List of weakness
MTS-Bashkortostan
Found at: http://www.bashkortostan.mts.ru/mymts/sms/sending/form.php
One more with same font, same size, similar position. Easy to recognize.
MTS
Found at: http://sms.mts.ru/cgi-bin/cgi.exe?function=sms_send&isFree=1
Very interesting feature. Not bad CAPTCHA, but look to URL of the picture... it is http://sms.mts.ru/cgi-bin/cgi.exe?function=sms_show_antispam_image&ImageNumber=335&time=26206_83200_5 Do you see something interesting? :) I see the following: ImageNumber=335. Let's set couple of experiments... you can check yourself, but allowed numbers are only 3-digits. What does it mean? It means - only 1000 pictures there, and all of them are numerated! Let's calculate... I personaly can recognize near 1 picture at a second, typing it takes 1 more sec. So, to make a database with full number-message set takes near 2000 seconds, halfhour :) Work for one hour if work not too fast. And no OCR needed :)
But! We are here to see what CAPTCHA is implemented there. And it is strong enough. But beatable, of course. Weak noise, but same font.
Kyivstar (old one, v0.1)
Found at: http://www.kyivstar.net/en/sms
As UMC, it has same font, same size, same position. And still too easy to recognize. We have done it in php too.
UMC (ver 0.1)
Found at: http://www.umc.ua/umc_sendsms_u.php
Same font, same size, same position. Too easy to recognize. We even done it in php.
Euro DNS
Found at: http://www.eurodns.com/whois/whoiswindow.php?domain=eurodns.com
Super easy. Same font, same position, same size, no noise.
Human Verify series
Found at: http://www.humanverify.com/genDemo.asp
This CAPTCHA is implemented in more then 200 sites. For example: http://frontpage.velocity.net/yanc/verification.htm
http://www.selfhealingexpressions.com/cgi-bin/links/links.cgi?action=add_link
http://dot.servehttp.com/home/register.asp
http://www.naomihall.com/links.shtml
All these sites are running the risk of some spamm messages of other automated access.
ua.fm
Found at: http://ua.fm
Strong enough CAPTCHA (for this list I mean :)). Weak noise, bad fonts.
- F.A.Q.
Q: What does this list include?
A: This is the list of CAPTCHAs we found, which are easy to break, and we are either already broke it or we are absolutely sure we can do this.Q: What do you mean telling "broke"?
A: This mean that we have working application which takes image and outputs the text written on it with accuracy which allows to make automation process reasonable (or we sure we can do this).Q: Can you check CAPTCHA on my site and tell me it it's secure enough?
A: Yes, we can. Contact us.