Effective usage of Online tools for web based testing

Web Standards

• The World Wide Web Consortium (W3C) is an international consortium where Web standards are developed. Mission : To lead the WWW to its full potential by developing protocols and guidelines that ensure long-term growth for the Web
• A major chunk of the population suffers from some of the impairment. The target segment for accessibility includes – Visual, Hearing, Old age, low Literacy, low bandwidth connections
• Web Content Accessibility Guidelines (WCAG) - Explains to Web content developers how to make content accessible for people with disabilities
• Section 508 and ADA (American with Disabilities Act) are laws that govern Web accessibility in US

Browser Compatibility

• Different web browsers are created by different organizations, user-interface enhancements. The designer must devise a strategy that accounts for this possible variation to ensure that a website can still be used without the enhancement or only use features that are supported by ‘all’ browsers.
• Testing the Browser Compatibility of Web sites across various browsers and operating systems

Readability

• Readability is the measure of how easy to read and comprehend a document
• Reading level algorithms only provide a rough guide, but can give a useful indication as to whether you've pitched your content at the right level for your intended audience
• Gunning Fog, Flesch Reading Ease, and Flesch-Kincaid are reading level algorithms that can be helpful in determining how readable your content is

Web Page Speed Analysis

• Web page speed is based on page size, composition, and download time.
• Page weight is a measurement of the file size of a Web page that includes the combined size of all the elements of the page, including HTML files, images, audio or video, Flash animation, etc.
• Reducing the page weight obviously improve the performance of the web site

Tools Usage

Tools	Description
HTML Validator	To check the HTML code as per W3C standards. This validator checks the markup validity of Web documents in HTML, XHTML, SMIL, MathML etc
Link Checker	To check the Link navigations as per W3C standards. Link Checker looks for issues in links, anchors and referenced objects in a Web page, or recursively on a whole Web site
CSS Validator	To check the CSS as per W3C standards
HTML WDG	To check the HTML code as per WDG standards
Juicy Studio	To check the readability of the content of the website
Page Speed Report	To analyze Web page speed
WAVE	To check for accessibility errors as per WCAG standards

All these evaluators are available with Web Accessibility Tool Bar (WAT) 2.0 for IE.

WAT 2.0 is a Free Ware provided by Web Accessibility Tools consortium. The tool aids in manual examination of web pages for a variety of aspects of accessibility. The functions are

1.Identify components of webpage

2.Provide access to alternate views of page content

3.Facilitate use of 3rd party online applications

Along with these evaluators, WAT2.0 also features tools such as Lynx viewer, Grey scale, FAE, Contrast analyzer, Vischeck color blindness simulator, Resize etc

Other Tool

http://www.webshot.org – Free Online Tool used for Cross Browser Testing

Analysis for a XXX Website

This case study provides the effective usage of free online tools available to test the XXX Website

Evaluator	Standards	Errors	Warning
HTML	W3C	123	107
Link Checker	W3C	1	110
CSS	W3C	49	203
HTML	WDG	30	21

Not an issue: Though these errors are reported, it doesn’t affect the core functionality.

Nice to have: The ease of displaying in various browsers, PDA, Pagers etc.

* All the results reported were w.r.t the XXX Website

Accessibility analysis using WAVE

Web pages	No of Errors
Home page	29
Collection page	55
Product page	46
Shopping Cart	27
Sign in - check out	24
Recipient page	36
Billing page	48
Review order page	79

Not an issue: Within a given system configuration we will not have any issues.

Nice to Have: The web page is assured to meet WCAG standards and also accessible at any situation. (The errors reported are “Alt text” missing for the images, links, form labels. The error will be critical to access, if the page is not fully loaded.)

* Refer appendix for screen shot of WAVE Tool

Browser Compatibility

Browser	Versions	Browser	Versions
Avant	11.7	K-Meleon	(1.1.4), (1.5.0)
Chrome	(0.2.149.30), (1.0.154.65), (0.3.154.9), (0.4.154.25)	Konqueror	4.2
Epiphany	2.22	Minefield	(3.1), (3.2), (3.6)
Firefox	(0.8), (0.9), (1.0.8), (1.5),(2.0.0.4), (3.0.1), (3.1)	MSIE	(5.01), (6.0), (7.0)
Flock	(1.2.6), (2.03)	Navigator	9.0.06
Galeon	2.0.4	Safari	(3.2.1), (4.0)
Iceweasel	3.0.4	SeaMonkey	(1.1.14), (2.0)
Kazehakase	0.5.2	Shiretoko	(3.1), (3.5)
Opera	(8.0), ( 9.25), (10.0), (7.03), (7.11), (7.54), (8.54), (9.26), (9.27), (9.6), (9.62), (9.63), (9.64)

47 browsers showed positive results for the XXX Website. Almost all the widely used browsers were able to access the site

