What's the deal with Captchas?

How recaptcha works:

http://www.google.com/recaptcha/learnmore

Its not that one word is known to OCR readers, its that the system assumes that one word was correctly guessed earlier by multiple ‘trusted’ readers and then passes that word plus the new unknown word to the new user. Both words are hard to read with OCR.

I also dont believe the more smudgy word is always the unknown word. If so, recaptcha would be trivial to defeat. You simple cannot know which words have worked their way through recaptcha. I’ve implemented it on multiple sites and have yet to see spammers break it and everytime I’ve tried to guess which word it knew I’m wrong 50% of the time.

Oh, and to the skepticism that this isnt a win-win. All of those ‘hackers’ arent hackers at all. They’re spammers who buy turn-key spamming applications from the talented, whose talent is usually nothing more than targeting a specific captcha method and breaking it. recaptcha has just too much randomness to crack it like other methods, thanks to shoddy printing processes. Turns out entropy added from a printing press beats weird colors and shapes anyday. If this talent makes a breakthrough they wont sell it to spammers for a pittance, they’ll sell it to google or some OCR firm for big bucks.

I’ve seen plenty of second-hand evidence of reCaptcha being broken by spammers.

I’m sure its crackable, but with a high fail rate.

In this case, they used some XSS exploit.

Re-Captchas were invented by Luis von Ahn from Carnegie Mellon University. His thoughts about crowdsourcing and and human computation are very interesting. There is a ton of videos/talks to be found on youtube etc.

Something like that would explain what I’ve seen.

Not exactly broken, but lets me access certain captcha protected sites without me doing anything.
http://captchatrader.com