Balancing usability and security in a video CAPTCHA

ABSTRACT

We present a technique for using content-based video labeling as a CAPTCHA task. Our CAPTCHAs are generated from YouTube videos, which contain labels (tags) supplied by the person that uploaded the video. They are graded using a video's tags, as well as tags from related videos. In a user study involving 184 participants, we were able to increase the human success rate on our video CAPTCHA from roughly 70% to 90%, while keeping the success rate of a tag frequency-based attack fixed at around 13%. Through a different parameterization of the challenge generation and grading algorithms, we were able to reduce the success rate of the same attack to 2%, while still increasing the human success rate from 70% to 75%. The usability and security of our video CAPTCHA appears to be comparable to existing CAPTCHAs, and a majority of participants (60%) indicated that they found the video CAPTCHAs more enjoyable than traditional CAPTCHAs in which distorted text must be transcribed.

REFERENCES

• 1: Henry S. Baird , Kris Popat, Human Interactive Proofs and Document Image Analysis, Proceedings of the 5th International Workshop on Document Analysis Systems V, p.507-518, August 19-21, 2002
• 2: Meeyoung Cha , Haewoon Kwak , Pablo Rodriguez , Yong-Yeol Ahn , Sue Moon, I tube, you tube, everybody tubes: analyzing the world's largest user generated content video system, Proceedings of the 7th ACM SIGCOMM conference on Internet measurement, October 24-26, 2007, San Diego, California, USA [doi>10.1145/1298306.1298309]
• 3: K. Chellapilla, K. Larson, P. Y. Simard, and M. Czerwinski. Building Segmentation Based Human-friendly Human Interaction Proofs (HIPs). In Proc. HIP 2005, LNCS (2005), 1--26.
• 4: M. Chew and H. S. Baird. Baffletext: A Human Interactive Proof. In Proc. DRR 2003, IST/SPIE (2003), 305--316.
• 5: M. Chew and J. D. Tygar. Image Recognition CAPTCHAs. In Proc. ISC 2004, LNCS (2004), 268--279.
• 6: Asirra: a CAPTCHA that exploits interest-aligned manual image categorization, Proceedings of the 14th ACM conference on Computer and communications security, October 28-31, 2007, Alexandria, Virginia, USA [doi>10.1145/1315245.1315291]
• 7: Gary Geisler , Sam Burns, Tagging video: conventions and strategies of the YouTube community, Proceedings of the 7th ACM/IEEE-CS joint conference on Digital libraries, June 18-23, 2007, Vancouver, BC, Canada [doi>10.1145/1255175.1255279]
• 8: P. B. Godfrey Text-based CAPTCHA algorithms. In Proc. HIP 2002.
• 9: Philippe Golle, Machine learning attacks against the Asirra CAPTCHA, Proceedings of the 15th ACM conference on Computer and communications security, October 27-31, 2008, Alexandria, Virginia, USA [doi>10.1145/1455770.1455838]
• 10: L. A. Goodman. Snowball sampling. The Annals of Mathematical Statistics 32, 1 (1961), 148--170.
• 11: Rich Gossweiler , Maryam Kamvar , Shumeet Baluja, What's up CAPTCHA?: a CAPTCHA based on image orientation, Proceedings of the 18th international conference on World wide web, April 20-24, 2009, Madrid, Spain [doi>10.1145/1526709.1526822]
• 12: Martin J. Halvey , Mark T. Keane, Analysis of online video search and sharing, Proceedings of the eighteenth conference on Hypertext and hypermedia, September 10-12, 2007, Manchester, UK [doi>10.1145/1286240.1286301]
• 13: George W. Hart, To decode short cryptograms, Communications of the ACM, v.37 n.9, p.102-108, Sept. 1994 [doi>10.1145/182987.184078]
• 14: A. Kerckhoffs. La Cryptographie Militaire. Journal des Sciences Militaires 9, (1883), 161--191.
• 15: K. A. Kluever. Evaluating the Usability and Security of a Video CAPTCHA. Master's thesis, Rochester Institute of Technology, 2008.
• 16: Tsz-Yan Chan, Using a Text-to-Speech Synthesizer to Generate a Reverse Turing Test, Proceedings of the 15th IEEE International Conference on Tools with Artificial Intelligence, p.226, November 03-05, 2003
• 17: V. I. Levenshtein. Binary Codes Capable of Correcting Deletions, Insertions, and Reversals. Soviet Physics Doklady 10, (1966), 707--710.
• 18: J. B. Lovins. Development of a Stemming Algorithm. Mechanical Translation and Computational Linguistics 11, (1968), 22--31.
• 19: M. Naor. Verification of a human in the loop or Identification via the Turing Test. Unpublished manuscript, (1996).
• 20: John C. Paolillo, Structure and Network in the YouTube Core, Proceedings of the Proceedings of the 41st Annual Hawaii International Conference on System Sciences, p.156, January 07-10, 2008 [doi>10.1109/HICSS.2008.415]
• 21: M. F. Porter. An Algorithm for Suffix Stripping. Program 14, 3 (1980), 130--137.
• 22: Y. Rui and Z. Liu. ARTiFACIAL: Automated Reverse Turing test using FACIAL features. Multimedia Systems Journal 9, 6 (2004), 493--502.
• 23: Amalia Rusu , Venu Govindaraju, Exploiting the gap between human and machine abilities in handwriting recognition for web security applications, State University of New York at Buffalo, Buffalo, NY, 2007
• 24: A. M. Turing. Computing Machinery and Intelligence. Mind 59, 236 (1950), 433--460.
• 25: C. J. Van Rijsbergen, Information Retrieval, Butterworth-Heinemann, Newton, MA, 1979
• 26: Luis von Ahn , Manuel Blum , John Langford, Telling humans and computers apart automatically, Communications of the ACM, v.47 n.2, p.56-60, February 2004 [doi>10.1145/966389.966390]
• 27: Luis von Ahn , Laura Dabbish, Labeling images with a computer game, Proceedings of the SIGCHI conference on Human factors in computing systems, p.319-326, April 24-29, 2004, Vienna, Austria [doi>10.1145/985692.985733]
• 28: Jeff Yan , Ahmad Salah El Ahmad, A low-cost attack on a Microsoft captcha, Proceedings of the 15th ACM conference on Computer and communications security, October 27-31, 2008, Alexandria, Virginia, USA [doi>10.1145/1455770.1455839]
• 29: Jeff Yan , Ahmad Salah El Ahmad, Usability of CAPTCHAs or usability issues in CAPTCHA design, Proceedings of the 4th symposium on Usable privacy and security, July 23-25, 2008, Pittsburgh, Pennsylvania [doi>10.1145/1408664.1408671]

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.5 INFORMATION INTERFACES AND PRESENTATION (I.7)
      H.5.2 User Interfaces (D.2.2, H.1.2, I.3.6)

Additional Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection

Keywords:
Completely Automated Public Turing test to tell Computers and Humans Apart (CAPTCHA), human interactive proof (HIP), tagging, video understanding