Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DOOM Captcha

vivirenremoto.github.io

Post reply on HN
Print view View original

141–150 of 178 posts

Re: DOOM Captcha

#141

Post by owl57 »

testesttest wrote: post #136
flanbiscuit wrote: post #47

Earlier quoted context omitted.

The DOOM Captcha is just using html/css/js so it's easy for bots to crack with simple DOM querying/manipulation in an automated browser. But what if canvas was used instead? > A minigame with extremely vague description that you have to react to quickly to pass. I dont know how advanced current bots are at breaking captchas these days but if you're using a canvas then they would have to use some kind of image/video p…

For traditional text captchas, bots are better than humans. Flow usally goes, pay humans to solve 50000 ($500) then train an ML model. For things like recaptcha things get harder because it is not easy to proxy the captcha puzzles to have humans solve them (which is nessary to collect training data).

Why do you need to proxy anything? If you're just collecting training data, seems easy to record the interaction with a browser extension?

Re: DOOM Captcha

#142

Post by drloser »

supernova87a wrote: post #114

I know it's a bit of fun and kind of a joke.... but, makes me wonder: What will happen some day when solvers and bots get so smart and human-like (and the CAPTCHAs evolving to keep up, with harder and harder tests) that the technology "have nots" human beings of our world will not even be able to prove they're human any more?

"Please prepare yourself for the blood test."

Re: DOOM Captcha

#145

Post by arbol »

conception wrote: post #130
jandrese wrote: post #16

While this is too simple (even the website admits that a bot could be written in virtually no time to break it), it does make me wonder if you could have a WarioWare CAPCHA. A minigame with extremely vague description that you have to react to quickly to pass. Thinking about it some more it fails the primary criteria for a CAPCHA: it needs to be harder to write the bot that cracks it than each test case, by at least…

I’ve seen this in the wild, or something like it. Your idea isn’t far away from it- https://www.jqueryscript.net/form/image-puzzle-slider-captch...

Commercial version https://www.geetest.com/en used on lots of crypto sites

Re: DOOM Captcha

#146

Post by Kiro »

arbol wrote: post #145
conception wrote: post #130

Earlier quoted context omitted.

I’ve seen this in the wild, or something like it. Your idea isn’t far away from it- https://www.jqueryscript.net/form/image-puzzle-slider-captch...

Commercial version https://www.geetest.com/en used on lots of crypto sites

Yeah, "I’ve seen this in the wild" undersells the prevalence. Geetest is used on a lot of big sites.

Re: DOOM Captcha

#147

Post by arbol »

nerevarthelame wrote: post #125
endisneigh wrote: post #107

Interesting. Fundamentally, I believe CAPTCHA, and attempting to distinguish humans from computers is pointless. I think it's better just accept it and design applications accordingly.

I don't understand. How would you propose protecting a website from DDoS attacks? What sort of design would address that?

A reputation system that grew from captcha and was eventually self referencing - so high rep IPS could vouch for other unknowns. Assumes most people's IPS remain static though.

I realise parent commenter was probably talking about identifying upfront.

Re: DOOM Captcha

#148

Post by unixfox »

jtvjan wrote: post #44
ryantgtg wrote: post #29

Earlier quoted context omitted.

This is great. Do you have any more tips about how to be more human?

Look if the site has an option to use the noscript recaptcha (you might be able to force it to appear by blocking scripts). That one's much easier: as long as you get it right it lets you through, and you always have to select three squares (none of that "keep clicking until there's no more matching" garbage).

Unfortunately this is becoming fairly rare, I haven't encountered one in ages.

Re: DOOM Captcha

#149

Post by wruza »

tshaddox wrote: post #137
sodality2 wrote: post #117

Earlier quoted context omitted.

Ideally you'd have something that's hard for the client but easy for the server to verify, though. so maybe prime factoring?

Or, the server provides a random string of bits with length n and requires a string of bits with length n+m that starts with the provided n bits and whose SHA-1 hash begins with 20 zero bits.

What nonceness!

Re: DOOM Captcha

#150

Post by dahjkol »

qixv wrote: post #126
GuB-42 wrote: post #49

Earlier quoted context omitted.

It mostly depends on what you are trying to protect with your CAPTCHA. When I managed a small phpbb forum, all I had to do was to change a few lines in the register page to make it non-standard and it stopped all bots. Better than the built-in CAPTCHA. Simply, no one cared enough about our forum to write a specialized tool, no matter how easy it was. If it is all you have to protect, go ahead with your clever ideas,…

When I managed a purely Danish forum, i simply added a textbox and asked the user to write ‘æ’ in it. Never saw any spam after that.

One of our public facing systems I put up a silly "what is the capital of x country?" While we waited on some other stuff. I think it's still in production.

And to my knowledge no bot has gotten past it or even bothered.

Post reply on HN