CAPTCHA arms race

January 1, 2007

Stories on the use of captchas and new captcha developments have been cropping up lately.  A few of the more clever ideas I’ve seen recently include:

Encoding a captcha image as an HTML table, with each cell representing one pixel (huge file size, but neat trick, if likely easy to break)

Creating animated captchas -  (there’s also a version 2 - put a 2 at the end of the previous URL to see it) - again neat trick, and likely harder to break than the table trick above, but also something which is moderately processor intensive to generate.  Also, I’d imagine for people with vision problems, it might be a little hard to use.

My thinking is that the next big thing in captchas (if it’s not being done already) will be something which asks questions which requires a bit of thought based on a picture (audio might be too difficult to incorporate at this point).

Imagine a captcha like the following

And the ‘question’ part might be more than one question, with the user selecting the question to answer, then supplying the answer.

• How many circles are there?
• How many squares are there?
• How many triangles are there?

This would require a bit more state-tracking on the server side, but is not at all impossible to do.

Take this a step further, and add in harder to process pictures, and ask some offer unrelated questions to answer:

• How many people are in the image above?
• How many pieces of fruit are in the image above?
• How many pictures of mountains are in the image above?

and so on…

My initial ’shape’ drawing attempt had some images overlapping, which would be OK if I’d been using solids, but using the outlines it created potentially more shapes to try to account for (more squares, etc.) so I think if shapes are used then solid shapes would need to be used.  However, the specifics of the picture are less important than my main point (I think!) which is that offering the user a selection of questions to attempt to answer (via a pulldown - they’d only need to answer 1 question), all of which have ‘real’ answers, but all of which require some reading and visual comprehension skills - is likely where the captcha arms race will take us.  Are we already there and i’m just not aware of these developments?

Posted in Design, Development, Ideas, Software, Web, linux, opensource