Evaluator	Value
Gunning Fox Index	10.89
Flesh Reading Ease	52.04
Flesh Kincaid Grade	6.92

 

• Gunning Fox index and Flesh Kincaid, the value represents number of schoolings required to read the content. For example if the value is sixteen, the sixteen years of schoolings is required to read the content
• For Flesh Reading Ease, the result is an index number that rates the text on a 100-point scale. The higher the score, the easier it is to understand the document. 60 – 70 is standard value and we stand at only 52.04 (Almost Near but still can reach the Standards)

Web Page Speed Analysis

Test	Units	Remarks	Status
Total HTML	1	The Total HTML should be 1	Pass
Total Objects	93	The Optimum number of object should be <20	Warning
Total Images	69	The images should be lowered for quick loading	Warning
Total CSS	5	The CSS should be lowered for quick loading	Caution
Total Size	735Kb	The optimum size should be < 100Kb	Warning
Total Script	18	The total script should be lowered for quick loading	Warning
HTML Size	67Kb	The Optimum HTML size should be <50Kb	Caution
Image Size	390Kb	The Optimum Image size should be <100Kb	Warning
Script Size	223Kb	The Optimum Script size should be <20Kb	Warning
CSS size	55Kb	The Optimum CSS Size should be <55Kb	Warning
Multi Size	0	The Multimedia size should be < 10Kb	Pass

Nice to Have: The Page size – Images, CSS, HTML can be decreased so that the pages gets loaded faster

Note: This depends on parameters like bandwidth, System Configuration etc..

Merits

The benefits on rectification of these errors are,

Clean code – Any developer could analyze the code easily.

Search Engine friendly – Search engines can track our website with ease

Faster Page Loading – A minor change can help in loading the pages quickly

Standard compliance - Publishing the standard compliance the Client can win the customer confidence

Accessibility – Easy accessibility of website across the various category of people

Once the site is W3C standard compliant, then the site shall have the W3C logo

Conclusion

• The Accessibility can be improvised to WCAG standard and open a new path for Disabled customers
• Writing web pages in accordance with the standards shortens site development time and makes pages easier to maintain. Debugging and troubleshooting become easier, because the code follows a standard
• Cross Browser testing can ensure that the Website can be used by the largest possible audience, with minimal variation in the user-experience
• The Readability Test provides prediction of the reading ease of the document with respect to sentence length and polysyllabic words. The results shall be used with Good writing style guidelines to increase the readability
• Lower page load times create more comfortable visitors. The Website brand perception will be enhanced.

Screen Shots

Web Accessibility Tool bar 2.0

WAVE report

Read More

Effective usage of Online tools for web based testing

Web Standards

• The World Wide Web Consortium (W3C) is an international consortium where Web standards are developed. Mission : To lead the WWW to its full potential by developing protocols and guidelines that ensure long-term growth for the Web
• A major chunk of the population suffers from some of the impairment. The target segment for accessibility includes – Visual, Hearing, Old age, low Literacy, low bandwidth connections
• Web Content Accessibility Guidelines (WCAG) - Explains to Web content developers how to make content accessible for people with disabilities
• Section 508 and ADA (American with Disabilities Act) are laws that govern Web accessibility in US

Browser Compatibility

• Different web browsers are created by different organizations, user-interface enhancements. The designer must devise a strategy that accounts for this possible variation to ensure that a website can still be used without the enhancement or only use features that are supported by ‘all’ browsers.
• Testing the Browser Compatibility of Web sites across various browsers and operating systems

Readability

• Readability is the measure of how easy to read and comprehend a document
• Reading level algorithms only provide a rough guide, but can give a useful indication as to whether you've pitched your content at the right level for your intended audience
• Gunning Fog, Flesch Reading Ease, and Flesch-Kincaid are reading level algorithms that can be helpful in determining how readable your content is

Web Page Speed Analysis

• Web page speed is based on page size, composition, and download time.
• Page weight is a measurement of the file size of a Web page that includes the combined size of all the elements of the page, including HTML files, images, audio or video, Flash animation, etc.
• Reducing the page weight obviously improve the performance of the web site

Tools Usage

Tools	Description
HTML Validator	To check the HTML code as per W3C standards. This validator checks the markup validity of Web documents in HTML, XHTML, SMIL, MathML etc
Link Checker	To check the Link navigations as per W3C standards. Link Checker looks for issues in links, anchors and referenced objects in a Web page, or recursively on a whole Web site
CSS Validator	To check the CSS as per W3C standards
HTML WDG	To check the HTML code as per WDG standards
Juicy Studio	To check the readability of the content of the website
Page Speed Report	To analyze Web page speed
WAVE	To check for accessibility errors as per WCAG standards

All these evaluators are available with Web Accessibility Tool Bar (WAT) 2.0 for IE.

