Best practices for CAPTCHA design?

[Sulabh Bista]

Dear all:

I am working on an authentication system that will utilize CAPTCHA to prevent brute force attack. Instead of using CAPTCHA solutions from the web, i am trying to develop my own implementation. I am using the PHP GD library. I am done with the session management thing. Has anyone already worked on this project and can offer me some help? I would also want to know about the basics of computer vision and how some bots are able to crack CAPTCHAs.

Regards,
Sulabh Bista

[nepbabu]

On Sunday, 1 June 2008 at 1:08:08 +0545, Sulabh Bista wrote:
> Dear all:
>
> I am working on an authentication system that will utilize CAPTCHA to
> prevent brute force attack. Instead of using CAPTCHA solutions from the web,
> i am trying to develop my own implementation. I am using the PHP GD library.
> I am done with the session management thing. Has anyone already worked on
> this project and can offer me some help? I would also want to know about the

> basics of computer vision and how *some *bots are able to crack CAPTCHAs.

Below is more of "how to get there" sort of answer so if you've already got answer for it, ditch it or else read on.

I suppose the best way to get answer is to ask in their respective ML / Newsgroup etc. IRC is also a good option. One way -> Sit simultaneously on say #security and #php, then try to ask people questions relating to how an attacker might circumvent the captcha using automated bots etc. Try to ask questions as much as you can and learn how things are done and as freenode is pretty cool about all this. You should get upto speed with how to prevent it.

Sorry, can't be of much help. Also, try Googling and ask our friends @ nepsecure GG.

cheers

[Sulabh Bista]

Thanks for the how-to Nepbabu :)

Regards,
Sulabh Bista