Towards designing robust CAPTCHAs

Article type: Research Article

Authors: Lorenzi, David^a | Uzun, Emre^a | Vaidya, Jaideep^{a; *} | Sural, Shamik^b | Atluri, Vijayalakshmi^a

Affiliations: [a] Management Science and Information Systems Department, Rutgers University, USA. E-mails: [email protected], [email protected], [email protected], [email protected] | [b] Department of Computer Science and Engineering, Indian Institute of Technology, Kharagpur, India. E-mail: [email protected]

Correspondence: [*] Corresponding author. E-mail: [email protected].

Abstract: CAPTCHAs are reverse Turing tests that aim to distinguish between human and non-human online participants. CAPTCHAs enable site administrators to determine if a particular user is a legitimate human or a bot, and grant or deny them access to resources accordingly, thus preventing abuse of resources. However, given the incentive to break or circumvent CAPTCHAs, they must also evolve alongside advances in machine learning tools and techniques to continue providing security for online services. In this paper, we present the essential design criteria for building robust CAPTCHAs and thus provide a general framework for evaluating a specific CAPTCHA design. We then develop several new CAPTCHA exemplars, and analyze them from this perspective to show how design decisions impact different evaluation parameters. We also provide an overview of a new security method that can be applied to any image CAPTCHA and present the results of the evaluation of one of the most promising image based CAPTCHAs with a comprehensive user study.

Keywords: CAPTCHA, user study, design requirements, web security, authentication

DOI: 10.3233/JCS-17947

Journal: Journal of Computer Security, vol. 26, no. 6, pp. 731-760, 2018