I wouldn't consider it invulnerable to OCR, considering the fact that only half of the captcha is actually doing validation -- the other half is digitization.
Plus, statistically a few groups have worked to break it in the past[1]. Even without breaking it programatically, buying human labor to solve them is sometimes equal or less expensive[2].
You're right that captcha farms (human labor, usually close to slave labor) allow spammers a fairly cheap method of bypassing them, but they're fairly slow (unlike OCR), not necessarily that accurate themselves, and increases the barrier required to spam. If a spammer expects to personally make $4 per 1000 advertisements posted, and if 1000 captchas costs $1, that's a massive profit loss for them.
At least from my experience, setting up reCAPTCHA on personal sites reduces spam to 0. They'll usually only spend money on captcha farms for sites that garner huge amounts of traffic, leaving smaller sites in the clear.
I think the beauty of reCAPTCHA is that if there's stronger OCR, those algorithms can be integrated into Google's book digitization system, resulting in a new version of reCAPTCHA that will only show words not recognized by this new algorithm. As a result, the captchas will get harder if there's better OCR.
Of course eventually, OCR systems will become as good as a significant fraction of the population, and then the idea breaks down.
Judging by the CAPTCHAs I've been getting lately, OCR is pretty much as good as humans. I used to always be able to solve them, but reCAPTCHAs have recently become ridiculous, requiring four or five tries to solve.
Comments
Not only is this extremely annoying, but it's usually trivial for bots to crack these new "improved" types of captchas.
reCAPTCHA is the only solution that's so far proven itself invulnerable to OCR.
I wouldn't consider it invulnerable to OCR, considering the fact that only half of the captcha is actually doing validation -- the other half is digitization.
Plus, statistically a few groups have worked to break it in the past[1]. Even without breaking it programatically, buying human labor to solve them is sometimes equal or less expensive[2].
[1]: http://arstechnica.com/security/2012/05/google-recaptcha-bro... [2]: http://www.npr.org/templates/story/story.php?storyId=1305940...
You're right that captcha farms (human labor, usually close to slave labor) allow spammers a fairly cheap method of bypassing them, but they're fairly slow (unlike OCR), not necessarily that accurate themselves, and increases the barrier required to spam. If a spammer expects to personally make $4 per 1000 advertisements posted, and if 1000 captchas costs $1, that's a massive profit loss for them.
At least from my experience, setting up reCAPTCHA on personal sites reduces spam to 0. They'll usually only spend money on captcha farms for sites that garner huge amounts of traffic, leaving smaller sites in the clear.
So what if half of reCAPTCHA is not a captcha? You still need to break the other half.
I think the beauty of reCAPTCHA is that if there's stronger OCR, those algorithms can be integrated into Google's book digitization system, resulting in a new version of reCAPTCHA that will only show words not recognized by this new algorithm. As a result, the captchas will get harder if there's better OCR.
Of course eventually, OCR systems will become as good as a significant fraction of the population, and then the idea breaks down.
Judging by the CAPTCHAs I've been getting lately, OCR is pretty much as good as humans. I used to always be able to solve them, but reCAPTCHAs have recently become ridiculous, requiring four or five tries to solve.