WAT 2.0 is a Free Ware provided by Web Accessibility Tools consortium. The tool aids in manual examination of web pages for a variety of aspects of accessibility. The functions are

1.Identify components of webpage

2.Provide access to alternate views of page content

3.Facilitate use of 3rd party online applications

Along with these evaluators, WAT2.0 also features tools such as Lynx viewer, Grey scale, FAE, Contrast analyzer, Vischeck color blindness simulator, Resize etc

Other Tool

http://www.webshot.org – Free Online Tool used for Cross Browser Testing

Analysis for a XXX Website

This case study provides the effective usage of free online tools available to test the XXX Website

Evaluator	Standards	Errors	Warning
HTML	W3C	123	107
Link Checker	W3C	1	110
CSS	W3C	49	203
HTML	WDG	30	21

Not an issue: Though these errors are reported, it doesn’t affect the core functionality.

Nice to have: The ease of displaying in various browsers, PDA, Pagers etc.

* All the results reported were w.r.t the XXX Website

Accessibility analysis using WAVE

Web pages	No of Errors
Home page	29
Collection page	55
Product page	46
Shopping Cart	27
Sign in - check out	24
Recipient page	36
Billing page	48
Review order page	79

Not an issue: Within a given system configuration we will not have any issues.

Nice to Have: The web page is assured to meet WCAG standards and also accessible at any situation. (The errors reported are “Alt text” missing for the images, links, form labels. The error will be critical to access, if the page is not fully loaded.)

* Refer appendix for screen shot of WAVE Tool

Browser Compatibility

Browser	Versions	Browser	Versions
Avant	11.7	K-Meleon	(1.1.4), (1.5.0)
Chrome	(0.2.149.30), (1.0.154.65), (0.3.154.9), (0.4.154.25)	Konqueror	4.2
Epiphany	2.22	Minefield	(3.1), (3.2), (3.6)
Firefox	(0.8), (0.9), (1.0.8), (1.5),(2.0.0.4), (3.0.1), (3.1)	MSIE	(5.01), (6.0), (7.0)
Flock	(1.2.6), (2.03)	Navigator	9.0.06
Galeon	2.0.4	Safari	(3.2.1), (4.0)
Iceweasel	3.0.4	SeaMonkey	(1.1.14), (2.0)
Kazehakase	0.5.2	Shiretoko	(3.1), (3.5)
Opera	(8.0), ( 9.25), (10.0), (7.03), (7.11), (7.54), (8.54), (9.26), (9.27), (9.6), (9.62), (9.63), (9.64)

47 browsers showed positive results for the XXX Website. Almost all the widely used browsers were able to access the site

Evaluator	Value
Gunning Fox Index	10.89
Flesh Reading Ease	52.04
Flesh Kincaid Grade	6.92

 

• Gunning Fox index and Flesh Kincaid, the value represents number of schoolings required to read the content. For example if the value is sixteen, the sixteen years of schoolings is required to read the content
• For Flesh Reading Ease, the result is an index number that rates the text on a 100-point scale. The higher the score, the easier it is to understand the document. 60 – 70 is standard value and we stand at only 52.04 (Almost Near but still can reach the Standards)

Web Page Speed Analysis

Test	Units	Remarks	Status
Total HTML	1	The Total HTML should be 1	Pass
Total Objects	93	The Optimum number of object should be <20	Warning
Total Images	69	The images should be lowered for quick loading	Warning
Total CSS	5	The CSS should be lowered for quick loading	Caution
Total Size	735Kb	The optimum size should be < 100Kb	Warning
Total Script	18	The total script should be lowered for quick loading	Warning
HTML Size	67Kb	The Optimum HTML size should be <50Kb	Caution
Image Size	390Kb	The Optimum Image size should be <100Kb	Warning
Script Size	223Kb	The Optimum Script size should be <20Kb	Warning
CSS size	55Kb	The Optimum CSS Size should be <55Kb	Warning
Multi Size	0	The Multimedia size should be < 10Kb	Pass

Nice to Have: The Page size – Images, CSS, HTML can be decreased so that the pages gets loaded faster

Note: This depends on parameters like bandwidth, System Configuration etc..

Merits

The benefits on rectification of these errors are,

Clean code – Any developer could analyze the code easily.

Search Engine friendly – Search engines can track our website with ease

Faster Page Loading – A minor change can help in loading the pages quickly

Standard compliance - Publishing the standard compliance the Client can win the customer confidence

Accessibility – Easy accessibility of website across the various category of people

Once the site is W3C standard compliant, then the site shall have the W3C logo

Conclusion

• The Accessibility can be improvised to WCAG standard and open a new path for Disabled customers
• Writing web pages in accordance with the standards shortens site development time and makes pages easier to maintain. Debugging and troubleshooting become easier, because the code follows a standard
• Cross Browser testing can ensure that the Website can be used by the largest possible audience, with minimal variation in the user-experience
• The Readability Test provides prediction of the reading ease of the document with respect to sentence length and polysyllabic words. The results shall be used with Good writing style guidelines to increase the readability
• Lower page load times create more comfortable visitors. The Website brand perception will be enhanced.

