4 ms·

Every time I read something like this I pine for never having the opportunity to turn MotionCAPTCHA[0] into a real (secure) system. Everyone said it couldn't be

Every time I read something like this I pine for never having the opportunity to turn MotionCAPTCHA[0] into a real (secure) system. Everyone said it couldn't be done, but I know it can! [0] http://www.josscrowcroft.com/demos/motioncaptcha/ http://www.josscrowcroft.com/demos/motioncaptcha/

doc4t 14y ago
Clever. Not knowing the details of how computers beat CAPTCHAa can you explain why it would be difficult to create a program to trace the path?
- StavrosK 14y ago
  I don't think it would, really...
- barik 14y ago
  I've done some research in this area with examining user input mechanics. This particular example would be solvable using B-spines [1], as one possible approach. The "path CAPTCHA" even provides some great computational hints, by indicating the starting point as a circle! http://mathworld.wolfram.com/B-Spline.html http://mathworld.wolfram.com/B-Spline.html
tripzilch 14y ago
MotionCAPTCHA doesn't actually solve the CAPTCHA problem, it just adds a hurdle for human users to your submission form. There is nothing in your "roadmap" that prevents bot spammers from trivially circumventing this hurdle. The only "protection" it offers is that, as long as MotionCAPTCHA does not become very popular, it won't be worth the effort for a bot spammer to write the circumventing code. However, you can get exactly the same amount of protection without inconveniencing your users by obfuscating field names and doing the same JavaScript form action replacing trick you already do. The simple problem is this: The challenge to properly submitting the form is tied to the fact whether your plugin has replaced the form action url to contain the right value. But this is not tied in any way to the user actually having solved the motion captcha. Which means that any bot-stopping power it possesses can also be achieved equally well without forcing the user to pass the motioncaptcha test. And while the motion captcha looks really neat and fun, it is still always a better user experience if they can submit a form without having to jump through a hoop at all.

doc4t 14y ago

Clever. Not knowing the details of how computers beat CAPTCHAa can you explain why it would be difficult to create a program to trace the path?

StavrosK 14y ago
I don't think it would, really...
barik 14y ago
I've done some research in this area with examining user input mechanics. This particular example would be solvable using B-spines [1], as one possible approach. The "path CAPTCHA" even provides some great computational hints, by indicating the starting point as a circle! http://mathworld.wolfram.com/B-Spline.html http://mathworld.wolfram.com/B-Spline.html

tripzilch 14y ago

MotionCAPTCHA doesn't actually solve the CAPTCHA problem, it just adds a hurdle for human users to your submission form. There is nothing in your "roadmap" that prevents bot spammers from trivially circumventing this hurdle. The only "protection" it offers is that, as long as MotionCAPTCHA does not become very popular, it won't be worth the effort for a bot spammer to write the circumventing code. However, you can get exactly the same amount of protection without inconveniencing your users by obfuscating field names and doing the same JavaScript form action replacing trick you already do. The simple problem is this: The challenge to properly submitting the form is tied to the fact whether your plugin has replaced the form action url to contain the right value. But this is not tied in any way to the user actually having solved the motion captcha. Which means that any bot-stopping power it possesses can also be achieved equally well without forcing the user to pass the motioncaptcha test. And while the motion captcha looks really neat and fun, it is still always a better user experience if they can submit a form without having to jump through a hoop at all.