A brief analysis of Yahoo captchas

Captchas, initially a huge annoyance, are generally recognized as a necessary evil now. They stop bots from abusing your services, and there's a lot of interesting variants to use. The biggest is google's recaptcha, which is so popular even microsoft uses it occasionally. Today my attention is on Yahoo's implementation. You'll know them, they look like this:

In a nutshell: I had to type a few of these lately, and the character distribution didn't look quite right. I grabbed a hundred captchas, laboriously typed them out, and broke it down by character.


What you can't see here: Yahoo works with the traditional 'random combinations of letters and numbers' form of captcha. They use at least three different fonts, which are then physically skewed in a variety of ways. There's no additional visible interference between you and the letters, and the average length is 7.2 characters.

What you can see: Yahoo captchas use a relatively small subset of alphanumeric characters. A, B ,F ,G ,H ,J ,L ,M, T and V appear only in uppercase while c, d, e, n, p, r, s, t, y, q, y and z appear only in lowercase. Out of the numbers we have only 2, 3, 4, 5, 6, 7, and 8. This leaves 8 alphanumeric characters completely unrepresented - i, k, o, q, x, 1, 9 and 0.

Most of these seem to be omitted due to possible confusion. O, o and 0 are easily mistaken and so all are avoided, and the same goes for l/1 and K/X. Additionally, some two-character combinations which look similar to existing characters are omitted.

In this example the letter d is very easily mistaken for either 'cl' or 'ol' due to the font. However c, l, and o never appear in the captchas, presumably for this reason.. The letter p suffers similarly, while B and 8 manage to escape despite being sometimes difficult to distinguish.

I'm not entirely sure of the strategy here. They're purposefully obfuscating the word by overlapping the characters, but at the same time dramatically reducing the number of characters that could be present. By cutting down the total alphanumeric characters from 62 to 28 they're making it easier for OCR to render their technique ineffective.

RIM: Now checking your email from the wrong country

I like the way my blackberry handles multiple email accounts. RIM servers effortlessly stream my gmail traffic directly to me wherever I am, handling two-way sync, calendars and contacts with ease.

Today google forced me to re-authenticate in gmail a couple of times. A quick look at the recent activity list revealed why:

216.9.249.99 turns out to be bda-216-9-249-99.bis3.ap.blackberry.com and is the first time a foreign IP has been handling my mail for an extended period.

They have Australian servers that work perfectly well, and I cant find any notices about local downtime. I'm not entirely happy with this, we'll have to see if it stays.

Edit: A week later, It's still all Canada. Either google has reclassified all RIM IP space as physically in canada, or RIM has made a fairly drastic change to how they access your email account.

Boxify.me: A brief lesson in what privacy isn't

Boxify.me is getting a bit of press lately as a new site that allows sharing multiple files with others in 'boxes'. No sign up required; you just click on the 'start sharing' button, upload files, and share the URL around with others.

Here's their current front page.

Before I go further, I should mention this kind of sharing is inherently insecure - they make no promises about keeping your data safe and there's no password protection. Anything you put up there can be accessed by whoever has the private URL, and that's how it's designed. The only thing they specify on that page there is that your box has a 'private URL'.

That should be easy, right? All they have to do is set up robots.txt so that nobody can spider their site, after all.

Unfortunately, I'm wrong.

And as a result of that:

Now, I know what you're thinking -"That's not too big a deal, google can't find anything that's not already linked to". That's where the second mistake comes in, which is only obvious because of the first.

When you click on the link to uploads.boxify.me, you get this lovely page.

Yup. That a public xml file with hard links for the thousand most recently uploaded files. I'm not sure why the file exists, but the fact it's publicly accessible is just terrible. In 15 minutes you could knock up a shell script that regularly checks for and downloads every single file uploaded to the site.

So the outcome here: Boxify.me may turn out fine one day, but so far Loren Burton's  claims of a private URL aren't holding up.. If you don't want your files immediately available to the general internet, don't use boxify.