Screen Shots

Web Accessibility Tool bar 2.0

WAVE report

Read More

Fighting the web robots

The internet bots have become major problem. These bots used to register for E-mail addresses that are later used to send unwanted ads, or spam, to e-mail users. CAPTCHA is a standard security technology. The most widely used CAPTCHAs rely on the sophisticated distortion of text images rendering them unrecognizable to the state of the art of pattern recognition techniques, and these text-based schemes have found widespread applications in commercial websites.

Introduction

The term "CAPTCHA" [Completely Automated Public Turing test to tell Computers and Humans ] (based upon the word capture) was coined in 2000 by Luis von Ahn, Manuel Blum, Nicholas J. Hopper and John Langford. It is a contrived acronym for "Completely Automated Public Turing test to tell Computers and Humans Apart."

A CAPTCHA system is a means of automatically generating new challenges which:

• Current software is unable to solve accurately.
• Most humans can solve
• Note: The visually disabled who rely on screen reading technology cannot solve a visual CAPTCHA, thus limiting or preventing their access to some sites.

This paper describes how security to a website can be provided using CAPTCHA to prove that they are a real person, and not just a spambot, or some other computerized agent trawling the Web for exploits.

History

In 1997 Alta Vista sought ways to block or discourage the automatic submission of URLs to their search engine. This free "add-URL" service was important to AltaVista since it broadens its search coverage. Yet some users were abusing the service by automating the submission of large number of URLS, in an effort to skew AltaVista's importance ranking algorithms.

Andrei Broder, Chief Scientist of AltaVista, and his colleagues developed a filter. Their method was to generate an image of printed text randomly so that machine vision (OCR) systems cannot read it but humans still can. A U.S. patent was issued in April 2001. In January 2002 Broder stated that the system had been in use for "over a year" and had reduced the number of "spam add-URL" by "over 95%." 

Yahoo's Chat Room Problem

In September 2000, Udi Manber of Yahoo described this "chat room problem" to researchers at CMU: 'bots' were joining on-line chat rooms and irritating the people there, by pointing them to advertising sites. How could all 'bots' be refused entry to chat rooms?

CMU's Prof. Manual Blum, Luis A. von Ahn, and John Langford articulated some desirable properties of a test, including:

• the test's challenges can be automatically generated and graded 
• the test can be taken quickly and easily by human users
• the test will accept virtually all human users with high reliability while rejecting very few
• the test will reject virtually all machine users
• the test will resist automatic attack for many years even as technology advances

CMU's CAPTCHA Research

The CMU team developed a 'hard' GIMPY CAPTCHA which picked English words at random and rendered them as images of printed text under a wide variety of shape deformations and image occlusions, the word images often overlapping. The user was asked to transcribe some number of the words correctly.

A simplified version of GIMPY (EZ GIMPYU), using only one word-image at a time, was installed by Yahoo, and is currently in use in their chat rooms to restrict access to only human users.

Need of CAPTCHA

Why would anyone need to create a test that can tell humans and computers apart?

• Let’s consider a scenario where a program is developed to create several free e-mail accounts.

This can affect millions of people across the world. These e-mail accounts can be used to spam millions of genuine users, send links to advertisements etc. If CAPTCHAs are present while registering for the free e-mail account, then it will be possible to distinguish if the user is a human or a bot. The same use will be found in several other Internet related registrations.

• Even bookings for concerts can be made to the tune of thousands with the help of computer programs.

However this cannot happen in the presence of CAPTCHAs.

Sometimes there is a possibility of the failure of the CAPTCHAs to recognise these bots.

But every CAPTCHA failure is really an advance in artificial intelligence.

• Spammers will post links back to their site in order to increase the number of links and make their site rank higher in search engines. This is called Comment spam and can be reduced through the use of a CAPTCHA.

Examples/Illustrations

Typesof CAPTCHA

• Visual Types

It’s also possible to customize the image (captcha) using our color scheme, image styles (text alignment and decoration) and the text font we like.

Simple:		Dashed:
Inclined:		Inclined & Dashed:
Horz Line:
Mixed:		Mixed & Dashed:
By choosing different colors you can create something of this type:		By choosing different fonts you can create something of this type:

• Audio Types

This is for the visually impaired and most common type of CAPTCHA.

• Problem solving Types

These require you to solve a problem that should be easy for a person but very hard for a computer to solve such as choosing which item in a list is not a bird for example, but the problem with this is that you need to have a large number of questions before it really becomes effective.

