CAPTCHA: A robust approach to resist online password guessing attacks

Abstract

Brute force and Dictionary attacks have become an inevitable security threat to web applications today. Common measures taken to prevent online password guessing attacks like account locking mechanism are ineffective if an attacker has access to a number of compromised machines from a botnet. The main goal is to design a web application that restricts such attacks and at the same time enable convenient login to valid users. CAPTCHA (Completely Automated Public Turing Test to Tell Computers and Humans Apart) is an effective challengeresponse test to achieve this goal because of its usability and robustness. These are the tests that cannot be solved by current computer programs or bots, but are easily solvable by humans. This ensures that the account is being accessed by a human and not by an automated program. The proposed system implements a secure CAPTCHA that withstands segmentation attacks and also provides various difficulty levels in CAPTCHA design. Classification of CAPTCHA and its robustness is discussed