Welcome to CrankyGoblin.Com Sign in | Join | Help

Public Class GeoffAppleby

Inherits Microsoft.VisualBasic.MVP : Implements IBrainFart
Thinking Captcha

Update: The source is now live! 

I never thought I'd do it, but the day has arrived. I'm starting to get enough blog spam, at a consistent rate, that I need to start thinking about prevention.

But I hate captcha controls. They're all so hard to read.

So I had an idea. How can I make it easy to use, but still require specific input from users so that automated spam posters get blocked? You make it point and click, instead of type :)

 This is a rough prototype. I know they're lifelike, but those faces are not actually me, but only hand drawn stunning likenesses.

But anyway, here's me plan.

I store a few different pictures of my head somewhere. And then everytime the comment form is loaded, it randomly picks some of the pictures (say, 5 or 6). It then, from those six, randomly picks 2 or 3. To submit the comment, you have to click on those 2 or 3 pictures of me (some JavaScript highlights them as they are clicked). When it's submitted, the selections are compared to the correct ones, and it's all good.

I'm interested to find out just how complex things need to be to stop automated systems from spamming me. This (in my head at least) seems simple enough.

So keep an eye out. I've made the mods to the CS datalayer to get the image info. I've created the extra DB table. I've got the html about rendered. I just need to write the javascript, create some better images, and update the admin interface so I can register images without sitting in query analyzer.

Anyone have any comments? Am I taking the wrong approach?

I just really hate those hard to read images with dodgy writing :)

Posted: Thursday, 12 October 2006 8:07 PM by Geoff Appleby

Comments

Jordana said:

will this be for my blog too or just yours?

# October 12, 2006 3:29 AM

Geoff Appleby said:

Yours too if you want it. *nods*

# October 12, 2006 3:41 AM

Dave Burke said:

I have nothing to add but "Genius.  Pure genius!"

# October 12, 2006 10:21 AM

Dave Burke said:

Oh, one suggestion.  Don't forget to show some tongue!

# October 12, 2006 10:22 AM

Community Server Daily News said:

news of the day a grab bag for what's happening in Community Server The San Francisco MeetUp on the night

# October 12, 2006 12:15 PM

MattyT said:

I like it.  :)

One potential way around it is that automated spammers could just iterate through the images until success.  There are a few ways around that but here's one:  Munge all the images together so that it's just one bigger image.  Record the pixels of where the individual images are located and use the coordinates of where the user clicks to do the check.

If you make the images different sizes it'll be especially hard to fool (automated spammer wouldn't know how many options there are).  You could also add noise to the images to make it harder to detect image boundaries.

Javascript highlighting would be trickier.

It would be tough to make stateless (you'd have to record the individual image's locatation within the big image).

Anyway, just thinking out loud - which means that it's an interesting idea - get to it!  ;)

# October 12, 2006 5:26 PM

Geoff Appleby said:

Dave: Thanks man. It's not worth doing if it's doesn't have the burkelizer seal of approval :)

Matty: That sounds like too much work *grin* although a very suitable fallback if V1 fails to fool em.

I did some work on it last night and this morning, and i've come much further. It now actually works :)

I still need to take some pictures of myself, and there's no management interface yet (hard coded for the numbers so far, images a registered in query analyser, and the images that _are_ there at the moment are 404ing, but the principal code has been written.  On my local mirror of crankygoblin, my blog won't accept comments unless i click the correct two out of 5 pictures.

I've also started thinking about combinations and permutations. there needs to be enough combinations that it's not easy to 'guess' but few enough that it's easy for legit users.

So i've pretty much decided on the 3 rows of 3 images, with 3 images needing to be clicked. I'll see how it goes, but that should do for now.

# October 12, 2006 5:42 PM

Daily News Faq List said:

Australia's Geoff Appleby presents the Captcha of Tomorrow.

# November 22, 2006 8:07 AM

Community Server Bits said:

Australia's Geoff Appleby presents the Captcha of Tomorrow.

# March 12, 2007 5:47 AM
Leave a Comment

(required) 

(required) 

(optional)

(required) 

To submit your comment, click on these pictures:
  • Tickle Me Geoff-Mo
  • Hairy Geoff
  • Happy Geoff
Gaptcha Image - No Peeking! Gaptcha Image - No Peeking! Gaptcha Image - No Peeking!
Gaptcha Image - No Peeking! Gaptcha Image - No Peeking! Gaptcha Image - No Peeking!
Gaptcha Image - No Peeking! Gaptcha Image - No Peeking! Gaptcha Image - No Peeking!
Can't recognise the people in these pictures? Look here for a quick introduction.
There's a time limit for you to get your comment submitted before this set of pictures expires. If you think it's been longer than 10 minutes, get some new pictures first (you won't lose what you've typed so far).
Get some new pictures 

Comment Notification

If you would like to receive an email when updates are made to this post, please register here

Subscribe to this post's comments using RSS