Applications

• Registration forms on Web sites often use CAPTCHAs. For example, free Web-based e-mail services like Hotmail, Yahoo! Mail or Gmail allow people to create an e-mail account free of charge. Usually, users must provide some personal information when creating an account, but the services typically don't verify this information. They use CAPTCHAs to try to prevent spammers from using bots to generate hundreds of spam mail accounts.
• Ticket brokers like TicketMaster also use CAPTCHA applications. These applications help prevent ticket scalpers from bombarding the service with massive ticket purchases for big events. Without some sort of filter, it's possible for a scalper to use a bot to place hundreds or thousands of ticket orders in a matter of seconds. Legitimate customers become victims as events sell out minutes after tickets become available. Scalpers then try to sell the tickets above face value. While CAPTCHA applications don't prevent scalping, they do make it more difficult to scalp tickets on a large scale.
• Some Web pages have message boards or contact forms that allow visitors to either post messages to the site or send them directly to the Web administrators. To prevent an avalanche of spam, many of these sites have a CAPTCHA program to filter out the noise. It will help prevent bots from posting messages automatically.
• The most common form of CAPTCHA requires visitors to type in a word or series of letters and numbers that the application has distorted in some way. Some CAPTCHA creators came up with a way to increase the value of such an application: digitizing books. An application called reCAPTCHA harnesses users responses in CAPTCHA fields to verify the contents of a scanned piece of paper. Because computers aren't always able to identify words from a digital scan, humans have to verify what a printed page says. Then it's possible for search engines to search and index the contents of a scanned document.
• Here's how it works: First, the administrator of the reCAPTCHA program digitally scans a book. Then, the reCAPTCHA program selects two words from the digitized image. The application already recognizes one of the words. If the visitor types that word into a field correctly, the application assumes the second word the user types is also correct. That second word goes into a pool of words that the application will present to other users. As each user types in a word, the application compares the word to the original answer. Eventually, the application receives enough responses to verify the word with a high degree of certainty. That word can then go into the verified pool.
• It sounds time consuming, but in this case the CAPTCHA is pulling double duty. It is not only verifying the contents of a digitized book, it's also verifying that the people filling out the form are actually people. In turn, those people gain access to the service they want to use.

Drawbacks

• One of the biggest drawbacks of CAPTCHA is that it relies on visual perception.

Users unable to view a CAPTCHA because of some disability or because they find the words are difficult to read will find CAPTCHAs difficult and also may find it hard to access the websites which make use of these CAPTCHAs for authentication.

Therefore it is suggested that sites using visual CAPTCHAs should also implement audio CAPTCHAs.

• However even with audio and visual CAPTCHAs some users may require help (users with both hearing and visual disabilities).

There have been attempts at creating CAPTCHAs that are more accessible including mathematical questions, general questions etc.

• However, none of these attempts meet both the criteria of being able to be automatically generated and not relying on the type of CAPTCHA being new to the attacker. Therefore, they are not CAPTCHAs and do not provide the protection that true CAPTCHAs provide.

Conclusion

CAPTCHA is a suitable technique to provide security and authenticate real users. However we do not live in a perfect world where all users are capable of handling these CAPTCHAs. There are those with disabilities and who may be troubled by their presence.

Sites with attractive resources and millions of users will always have a need for access control systems that limit widespread abuse. At that level, it is reasonable to employ many concurrent approaches, including audio and visual CAPTCHA, to do so. However, it must be noted that human users will fall through the cracks in these systems, and it will be necessary for sites like these to ensure that users with disabilities will have some human-operated means of interacting with a given resource in a reasonable amount of time.

An explicitly inaccessible access control mechanism should not be promoted as a solution, especially when other systems exist that are not only more accessible, but may be more effective, as well. It is strongly recommended that smaller sites adopt spam filtering and/or heuristic checks in place of CAPTCHA.

Lastly, new approaches should be found where the human users with disabilities can authenticate themselves. A short-term security benefit is not worth threatening a person's autonomy by denying them access to such important data as their finances.

References

[1] http://recaptcha.net/whyrecaptcha.html

[2] http://www.captcha.net/

[3] http://en.wikipedia.org/wiki/Captcha

[4] http://googleblog.blogspot.com/2006/11/audio-captchas-when-visual-images-are.html

[5] http://news.cnet.com/8301-17939_109-10222514-2.html

[6] http://www.answers.com/topic/captcha-1

Appendix

B

Bots…………….Web robots, www robots, bots are software applications that run automated tasks over the Internet.

I

Internet…………..The Internet is a global network of interconnected computers, enabling users to share information along multiple channels.

