Leveraging human computation for pure-text human interaction proofs

Human-Interaction Proofs (HIPs) are used to mitigate automated attacks. They are assumed to be easily passed by humans but not by computers or automated programs. Security and usability have always been a critical problem for HIPs, especially when "accessibility" is a system requirement. Audio HIPs usually cannot reliably distinguish attacks from legitimate use; they are either easy, and can be automatically solved, or hard even for humans. Even though purely text-based HIPs have desirable usability and accessibility attributes; they could not overcome the security problems yet. Given the fact that fully automated techniques to generate pure-text HIPs securely do not exist, leveraging human computation for this purpose is proposed in the thesis study. In the study, the usability of a currently used pure-text HIP service, textCAPTCHA, is compared against Google's reCAPTCHA. After analyzing the results, a system called SMARTCHA is designed and implemented. SMARTCHA involves a security engine to perform automated proactive checks on the security of human-generated HIPs and also a module for combining human computation with automation to increase the number of HIP questions. HIP operators were employed in three human computation studies, in which they generated around 22,000 questions in total for SMARTCHA system. The methodology, efficiency and results of these human computation studies are analyzed in detail. The usability of SMARTCHA system is evaluated with a large user study of 372 participants. Users found solving pure-text HIPs of SMARTCHA system significantly more enjoyable than solving reCAPTCHA visual HIPs. The effects of question pre-filtering and use of automation techniques are also evaluated in the study. Results suggest that question pre-filtering reduces solving time of SMARTCHA, whereas applying automation techniques increase it. Another user study among 31 visually impaired users helped evaluation of accessibility. The study results show that SMARTCHA takes less time and is more enjoyable to solve than the new reCAPTCHA audio HIPs. Both studies suggest that pure-text HIPs could be a promising solution for secure, usable and accessible HIPs.