{
  "status": "Published metadata and original synthesis; no full original source texts hosted",
  "checked_date": "2026-10-16",
  "rights": "Original concise synthesis and source links only; no original paper, transcript or slides republished",
  "articles": [
    {
      "id": "decoding-recaptcha-context",
      "title": "Decoding reCAPTCHA: what the surviving evidence establishes",
      "depth": "Abstract reviewed; video metadata linked; paper, slides and transcript not acquired",
      "source": "https://infocondb.org/con/def-con/def-con-18/decoding-recaptcha",
      "text": "Chad Houck and Jason Lee presented Decoding reCAPTCHA at DEF CON 18 in 2010. The surviving talk abstract describes research against the contemporary reCAPTCHA challenge and discusses strengthening its design. It reports a conservative 10% effectiveness figure. This is an attributed research claim, not a result independently reproduced by this archive. The abstract alone does not establish the test population, measurement denominator, implementation details or applicability to later versions. An official DEFCONConference video is linked in the catalog; its upload date is not the presentation date. Playback and transcription have not been verified here. The historical value is a concrete example of researchers testing a system intended to distinguish human activity from automation. A useful next edition needs the actual presentation or paper, followed by a careful account of the evaluated version, assumptions and limitations. Missing evidence should remain visible rather than being filled with a generic description of CAPTCHA attacks.",
      "links": [
        "https://aol.pm/conferences/records/defcon-index-18-0bd11a57d51ba424.html",
        "https://www.youtube.com/watch?v=KxBsrm-wkKs"
      ],
      "claim_status": "Reported by presenters in an indexed abstract; independently unreplicated here"
    },
    {
      "id": "captcha-comparative-evaluation",
      "title": "Why CAPTCHA evaluation needs a version and a denominator",
      "depth": "Relevant paper sections reviewed, including evaluation summary and Table 2; not a full-paper review",
      "source": "https://elie.net/publication/text-based-captcha-strengths-and-weaknesses.pdf",
      "text": "Elie Bursztein, Matthieu Martin and John C. Mitchell studied 15 text-based CAPTCHA schemes in their 2011 CCS paper. Their tool succeeded against 13 to varying degrees; Google and reCAPTCHA resisted that evaluation. The paper distinguishes segmentation, separating characters, from recognition, identifying them. It also separates coverage of attempted challenges from precision of answers. Its evaluation uses held-out examples, and its proposed 1% threshold for calling a scheme broken is a research convention rather than a universal law. This makes it useful for reading historical claims critically: a success percentage needs a defined test set and measurement. The result does not establish that every CAPTCHA was vulnerable, nor that the two resistant schemes were invulnerable. It also does not by itself refute the DEF CON 18 abstract: the evaluated versions, datasets and methods would need comparison before drawing that conclusion. This is historical research, not evidence about the security of a current service.",
      "links": [
        "https://aol.pm/taxonomy/cwe-804.html"
      ],
      "claim_status": "Published experimental results; no independent reproduction by this archive"
    },
    {
      "id": "guessable-captcha",
      "title": "Guessable CAPTCHA: a weakness broader than image recognition",
      "depth": "CWE definition and examples reviewed",
      "source": "https://cwe.mitre.org/data/definitions/804.html",
      "text": "CWE-804 describes a challenge that software can recognize or guess automatically. Weakness can arise from predictable questions, a small answer space or information exposed alongside the challenge, as well as insufficient visual or audio distortion. The consequence is that automated activity can pass a restriction intended for humans. This classification helps separate a visible symptom from its cause: an image puzzle can fail because of the surrounding implementation, not only because a machine recognizes letters. A CWE entry describes a category, while a CVE identifies a particular reported vulnerability; neither is a complete history of the subject. The date a weakness entered a taxonomy is not proof of when someone first discovered it. Catalog links should identify whether a talk actually demonstrates this weakness, merely discusses the topic, or has not been reviewed beyond its title. That distinction avoids making a taxonomy association look like a verified finding.",
      "links": [
        "https://aol.pm/taxonomy/cwe-804.html"
      ],
      "claim_status": "Taxonomy definition; application to individual talks requires source review"
    }
  ]
}