R

ReCAPTCHA…….An application which harnesses users’ responses in CAPTCHA fields to verify the contents of a scanned piece of paper

Acronyms

C

CAPTCHA……… Completely Automated Public Turing test to tell Computers and Humans

Apart

O

OCR………………Optical Character Recognition

U

URL………………Uniform Resource Locator

Read More

Fighting the web robots

The internet bots have become major problem. These bots used to register for E-mail addresses that are later used to send unwanted ads, or spam, to e-mail users. CAPTCHA is a standard security technology. The most widely used CAPTCHAs rely on the sophisticated distortion of text images rendering them unrecognizable to the state of the art of pattern recognition techniques, and these text-based schemes have found widespread applications in commercial websites.

Introduction

The term "CAPTCHA" [Completely Automated Public Turing test to tell Computers and Humans ] (based upon the word capture) was coined in 2000 by Luis von Ahn, Manuel Blum, Nicholas J. Hopper and John Langford. It is a contrived acronym for "Completely Automated Public Turing test to tell Computers and Humans Apart."

A CAPTCHA system is a means of automatically generating new challenges which:

• Current software is unable to solve accurately.
• Most humans can solve
• Note: The visually disabled who rely on screen reading technology cannot solve a visual CAPTCHA, thus limiting or preventing their access to some sites.

This paper describes how security to a website can be provided using CAPTCHA to prove that they are a real person, and not just a spambot, or some other computerized agent trawling the Web for exploits.

History

In 1997 Alta Vista sought ways to block or discourage the automatic submission of URLs to their search engine. This free "add-URL" service was important to AltaVista since it broadens its search coverage. Yet some users were abusing the service by automating the submission of large number of URLS, in an effort to skew AltaVista's importance ranking algorithms.

Andrei Broder, Chief Scientist of AltaVista, and his colleagues developed a filter. Their method was to generate an image of printed text randomly so that machine vision (OCR) systems cannot read it but humans still can. A U.S. patent was issued in April 2001. In January 2002 Broder stated that the system had been in use for "over a year" and had reduced the number of "spam add-URL" by "over 95%." 

Yahoo's Chat Room Problem

In September 2000, Udi Manber of Yahoo described this "chat room problem" to researchers at CMU: 'bots' were joining on-line chat rooms and irritating the people there, by pointing them to advertising sites. How could all 'bots' be refused entry to chat rooms?

CMU's Prof. Manual Blum, Luis A. von Ahn, and John Langford articulated some desirable properties of a test, including:

• the test's challenges can be automatically generated and graded 
• the test can be taken quickly and easily by human users
• the test will accept virtually all human users with high reliability while rejecting very few
• the test will reject virtually all machine users
• the test will resist automatic attack for many years even as technology advances

CMU's CAPTCHA Research

The CMU team developed a 'hard' GIMPY CAPTCHA which picked English words at random and rendered them as images of printed text under a wide variety of shape deformations and image occlusions, the word images often overlapping. The user was asked to transcribe some number of the words correctly.

A simplified version of GIMPY (EZ GIMPYU), using only one word-image at a time, was installed by Yahoo, and is currently in use in their chat rooms to restrict access to only human users.

Need of CAPTCHA

Why would anyone need to create a test that can tell humans and computers apart?

• Let’s consider a scenario where a program is developed to create several free e-mail accounts.

This can affect millions of people across the world. These e-mail accounts can be used to spam millions of genuine users, send links to advertisements etc. If CAPTCHAs are present while registering for the free e-mail account, then it will be possible to distinguish if the user is a human or a bot. The same use will be found in several other Internet related registrations.

• Even bookings for concerts can be made to the tune of thousands with the help of computer programs.

However this cannot happen in the presence of CAPTCHAs.

Sometimes there is a possibility of the failure of the CAPTCHAs to recognise these bots.

But every CAPTCHA failure is really an advance in artificial intelligence.

• Spammers will post links back to their site in order to increase the number of links and make their site rank higher in search engines. This is called Comment spam and can be reduced through the use of a CAPTCHA.

Examples/Illustrations

Typesof CAPTCHA

• Visual Types

It’s also possible to customize the image (captcha) using our color scheme, image styles (text alignment and decoration) and the text font we like.

Simple:		Dashed:
Inclined:		Inclined & Dashed:
Horz Line:
Mixed:		Mixed & Dashed:
By choosing different colors you can create something of this type:		By choosing different fonts you can create something of this type:

• Audio Types

This is for the visually impaired and most common type of CAPTCHA.

• Problem solving Types

These require you to solve a problem that should be easy for a person but very hard for a computer to solve such as choosing which item in a list is not a bird for example, but the problem with this is that you need to have a large number of questions before it really becomes effective.

