Hello! I'm Miquel the author of Doom Captcha Thanks jukkakoskknen for sharing it on HN and everyone here talking about it, I hope you enjoy it :)
Thank you for creating it. :)
DOOM Captcha
131–140 of 178 posts
Re: DOOM Captcha
#132Earlier quoted context omitted.
How does that work if you want to grow your hobby or group? And if it’s something between friends why not use a private whatsapp group or IRC
Speaking for myself, if was a little bigger than 20 members (around 100). The thing is that we wanted to keep the forum open to everyone, at least for the public parts. That's why I went with invisible tweaks (mostly just renaming fields) instead of a challenge. But I could have came up with a challenge that anyone interested in our forum would have known. We were a rhythm games club, so a questions could have been "…
My first thought would have been Osu or EBA (Elite Beat Agents), different type of rhythm game.
Re: DOOM Captcha
#133[deleted]
Re: DOOM Captcha
#134Earlier quoted context omitted.
It mostly depends on what you are trying to protect with your CAPTCHA. When I managed a small phpbb forum, all I had to do was to change a few lines in the register page to make it non-standard and it stopped all bots. Better than the built-in CAPTCHA. Simply, no one cared enough about our forum to write a specialized tool, no matter how easy it was. If it is all you have to protect, go ahead with your clever ideas,…
When I managed a purely Danish forum, i simply added a textbox and asked the user to write ‘æ’ in it. Never saw any spam after that.
I feel like you could have just asked them to type 'a'. If the threat was automated bots, all generic ones are defeated by a simple "do X" request. Especially if the request was in text, where a lazy human attacker could just copy paste.
Re: DOOM Captcha
#135While this is too simple (even the website admits that a bot could be written in virtually no time to break it), it does make me wonder if you could have a WarioWare CAPCHA. A minigame with extremely vague description that you have to react to quickly to pass. Thinking about it some more it fails the primary criteria for a CAPCHA: it needs to be harder to write the bot that cracks it than each test case, by at least…
The DOOM Captcha is just using html/css/js so it's easy for bots to crack with simple DOM querying/manipulation in an automated browser. But what if canvas was used instead? > A minigame with extremely vague description that you have to react to quickly to pass. I dont know how advanced current bots are at breaking captchas these days but if you're using a canvas then they would have to use some kind of image/video p…
I believe a simple JS browser extension or automation script could easily ask about every pixel in the canvas. For this case I suspect it would be very easy to iterate over each row of pixels looking for a few consecutive pixels that uniquely match the monster and then trigger a click on those coordinates.
Re: DOOM Captcha
#136While this is too simple (even the website admits that a bot could be written in virtually no time to break it), it does make me wonder if you could have a WarioWare CAPCHA. A minigame with extremely vague description that you have to react to quickly to pass. Thinking about it some more it fails the primary criteria for a CAPCHA: it needs to be harder to write the bot that cracks it than each test case, by at least…
The DOOM Captcha is just using html/css/js so it's easy for bots to crack with simple DOM querying/manipulation in an automated browser. But what if canvas was used instead? > A minigame with extremely vague description that you have to react to quickly to pass. I dont know how advanced current bots are at breaking captchas these days but if you're using a canvas then they would have to use some kind of image/video p…
For traditional text captchas, bots are better than humans. Flow usally goes, pay humans to solve 50000 ($500) then train an ML model. For things like recaptcha things get harder because it is not easy to proxy the captcha puzzles to have humans solve them (which is nessary to collect training data).
Re: DOOM Captcha
#137Earlier quoted context omitted.
Why not something computationally expensive? Bcrypt this value 10000 times to continue
Ideally you'd have something that's hard for the client but easy for the server to verify, though. so maybe prime factoring?
Or, the server provides a random string of bits with length n and requires a string of bits with length n+m that starts with the provided n bits and whose SHA-1 hash begins with 20 zero bits.
Re: DOOM Captcha
#138While this is too simple (even the website admits that a bot could be written in virtually no time to break it), it does make me wonder if you could have a WarioWare CAPCHA. A minigame with extremely vague description that you have to react to quickly to pass. Thinking about it some more it fails the primary criteria for a CAPCHA: it needs to be harder to write the bot that cracks it than each test case, by at least…
The DOOM Captcha is just using html/css/js so it's easy for bots to crack with simple DOM querying/manipulation in an automated browser. But what if canvas was used instead? > A minigame with extremely vague description that you have to react to quickly to pass. I dont know how advanced current bots are at breaking captchas these days but if you're using a canvas then they would have to use some kind of image/video p…
> The DOOM Captcha is just using html/css/js so it's easy for bots to crack with simple DOM querying/manipulation in an automated browser.
I mean, if you're looking at it at that level, it's just giving a "didn't pass" callback. A bad actor could just ignore that, and not care about it.
Without some sort of server side verification of the result, it doesn't really matter how difficult it is to script through the game itself. Even some crazy hard game in canvas isn't any more difficult for a bot to script around, if the server doesn't have any way of knowing anyone actually jumped through the hoop.
Re: DOOM Captcha
#139As long as I don't have to click a damn bus or find the traffic lights again I'm all for it.
Have you encountered the CAPTCHA from this monstrosity of a company called Arkose Labs? I don't get angry but I was trying to redeem gift cards for an elderly relative and I was shouting and gave up. Not sure if I am allowed to paste links but search for "arkose labs reddit" or just the name of this company on Twitter. Or search "arkose labs san francisco" on Google and just read the reviews.
^This.
That CAPTCHA on Epic Games Store is hell. Worst part being you have to do it all over again if you fail even once and that one is enough for me to not login.
Re: DOOM Captcha
#140Oh man, I just realised what would work really well:
A captcha with a random level from https://www.elizium.nu/scripts/lemmings/