Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chess CAPTCHA

en.lichess.org

Post reply on HN
Print view View original

11–20 of 171 posts

Re: Chess CAPTCHA

#11

Post by jimktrains2 »

TheBiv wrote: post #9
jimktrains2 wrote: post #6

What's with the "Ping" at the bottom of the page. Why would someone do that?

A quick google gives this; apparently from the creator. "I[t] tells how fast your computer talks with lichess server. It measures the time a message needs to make the round trip from your browser to lichess, then from lichess to your browser. I'm interrested in knowing what your ping is, depending on the country/city where you live. I live in Le Mans, France, and my ping is around 30-40ms. What about you?" {source} h…

I know what a ping is. Why would someone do that on a website? It just seems pointless and causes additional load on the server.

Re: Chess CAPTCHA

#12

Post by C1D »

throwaway125 wrote: post #7
C1D wrote: post #2

It really isn't that secure since a bot could be used to calculate the checkmate and it takes more time than a normal CAPTCHA.

That is definitely true, it's not good enough to secure yourself against a persistent attacker but I do think it's a good captcha: It's a topical captcha that the target audience of the site will recognize and most likely enjoy. It's significantly different from any other captcha so that automated untargeted bots will not be able to beat it It has a high enough entropy that untargeted bots that repeatedly attempt to…

I have to agree with most if not all of those points but for some people that don't know how to play chess it would be harder. I thinks is pretty innovative but I definitely wouldn't try to release it publicly as an attack could easily use a DOM parser to bypass it.

Re: Chess CAPTCHA

#13

Post by calopetreep »

mooism2 wrote: post #5
benjoffe wrote: post #3

This looks like a clever solution to the problem for lichess, at least until someone plugs together a relatively simple bot with 100% success rates. Though, just because it can be cracked easily doesn't necessarily demerit it, perhaps their biggest problem is random untargetted bots, in which case this is great (the argument that it could take longer isn't really important to people on a chess forum).

It also keeps out beginners. Depending on the forum (I'm not familiar with lichess) that might be a drawback or a bonus.

The captcha seems very easy (I am not a chess player)- I tried three times and always got a board to solve in one move, so I doubt anyone that knows the rules of chess is going to be excluded. That's probably not a problem for this forum :)

Re: Chess CAPTCHA

#14

Post by TheBiv »

jimktrains2 wrote: post #11
TheBiv wrote: post #9

Earlier quoted context omitted.

A quick google gives this; apparently from the creator. "I[t] tells how fast your computer talks with lichess server. It measures the time a message needs to make the round trip from your browser to lichess, then from lichess to your browser. I'm interrested in knowing what your ping is, depending on the country/city where you live. I live in Le Mans, France, and my ping is around 30-40ms. What about you?" {source} h…

I know what a ping is. Why would someone do that on a website? It just seems pointless and causes additional load on the server.

My apologies Jim, as I was not trying to insult your intelligence.

I did not know the answer, but that is the answer given by the creator and it leaves a lot to be desired. His answer appears to indicate that he just did it for shits and giggles.

Re: Chess CAPTCHA

#15

Post by NamTaf »

I thought image recognition on that would be trivially easy to compute? You could identify each piece, then just analyse it to work out the 1 move. As a layman, it seems less computationally difficult to solve that than a state-of-the-art captcha currently?

Re: Chess CAPTCHA

#16

Post by krapp »

C1D wrote: post #2

It really isn't that secure since a bot could be used to calculate the checkmate and it takes more time than a normal CAPTCHA.

For it to even be nominally effective, the state of play would need to be non-scriptable - but the piece types, positions, number of necessary moves are all available in the DOM (and some in handy data statements no less). And it appears to post by ajax to a url which returns a boolean for success or failure. And it lets you retry. So yeah, other than being pretentious about chess it would appear to be more or less pointless at actually detecting whether someone is a human or a bot.

Re: Chess CAPTCHA

#19

Post by mich41 »

C1D wrote: post #2

It really isn't that secure since a bot could be used to calculate the checkmate and it takes more time than a normal CAPTCHA.

> it takes more time than a normal CAPTCHA

Most of these captchas are very easy. If the targeted king was easier to spot (e.g. marked red) I'm sure I would solve them faster than the omnipresent reCaptchas (even knowing that I only need to type the less legible word).

Re: Chess CAPTCHA

#20

Post by lifebar »

jimktrains2 wrote: post #11
TheBiv wrote: post #9

Earlier quoted context omitted.

A quick google gives this; apparently from the creator. "I[t] tells how fast your computer talks with lichess server. It measures the time a message needs to make the round trip from your browser to lichess, then from lichess to your browser. I'm interrested in knowing what your ping is, depending on the country/city where you live. I live in Le Mans, France, and my ping is around 30-40ms. What about you?" {source} h…

I know what a ping is. Why would someone do that on a website? It just seems pointless and causes additional load on the server.

Might have something to do with the fact that you can play timed chess on that website. Time compensation due to high ping and such.... Just a guess.
Post reply on HN