Shulou(Shulou.com)06/03 Report--

As the saying goes, "if you often walk on the Internet, how can you not verify it?" Whether we love it or hate it, who doesn't scratch his head and enter a few CAPTCHA every day?

However, in the final analysis, CAPTCHA is a passive defense countermeasure. Today, we quickly comb the development process of CAPTCHA from scratch, and introduce a very cutting-edge idea of cool techs. Change passive to active, silky: unverified CAPTCHA-- non-inductive verification.

First, why should we verify?

CAPTCHA is for anti-spam. As early as the 1990s, Yahoo Mailbox was frequently harassed by a large number of spam generated by machines, when the need to identify others / machines has emerged. Louis Fengan (Luis von Ahn) led the team to design a gadget called CAPTCHA, the idea behind which is that humans can easily recognize, but machines can recognize difficult, thus can distinguish between humans and machines.

Second, how to verify

So what's the difference between humans and machines?

The so-called CAPTCHA is Completely Automated Public Turing Test To Tell Computers and Humans Apart, that is, the public Turing test that automatically distinguishes computers from humans. Say something reasonable! )-CAPTCHA. The Turing test is the key to identification here, and simple Q & An is the most commonly used means.

The graph zero test is usually based on the verification of human knowledge (Knowledge-based authentication, KBA). The knowledge here mainly refers to the recognition of graphics and some simple analysis.

Third, attack and defense, love and hate

However, with the continuous deepening of machine recognition ability and human knowledge learning, the success rate of cracking common CAPTCHA is getting higher and higher, and the need to jump out of the "knowledge" recognition thinking pattern is becoming more and more obvious.

If you blindly pursue "the challenge of difficulty at the knowledge level", in order to cope with smarter and smarter machines, the difficulty of CAPTCHA is also increasing, and the sense of disturbance for human users is getting stronger and stronger. There is even no shortage of this completely baffling "CAPTCHA":

Therefore, it is absolutely necessary to open up new ideas to identify the unique characteristics of human beings that are difficult for machines to imitate, that is, behavior.

Google launched a "I'm not a robot" verification a few years ago, which only requires users to tick a check box in front of "I'm not a robot" on the page. the principle behind it is that Google collects and analyzes the mouse behavior of a large number of real users to determine whether it is a human operation or a machine operation.

Similarly, using the human behavior characteristics that are difficult for machines to imitate, slider verification code has attracted wide attention recently, because this verification process also does not require users to do too much thinking (calling knowledge). Moreover, it adapts to the objective condition that there is no mouse track on the mobile end, and determines whether the operator is a human or a simulated human machine by analyzing the biological characteristics such as the sliding speed and alignment position of the user's fingers.

IV. Ultimate verification: non-inductive verification

However, no matter how easy and simple it is, it will disturb the user's whole process. There is no way to do it. No verification?!

In fact, the answer is yes, now some risk control platforms have launched a verification system that can identify users without verification, and its principle is actually very simple. Before users try to log in or do other traditional operations that need to be verified, the risk control engine will scan the operating environment and analyze some key parameters, including common IP, geographical location, usage habits, malicious features, device fingerprints and so on. Based on the analysis of a large number of models and data, the risk control engine can make a pre-judgment of the user's identity. If the risk control engine thinks that the user is a "good person", it will release it directly; if it is judged as a "machine", it will not be released; if in doubt, it will give out a CAPTCHA, and you can slip.

The behavior-based verification process cooperates with risk control decisions and has several obvious advantages:

1. Block machine garbage

This is also the most original demand of the CAPTCHA itself, which is directly released after identifying the normal human user, while the machine cannot publish spam information.

2. Good user experience-- No thinking verification

In cases where verification is really needed (such as using it for the first time), unlike traditional image verification or voice verification, users can proceed smoothly to the next step in a short period of time without calculation or thinking when performing slider verification. The user experience has been greatly improved.

3. Intelligent risk blocking

The traditional verification process can not completely combat machines with increasingly strong imitation capabilities, but slider verification is closely related to risk control decisions, and machines can not pass verification after repeated attempts, which can block machine operations and intercept abnormal users. Not only spam, a variety of other harmful behaviors of machines will be intercepted, including crawling, theft and so on.

Top image non-sensing verification can resist a variety of malicious actions such as brushing orders, wool wool and so on. For more information on features and specific application scenarios, please go to Top Image Intelligent non-sense Verification > >

Extended reading:

The whole process of accessing Mini Program verification code of top video technology

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.