Designing human friendly human interaction proofs (HIPs)

ABSTRACT

HIPs, or Human Interactive Proofs, are challenges meant to be easily solved by humans, while remaining too hard to be economically solved by computers. HIPs are increasingly used to protect services against automatic script attacks. To be effective, a HIP must be difficult enough to discourage script attacks by raising the computation and/or development cost of breaking the HIP to an unprofitable level. At the same time, the HIP must be easy enough to solve in order to not discourage humans from using the service. Early HIP designs have successfully met these criteria [1]. However, the growing sophistication of attackers and correspondingly increasing profit incentives have rendered most of the currently deployed HIPs vulnerable to attack [2,7,12]. Yet, most companies have been reluctant to increase the difficulty of their HIPs for fear of making them too complex or unappealing to humans. The purpose of this study is to find the visual distortions that are most effective at foiling computer attacks without hindering humans. The contribution of this research is that we discovered that 1) automatically generating HIPs by varying particular distortion parameters renders HIPs that are too easy for computer hackers to break, yet humans still have difficulty recognizing them, and 2) it is possible to build segmentation-based HIPs that are extremely difficult and expensive for computers to solve, while remaining relatively easy for humans.

References

1. Simard PY, Szeliski R, Benaloh J, Couvreur J, and Calinov I (2003), "Using Character Recognition and Segmentation to Tell Computers from Humans," Intl. Conf. on Document Analysis and Recognition (ICDAR), IEEE Computer Society, pp. 418--423, 2003.
2. Chellapilla K., and Simard P., "Using Machine Learning to Break Visual Human Interaction Proofs (HIPs)," Advances in Neural Information Processing Systems 17, Neural Information Processing Systems (NIPS'2004), MIT Press.
3. Turing AM (1950), "Computing Machinery and Intelligence," Mind, vol. 59, no. 236, pp. 433--460.
4. Von Ahn L, Blum M, and Langford J. (2004) "Telling Computers and Humans Apart (Automatically) or How Lazy Cryptographers do AI." Comm. of the ACM, 47(2):56--60.
5. First Workshop on Human Interactive Proofs, Palo Alto, CA, January 2002.
6. Von Ahn L, Blum M, and Langford J, The Captcha Project. http://www.captcha.net
7. Mori G, Malik J (2003), "Recognizing Objects in Adversarial Clutter: Breaking a Visual CAPTCHA," Proc. of Comp. Vision and Pattern Rec. (CVPR) Conf., IEEE Computer Society, vol.1, pages:I-134 - I-141, June 18-20, 2003.
8. Chew, M. and Baird, H. S. (2003), "BaffleText: a Human Interactive Proof," Proc. 10th IS&T/SPIE Doc. Reco. & Retrieval Conf., Santa Clara, CA, Jan. 22.
9. Simard, P.,Y., Steinkraus, D., Platt, J. (2003) "Best Practice for Convolutional Neural Networks Applied to Visual Document Analysis," International Conference on Document Analysis and Recognition (ICDAR), IEEE Computer Society, Los Alamitos, pp. 958--962, 2003.
10. Selfridge, O.G. (1959). Pandemonium: A paradigm for learning. In Symposium in the mechanization of thought process (pp.513-526). London: HM Stationery Office.
11. Pelli, D. G., Burns, C. W., Farrell, B., & Moore, D. C, "Identifying letters." (accepted) Vision Research.
12. Goodman J. and Rounthwaite R., "Stopping Outgoing Spam," Proc. of the 5th ACM conf. on Electronic commerce, New York, NY. 2004.

Index Terms

• Human-centered computing

  • Human computer interaction (HCI)

    • Interaction paradigms

      • Graphical user interfaces