Applications

• Registration forms on Web sites often use CAPTCHAs. For example, free Web-based e-mail services like Hotmail, Yahoo! Mail or Gmail allow people to create an e-mail account free of charge. Usually, users must provide some personal information when creating an account, but the services typically don't verify this information. They use CAPTCHAs to try to prevent spammers from using bots to generate hundreds of spam mail accounts.
• Ticket brokers like TicketMaster also use CAPTCHA applications. These applications help prevent ticket scalpers from bombarding the service with massive ticket purchases for big events. Without some sort of filter, it's possible for a scalper to use a bot to place hundreds or thousands of ticket orders in a matter of seconds. Legitimate customers become victims as events sell out minutes after tickets become available. Scalpers then try to sell the tickets above face value. While CAPTCHA applications don't prevent scalping, they do make it more difficult to scalp tickets on a large scale.
• Some Web pages have message boards or contact forms that allow visitors to either post messages to the site or send them directly to the Web administrators. To prevent an avalanche of spam, many of these sites have a CAPTCHA program to filter out the noise. It will help prevent bots from posting messages automatically.
• The most common form of CAPTCHA requires visitors to type in a word or series of letters and numbers that the application has distorted in some way. Some CAPTCHA creators came up with a way to increase the value of such an application: digitizing books. An application called reCAPTCHA harnesses users responses in CAPTCHA fields to verify the contents of a scanned piece of paper. Because computers aren't always able to identify words from a digital scan, humans have to verify what a printed page says. Then it's possible for search engines to search and index the contents of a scanned document.
• Here's how it works: First, the administrator of the reCAPTCHA program digitally scans a book. Then, the reCAPTCHA program selects two words from the digitized image. The application already recognizes one of the words. If the visitor types that word into a field correctly, the application assumes the second word the user types is also correct. That second word goes into a pool of words that the application will present to other users. As each user types in a word, the application compares the word to the original answer. Eventually, the application receives enough responses to verify the word with a high degree of certainty. That word can then go into the verified pool.
• It sounds time consuming, but in this case the CAPTCHA is pulling double duty. It is not only verifying the contents of a digitized book, it's also verifying that the people filling out the form are actually people. In turn, those people gain access to the service they want to use.

Drawbacks

• One of the biggest drawbacks of CAPTCHA is that it relies on visual perception.

Users unable to view a CAPTCHA because of some disability or because they find the words are difficult to read will find CAPTCHAs difficult and also may find it hard to access the websites which make use of these CAPTCHAs for authentication.

Therefore it is suggested that sites using visual CAPTCHAs should also implement audio CAPTCHAs.

• However even with audio and visual CAPTCHAs some users may require help (users with both hearing and visual disabilities).

There have been attempts at creating CAPTCHAs that are more accessible including mathematical questions, general questions etc.

• However, none of these attempts meet both the criteria of being able to be automatically generated and not relying on the type of CAPTCHA being new to the attacker. Therefore, they are not CAPTCHAs and do not provide the protection that true CAPTCHAs provide.

Conclusion

CAPTCHA is a suitable technique to provide security and authenticate real users. However we do not live in a perfect world where all users are capable of handling these CAPTCHAs. There are those with disabilities and who may be troubled by their presence.

Sites with attractive resources and millions of users will always have a need for access control systems that limit widespread abuse. At that level, it is reasonable to employ many concurrent approaches, including audio and visual CAPTCHA, to do so. However, it must be noted that human users will fall through the cracks in these systems, and it will be necessary for sites like these to ensure that users with disabilities will have some human-operated means of interacting with a given resource in a reasonable amount of time.

An explicitly inaccessible access control mechanism should not be promoted as a solution, especially when other systems exist that are not only more accessible, but may be more effective, as well. It is strongly recommended that smaller sites adopt spam filtering and/or heuristic checks in place of CAPTCHA.

Lastly, new approaches should be found where the human users with disabilities can authenticate themselves. A short-term security benefit is not worth threatening a person's autonomy by denying them access to such important data as their finances.

References

[1] http://recaptcha.net/whyrecaptcha.html

[2] http://www.captcha.net/

[3] http://en.wikipedia.org/wiki/Captcha

[4] http://googleblog.blogspot.com/2006/11/audio-captchas-when-visual-images-are.html

[5] http://news.cnet.com/8301-17939_109-10222514-2.html

[6] http://www.answers.com/topic/captcha-1

Appendix

B

Bots…………….Web robots, www robots, bots are software applications that run automated tasks over the Internet.

I

Internet…………..The Internet is a global network of interconnected computers, enabling users to share information along multiple channels.

R

ReCAPTCHA…….An application which harnesses users’ responses in CAPTCHA fields to verify the contents of a scanned piece of paper

Acronyms

C

CAPTCHA……… Completely Automated Public Turing test to tell Computers and Humans

Apart

O

OCR………………Optical Character Recognition

U

URL………………Uniform Resource Locator

Read More

Internet Screen Scraping

Abstract

Screen scraping is the act of programmatically extracting data displayed on the screen, evaluating the data and extracting the information which is required into an understandable format. This technology is widely used by search engines for collecting information from different web sites, integration tools for transferring data between systems, business intelligence for strategic business decisions, meta-search etc. The application of this technology is innumerable, but careless use can result in legal issues. This white paper is a case study on an Internet Screen Scraping solution developed for the regular Web Tasks and extracting information from any Web based systems.

