Recently I noticed that Google will be supporting audio as well as visual CAPTCHA tests. This is so that those who can’t see the screen can listen to a sound clip and fill in a code to prove they are human.
Matt May provided a great article on why you shouldn’t use CAPTCHA in 2004. I won’t repeat that, but the most relevant issues for me are that:
- It places undue burden on users. All users, but especially those with accessibility issues.
- It is not effective. People have created systems to break it in 92% of cases.
- There are better methods.
What actually prompted me to post wasn’t the audio aspect, but the fact that it’s Google. Surely Google is in an ideal position to accomplish something more effecive?
On this blog, Akismet has blocked over 10,000 spam comments by submitting them to a central service that checks the comment against a database of spam comments. If it matches, it’s caught, if it doesn’t match it might be published depending on my other criteria. Only two spam comments have gotten past Akismet, and both were caught by the secondary measures.
That kind of centralised checking mechanism is surely Google’s bread & butter of application type?
Another anti-bot tool is Bad Behaviour, which blocks access to the site depending on the properties and behaviour of the access attempt. (I don’t know all the details, but IP addresses, user agents and other aspects are all used.) Google makes use of databases of IPs already (at the very least for identifying country of origin), surely this would be a useful extension of that?
Another option would be a social networking service, which uses a web of recommended people. Gez Lemon concluded that:
There would be a lot of work required to make this foolproof, and it would also take time to establish a trustworthy community, but I think using a web service based upon social networking is a far more reasonable approach than testing for a person’s ability… which will always cause insurmountable problems to some users; that cannot be ignored.
Perhaps that’s more a Yahoo style service though? (Google tends to use computers and algorithms, Yahoo tends to use more socially oriented services.)
Google has just the kind of resources and know how to take an approach other than CAPTCHA. I’m somewhat disappointed, although not surprised.