Mon, Jan 2, 2012 at 4:25 PM, Randall Webmail rv...@insightbb.com wrote: My neighborhood Wal*Mart has pretty much eliminated cashiers in favor of self-checkouts. [...] Wal*Mart is not stupid.   They know full well that a certain percent of shoppers will indeed walk out with a certain

Re: [cryptography] CAPTCHA as a Security System?

2012-01-02 Thread John Levine
Ticket sellers and scalpers have been been fighting since long before there was an Internet. To do much better than slow down the scalpers Ticketmaster would have to either do a lot of work (with payments system providers' help) to ensure that payments are not anonymous and that the there is one

Re: [cryptography] CAPTCHA as a Security System?

2012-01-02 Thread Nico Williams
On Mon, Jan 2, 2012 at 9:08 PM, John Levine jo...@iecc.com wrote: [...].  One of the advantages of having a working legal system is so that we can live reasonable lives with $20 locks in our doors, rather than all having to spend thousands to armor all the doors and windows, like they do in

Re: [cryptography] CAPTCHA as a Security System?

2012-01-02 Thread Jonathan Thornburg
On Mon, 3 Jan 2012, John Levine wrote: Scalping can be very profitable, with markups of $100 per ticket not unsusual, so if I were a scalper, I'd have a network of web proxies, to make it hard to tell that they're all me, a farm of human CAPTCHA breakers in Asia who cost maybe 5c per CAPTCHA,

Re: [cryptography] CAPTCHA as a Security System?

2012-01-02 Thread Peter Gutmann
Randall Webmail rv...@insightbb.com writes: My neighborhood Wal*Mart has pretty much eliminated cashiers in favor of self-checkouts. Anyone so inclined could walk in, load up a cart, walk up to a self-checkout, check maybe half the items in the cart, pay for them and leave, with no one the wiser

Re: [cryptography] CAPTCHA as a Security System?

2012-01-02 Thread Peter Gutmann
=?UTF-8?Q?lodewijk_andr=C3=A9_de_la_porte?= lodewijka...@gmail.com writes: Our cozy dutch supermarkets are trying self-checkout systems themselves. They sometimes check carts with what's scanned. My dad's theory was that people are so afraid to have forgotten that they'd most likely scan their

Re: [cryptography] CAPTCHA as a Security System?

2012-01-02 Thread Randall Webmail
From: Peter Gutmann pgut...@cs.auckland.ac.nz To: cryptography@randombit.net, rv...@insightbb.com Sent: Tue, 03 Jan 2012 01:51:26 -0500 (EST) Subject: Re: [cryptography] CAPTCHA as a Security System? Randall Webmail rv...@insightbb.com writes: My neighborhood Wal*Mart has pretty much eliminated

Re: [cryptography] CAPTCHA as a Security System?

2012-01-02 Thread Thor Lancelot Simon
On Tue, Jan 03, 2012 at 01:57:10AM -0500, Randall Webmail wrote: There is one girl (and it is always a girl) who is at the control center. She comes to the checkout station to override the system when the shopper scans beer. No one watches to see if you scan every item in your cart.

Re: [cryptography] CAPTCHA as a Security System?

2012-01-02 Thread Randall Webmail
From: Thor Lancelot Simon t...@panix.com To: Randall Webmail rv...@insightbb.com Cc: Crypto List cryptography@randombit.net Sent: Tue, 03 Jan 2012 01:58:46 -0500 (EST) Subject: Re: [cryptography] CAPTCHA as a Security System? On Tue, Jan 03, 2012 at 01:57:10AM -0500, Randall Webmail wrote