Internet Screen Scraping

Screen scraping is the act of programmatically extracting data displayed on the screen, evaluating the data and extracting the information which is required into an understandable format.

There are a plethora of applications for screen scraping, sometimes this is done simply to display the information in a richer fashion and sometime to send information to another system. A common example for screen scraping is Web search engines. They use spiders which uses screen scraping for extracting and recording key words from HTML.

Screen scraping is programming that translates between legacy application programs (written to communicate with now generally obsolete input/output devices and user interfaces) and new user interfaces so that the logic and data associated with the legacy programs can continue to be used.

In this white paper, we will be discussing only about Internet Screen scraping. Internet screen scraping or Web scraping means programming that translates data between a source web application and a destination application. The source application or the application, which needs to be scraped, should be a ‘scrapable’ application. By ‘scrapable’ we mean, the application that is web based, having HTML front end that can be parsed.

For a scrapable application, the majority of the information that is of interest will be textual and can be parsed. Web applications, which are developed using Developer 2000, Java applets etc, are out of scope, as the content is not parsable. These types of applications require the conventional Screen scraping techniques (using terminal emulation, character reading etc). The scrapable web applications will be developed using the technologies like Java, JSP, ASP, .Net, and other web based technologies. Only thing to keep in mind is that the output pages of the scrapable application, generated by the web server, should be having textual content.

Why Web Scraping?



Internet Screen Scraping can be used in the following areas:

• Application Integration
  
• Data Mining and Extraction
  
• Data Migration
  
• Business Intelligence
  
• Web Task Automation
  
• Portal Components
  
• Meta-Searching
  
• Archiving

Application Integration

Organizations often have multiple web-based applications for their business process. The communication between these systems will be through manual processes and can be erroneous. Screen scraping can be used to develop bridging software that can integrate different applications, creating one application from different applications, transferring data from one system to another in real time.

• Transferring data between different systems in real time
• Bridging external applications to internal systems
• Building a single interface from many independent systems

Data Mining and Extraction

Extracting data from secure web sites require authentication, browsing to a particular web page, entering certain parameters etc. The resultant web page containing the relevant information needs to be validated, converted into a different format, inserted into a database or need to be passed to another application. For example few applications of Data Mining and extraction is given below:

• Pulling product data from multiple web sites to create meta-search sites
• Extracting news headlines to use in RSS feeds
• Archiving web pages or resources

Data Migration

Most of the legacy systems provide read only access to the data behind them. For the migration of this data to a more flexible system involves huge amount of costly manual effort and can be error prone. Data should be migrated from legacy systems without manual intervention to minimize these risks.

• Migrating data from legacy applications
• Migrating data from one application to another when upgrading

Business Intelligence

For success of a company, one has to understand their market and competitors, but information about others' products and services is valuable data that the competitor is not likely to want to share, except through a publicly accessible website.

• Comparing product listings and prices of a competitor
• Extracting news relevant to your marketplace on a routine basis
• Monitoring new products and service launch

Web Task Automation

Different web tasks like data entry in a form, testing web server’s output, monitoring business transactions etc require manual effort and web navigation. The data that needs to be entered can be from a database or other application. These tasks are tedious and error-prone. These types of activities can be automated using screen scraping. The data can be from different databases or from different other web sites.

• Monitoring of Web portals, complex transactions, transactions that require input from different other data bases or other web applications.
• Web site testing

Portal Components

Developing portal components can be a challenge when there is only a common web-interface between applications. Interfacing different applications require knowledge of the application APIs and if known creating complex middleware. Building the portal components should not affect the parent applications.

• Common look and feel across multiple applications
• Creating portlets (embedding services like weather forecast)
• Combining applications into a single interface

Meta-Searching

Meta searching is defined as the ability to search multiple web sites and judge the results. Many sites do not provide a consistent interface. For meta searching, the data from each site needs to be extracted and stored in a uniform format. This is required for search results consistency.

• Creating meta-search web portals for price matching.
• Conducting product research

Archiving

The dynamic nature of web sites results in the contents changing frequently. A snapshot of the web pages is required for archiving purpose. These snapshots should be able to store the page required at the time including the multimedia content.

• Archiving receipts of web transactions
• Building static web sites from dynamic content
• Archiving snapshots of web content for analysing historic data

A Case Study

Screen scraping is successfully implemented and widely used in day to day activities in our project . The architecture of the application is illustrated below. The design and development of this solution is indigenously done within the project.

Resources:

http://webdlabs.com/2009/05/bringing-web-scraping-to-wordpress/

Read More