Practical non-image based CAPTCHA approaches?

My favourite CAPTCHA ever:

Unless I'm missing something, what's wrong with using reCAPTCHA as all the work is done externally.

Just a thought.

Avoid the worst CAPTCHAs of all time.

Trivia is OK, but you'll have to write each of them :-(

Someone would have to write them.

You could do trivia questions in the same way ReCaptcha does printed words. It offers two words, one of which it knows the answer to, another which it doesn't - after enough answers on the second, it now knows the answer to that too. Ask two trivia questions:

A woman needs a man like a fish needs a?

Orange orange orange. Type green.

Of course, this may need to be coupled with other techniques, such as timers or computed secrets. Questions would need to be rotated/retired, so to keep the supply of questions up you could ad-hoc add:

Enter your obvious question:

You don't even need an answer; other humans will figure that out for you. You may have to allow flagging questions as "too hard", like this one: "asdf ejflf asl;jf ei;fil;asfas".

Now, to slow someone who's running a StackOverflow gaming bot, you'd rotate the questions by IP address - so the same IP address doesn't get the same question until all the questions are exhausted. This slows building a dictionary of known questions, forcing the human owner of the bots to answer all of your trivia questions.

I saw this once on a friend's site. He is selling it for 20 bucks. It's ASCII art!

http://thephppro.com/products/captcha/

  .oooooo.         oooooooo 
 d8P'  `Y8b       dP""""""" 
888      888     d88888b.   
888      888 V       `Y88b '
888      888           ]88  
`88b    d88'     o.   .88P  
 `Y8bood8P'      `8bd88P'   

I know that no one will read this, but what about the dog or cat CAPTCHA?

You need to say which one is a cat or a dog, machines can't do this.. http://research.microsoft.com/asirra/

Is a cool one..

What if you used a combination of the captcha ideas you had (choose any of them - or select one of them randomly):

• ASCII text captcha: //(_)//
• math puzzles: what is 7 minus 3 times 2?
• trivia questions: what tastes better, a toad or a popsicle?

with the addition of placing the exact same captcha in a css hidden section of the page - the honeypot idea. That way, you'd have one place where you'd expect the correct answer and another where the answer should be unchanged.

I have to admit that I have no experience fighting spambots and don't really know how sophisticated they are. That said, I don't see anything in the jQuery article that couldn't be accomplished purely on the server.

To rephrase the summary from the jQuery article:

1. When generating the contact form on the server ...
2. Grab the current time.
3. Combine that timestamp, plus a secret word, and generate a 32 character 'hash' and store it as a cookie on the visitor's browser.
4. Store the hash or 'token' timestamp in a hidden form tag.
5. When the form is posted back, the value of the timestamp will be compared to the 32 character 'token' stored in the cookie.
6. If the information doesn't match, or is missing, or if the timestamp is too old, stop execution of the request ...

Another option, if you want to use the traditional image CAPTCHA without the overhead of generating them on every request is to pre-generate them offline. Then you just need to randomly choose one to display with each form.

How about a CSS based CAPTCHA?

<div style="position:relative;top:0;left:0">
<span style="position:absolute;left:4em;top:0">E</span>
<span style="position:absolute;left:3em;top:0">D</span>
<span style="position:absolute;left:1em;top:0">B</span>
<span style="position:absolute;left:0em;top:0">A</span>
<span style="position:absolute;left:2em;top:0">C</span>
</div>

This displays "ABCDE". Of course it's still easy to get around using a custom bot.

If you're leaning towards the question/answer solution in the past I've presented users with a dropdown of 3-5 random questions that they could choose from and then answer to prove they were human. The list was sorted differently on each page load.

I wrote up a PHP class that lets you choose to use a certain class of Captcha Question (math, naming, opposites, completion), or to randomize which type is used. These are questions that most english-speaking children could answer. For example:

1. Math: 2+5 = _
2. Naming: The animal in this picture is a ____
3. Opposites: The opposite of happy is ___
4. Completion: A cow goes _____

This will be per-sign-up and not per-post, right? Because that would just kill the site, even with jQuery automation.

Simple maths is not the answer - the spammer doesn't even need to write a simple parser. Google will do it for them, even if you use words instead of number so it just requires a quick search on google, and it's done.

It can do text to numerical conversions easily too.

There seems to be some sort of bug in SO's rendering as it's only showing the first link when this is posted, even though preview works properly. The second link is - go to google, and search for "1 * forty-two"

If the main issue with not using images for the captcha is the CPU load of creating those images, it may be a good idea to figure out a way to create those images when the CPU load is "light" (relatively speaking). There's no reason why the captcha image needs to be generated at the same time that the form is generated. Instead, you could pull from a large cache of captchas, generated the last time server load was "light". You could even reuse the cached captchas (in case there's a weird spike in form submissions) until you regenerate a bunch of new ones the next time the server load is "light".

What about displaying captchas using styled HTML elements like divs? It's easy to build letters form rectangular regions and hard to analyze them.

How about showing nine random geometric shapes, and asking the user to select the two squares, or two circles or something.. should be pretty easy to write, and easy to use as well..

There's nothing worse than having text you cannot read properly...

I recently (can't remember where) saw a system that showed a bunch of pictures. Each of the pictures had a character assigned to it. The user was then asked to type in the characters for some pictures that showed examples of some category (cars, computers, buildings, flowers and so on). The pictures and characters changed each time as well as the categories to build the CAPTCHA string.

The only problem is the higher bandwidth associated with this approach and you need a lot of pictures that are classified in categories. There is no need to waste much resources generating the pictures.

How about just checking to see if JavaScript is enabled?

Anyone using this site is surely going to have it enabled. And from what folks say, the Spambots won't have JavaScript enabled.

CAPTCHAs check if you are human or computer. The problem is that after that a computer needs to judge whether you are human.

So a solution would be to let one user fill out a CAPTCHA and let the next user check it. The problem is of course the time gap.

One thing that is baffling is how Google, apparently the company with the most CS PHDs in the world can have their Captcha broken, and seem to do nothing about it.

The image could be created on the client side from vector based information passed from the server.

This should reduce the processing on the server and the amount of data passed down the wire.

What about audio? Provide an audio sample with a voice saying something. Let the user type what he heard. It could also be a sound effect to be identified by him.

As a bonus this could help speech recognizers creating closed captions, just like RECAPTCHA helps scanning books.

Probably stupid... just got this idea.