Color, Usability, and Security

C olor plays a major role in increasing usability in systems ranging from TV remote controls (whose buttons are highlighted in different colors to make them easy to spot) to complicated GUIs (where users’ navigation from one area to another is effectively guided by different colors). When used properly, color can greatly enhance user interface designs.1 Color in interfaces is thus typically a usability issue and has rarely led to any security failures. Here, however, we examine the use of color in CAPTCHAs (Completely Automated Public Turing Test to Tell Computers and Humans Apart),2 now a standard security mechanism that many commercial websites deploy to address spam and other online abuses. We focus on text-based CAPTCHAs, which are the most common and which rely on sophisticated distortion of text images, rendering them unrecognizable to current pattern-recognition algorithms but recognizable to human eyes. Some of our discussion is also relevant to other types of CAPTCHAs (such as image-based schemes that typically require users to perform an imagerecognition task), which we discussed in detail in our previous technical report.3 A good CAPTCHA must be humanfriendly and robust enough to resist computer programs that attackers write to automatically pass CAPTCHA tests. To strike the right balance between usability and security, designers must address many issues other than color, but these are discussed elsewhere.4 Solving the accessibility issues that CAPTCHAs cause — for instance, by exploring alternatives5 — is also important and of practical relevance, but is beyond this article’s scope (although our discussion can help improve accessibility by identifying inappropriate use of color in deployed CAPTCHAs). CAPTCHAs have commonly used color for the following reasons: