G-WAN Captcha Decode (opens in new tab)

This is something I find absolutely bizarre: for every person who is willing to make ridiculously exaggerated claims about something, there are thousands willing to believe them. One example which springs to mind is the "spam free wordpress" plugin[0], which claims to use "anonymous password authentication to block 100% of all comment spam with zero false positives."

As it turns out, "anonymous password authentication" means that it gives you a randomly generated string which you have to copy and paste into another box each time you submit a comment. It sounds like something a machine could do because it is something a machine could do with ease. And yet nobody seems to have noticed this for two reasons:

1) The author deletes all the comments on his blog questioning why the system works

2) It has a 4.5 star rating on the WordPress plugin DB

As a result, the author is still making ridiculously exaggerated claims about the capability of his system, like "If Gawker had been using the anonymous password authentication built into Spam Free WordPress this incident [the Gawker break-in in 2010] would not have happened." Another gem is "CAPTCHA is not used because it is hard to read, unnecessary, easily cracked, and reduces the number of real comments substantially."

So there it is, another snake-oil salesman spreading FUD and making users (of some very popular websites[1]) suffer.

[0]: http://www.toddlahman.com/spam-free-wordpress/ [1]: http://www.raspberrypi.org/

Pierre (the sole G-WAN author) says some funny things. He also defends G-WAN using dummy accounts all over the internet (StackOverflow, Reddit, Wikipedia, etc). You can respect his coding knowledge if you can force yourself to ignore his high claims and self-importance. But good job tearing the captcha apart!

I was looking at gwan with some friends a year ago, at that time it was presented as a C-script-page server. The idea of scripting with C was intriguing. But then, it just didn't work, unstable and the author claiming to be a victim of some odd spy-movie-like conspiracy.. that was really weird.. and funny somehow.

And the company name "TrustLeap" ... seriously ? http://trustleap.ch disappeared by the way.. here you go http://web.archive.org/web/20110707004226/http://www.trustle...

http://web.archive.org/web/20091028041609/http://trustleap.c...

http://web.archive.org/web/20110707004059/http://www.trustle...

Now it looks that they redesigned the site, changing target and adding new buzz words here and there (removing the obsolete buzz no one is using anymore)

see also http://news.ycombinator.com/item?id=2776927

And to be honest this king of restriction on a web server, sounds crazy:

=== “Server identification field” means the field in the response header which contains the text “Server: G-WAN/x.x.x” where “x.x.x” is the program version number.

You agree not to remove or modify the server identification field contained in the response header. ===

Funny stuff!

Well done.

Except, I'm pretty sure the gwan guys are just a very sophisticated group of trolls.

I'm going to go out on a limb and say if you test their web server yourself you'll find that their claims are false, and that the reason it's closed source is because the joke would be too obvious if we could simply take a quick look.

In any event this is all hilarious.

Now, I hope someone with the time and curiosity will do this.. and publish some actual benchmarks of gwan so this controversy can finally end.

The more I see of 'original' captchas, the more I think people should be taking the same attitude towards captchas as they do to cryptography. Just use a well known library that has proved to be hard to break by the test of time and heavy use.

[Reposted from http://news.ycombinator.com/item?id=4113609]

That example is easy to solve because it is not using any of the provided techniques that makes it more difficult for robots to solve the CAPTCHA: "changing the HTML background color based on: mouse cursor hovering, previous state or input or shared secret"

The purpose of the example is to give you a basis on which you could implement an effective CAPTCHA.

The claim of "difficult or even completely impossible for robots" applies to CAPTCHAs using the above techniques, which are not used in the example.

I didn't read through all his code...but wouldn't OP's approach only work if they used the same GIF over and over?

In any case, it seems trivially easy to break. Just capture the image. Read the background color value. Generate the image (with the background color) in ImageMagick and run through your OCR of choice. Obviously, that's not the fastest way to do it if you're trying to do thousands of attempts at once, but it's the least brainpower-involved.

I think this algorithm Captcha is optional. I'm using G-WAN, and I implemented another CAPTCHA algorithm in C. I like it when someone proves that something is unsafe. It's inspiring to improve our applications.

I've never even heard of G-WAN until now, so I guess it's working..

How about using NoCaptcha technique?

All the people who make something fantastic in some part were crazZzyYy

But G-wan author i think need chillout and start re-thinking

G wan should be OK for eq CDN

For hosters * need options to turn off script language * Support modules like in Apache * Support .httacess For me * Add fcgid but something better and more faster its posibble. Show that PHP on gwan can be balizing fast * add modules session mongodb redis etc * should be OK replacement for apache * recode version for windows for developer

Go to some IT conference run 2 machine NginX full optimized for speed + Gigagbyte network and show people how its work CPU usage request per second to compare

For Fabian Fäßler, from DC949 chat:

  <@merlin_> do we know this guy?
  ... snip ...
  <@merlin_> """Today I had my first lightning talk at #BerlinSides_0x3"""
  <@Kos> OH YEAH
  <@Kos> that adude started following me a few weeks ago
  <@C-Ps> berlin sids is pretty slick
  ... snip ...
  <@Kos> I probably  meat that dude at berlinsides
  <@Kos> erm
  <@Kos> met
  <@savant42> meat, eh?
   ... snip ...
  <@C-Ps> do you often meat men in berlin?

Thank you for providing the lulz, as well as the link to stiltwalker!