4 ms·
Can brute force answer from the server quicky: http://en.lichess.org/captcha/0nbdeigw?solution=a1+a2 http://en.lichess.org/captcha/0nbdeigw?solution=a1+a2 retu
by bdg 14y ago
Can brute force answer from the server quicky:
http://en.lichess.org/captcha/0nbdeigw?solution=a1+a2 http://en.lichess.org/captcha/0nbdeigw?solution=a1+a2 returns either 1 or 0.
The total complexity of this to brute force is 768 possible moves.
Most of us here could write a bot to spam their site with less than 30 minutes of time and effort.
- blaabjerg 14y agoPhilistine! At least plug it into a chess AI and do it properly.
- solistice 14y agoI don't think a chess AI would offer much benefits to execution time with a brute force that is that small.
- mich41 14y agoBut serious spammers would prefer to spend this time writing a bot capable of spamming all forums based on some widely used engine. Cracking this captcha won't give you access to any significant audience.
- alexjeffrey 14y agoby this argument, the captcha would become useless as soon as it saw widespread adoption. The idea of a captcha is to be strong against bots even if it was directly targeted by spammers.
- mich41 14y agoYes, it would. But this one will never see wide adoption so it's sufficient. If every forum had a completely different captcha system, forum spam would pretty much die out.
- danielweber 14y agoNo, a captcha is supposed to get rid of spam without annoying the users. If it gets rid of lichess.com's spam without annoying the users, then it is perfect.
- shawn-butler 14y agoCAPTCHA solve a specific design problem. They are not an IETF protocol or solution to be used everywhere. That's kind of the issue. Once a CAPTCHA is worth enough it will be overcome. The problem is to design a CAPTCHA that implements just enough headache to make it worthwhile not to overcome and at the same time not frustrating users. I think this chess problem uniquely and elegantly solves the problem for the site in question by achieving both. Then again, I am not familiar with the users, maybe the site is often trolled by chess mastah wanna-bes.
- krapp 14y agoThe design itself could be improved though to make it stronger against scripting, though. For instance, there's no reason the values for the pieces and the boards necessarily need to be human-readable and to follow the notation of chess in the code itself, those variables could be randomly generated per load, perhaps with a salted hash. That could also serve as csrf protection maybe.
- alexjeffrey 14y agoif the idea of the chess captcha is to be used once on a single site, (ignoring the fact that it's a chess captcha for a chess community) it's very over engineered. Jeff Atwood gets away with a captcha where all you have to do is type "orange" to post a comment[1] and even that manages to mitigate a lot of spam. http://www.codinghorror.com/blog/2008/03/captcha-is-dead-long-live-captcha.html http://www.codinghorror.com/blog/2008/03/captcha-is-dead-lon...
- kostya-kow 14y agoOr use Rybka which can do it much quicker.
- raverbashing 14y agoBlocking bruteforce is 'easy', just make any attempts after X attempts be void for the given board/ip For the humans, just give another board (and add a time delay)
- bartl 14y agoIt's chess. You don't have to use this board to check every possible move, as any engine that knows the chess rules can verify if the result is indeed checkmate, without using this site's engine. But, basically you're right. If the bot is not using an external chess engine, it could effectively be blocked from brute force attacks the way you describe.
- tjoff 14y agoYou would do an online bruteforce? I think hundreds of moves in a few seconds kind of rule out a human... Just implement your own check-mate check if going the brute-force route.