Interesting Sidenode: The example box they link to on the front page can also be edited by the masses. Consequently, it has naughty material for the discerning visitor.

Fringe

I finally got around to watching Fringe, after a year or two of constantly meaning to. It's a macabre but fun show where you have to suspend quite a bit of disbelief - they're always reading the memories of corpses, teleporting around, and growing single cells to the size of a greyhound. Sometimes they push my limits, but I've mostly been able to enjoy it. Then I saw this.

In their Operating System (that consists entirely of fancy maps and scrolling text), they have an IP address where every octet is over 256. This was a bit of a surprise, so I went back through the scene a little more carefully to glean a few more facts about their computer.

The text might be a bit small, but his computer is s a PIV 2.8 MMX cpu running at 3.2kMHTZ with 128000 memories. There's what seems to be a typo on the next line with the 'Plug and PLay' bios, and the rest is a nice mixing-pot of acronyms that occasionally make sense. 

Here's more of the same address type: all IP addresses, but nearly all of the numbers involved are way too big. This time they've thrown in a few token two-digit numbers, but they're clearly not using IPv4 as we know it.

It's hard to read, but that top window is full of extra IP adresses... this time consisting of 5 pairs of numbers. They've added a whole new octet but limited themselves to numbers below a hundred, which doesn't give them much more IP space to work with. The only reasonable option I can think of is that these guys are working with base 10 computers and I've uncovered a major plot point later intended for later.

It's reminds me of a cargo cult. Whoever did this knows what a computer should look like, they vaguely remember the boot screen and they liked that map in Goldeneye. It's so close at the casual glance, but wrong in every single detail. Mindbogglingly, they had to use a computer to create all of this. At some point in the process, people who know what an IP address is must have been involved. They stood by and watched somebody fake a a whole boot sequence for no good reason.

If you want to see the whole scene, you can find it here.

On the plus side, they have a rather nice Hard Drive sound effect.

Gmail forwarding security reminders

Since Gmail was first released in 2004, it's led the field in webmail security. They were the first big player to pioneer systems like two-factor authentication and geographic checking, and they've still got a few nice settings that nobody else has implemented yet - like demanding immediate verification if user activity seems suspicious rather than notifying you after the event.

But with everything else, they've always had a bit of a hole in their account security: Forwarding. Hidden away in the gmail options is a setting that will silently forward a copy of all your received email to an email address. It's incredibly useful (I've been using it since 2005), but it's a setting few people pay attention to. All an attacker would need is two minutes of access to your account - say when you wandered off to get a cup of coffee or answer the phone - and they'd have access to all your incoming emails for the indefinite future.

As of today, google seems to have addressed the issue: If you have with forwarding enabled, when you sign in there's a notification bar at the top of the screen letting you know just what those settings are and asking you to double check that they're correct. It's a fairly understated but you also can't dismiss it manually.

If you click on 'why is this notice here?' you get an explanation:
You’re seeing a notice to help you confirm that the forwarding setting that’s active on your account is accurate. If your account has this feature enabled, you should see this notice ... For about a week, this notice will appear for a few minutes each time you sign in to your account. Displaying the notification in this way helps ensure that you have a chance to see the notice, rather than someone who might try to gain unauthorized access to your account and use this setting improperly.

It's a great start, hopefully after the initial week is up it'll turn into one of their occasional reminders rather than being scrapped completely.

CD shelving

Got a pile of old CD racks lying around taking up room? Need some quickly configurable shelving space for small items? Finally, we have a solution!

Ingredients:
CD Rack
Some old crystal CD cases.

Method:
Place CD cases in CD rack at intervals. put things on them.

Finished Product:

It's surprisingly nice having shelving you can completely reconfigure in a couple of seconds. I'm guessing it'd work really well with one of those 100+ cd units - you know the ones.

Reassuring incompetence

With the world being full of  Crazy really-tough-to-remove rootkits and surprisingly realistic fake antivirus software that steals your credit card information, it can sometimes be a bit of a downer working in IT.

That's why I love it when I come across something like this at work:

Even the pros sometimes forget that computers can have two screens.