CAPTCHA design

I wanted to open this up for discussion. In your opinion, what aspects make a good CAPTCHA? What has worked for you to keep the bots away? Don't be shy!

in what context? Akismet formy wordress has been absolutely awesome in controlling the spam on my blog. Some do get through - but nowhere near what used to.

It also has an API to hook into it. Check out this to see how one person did.

Well, okay, I wasnt quite thinking of something to that degree, but it is extemely interesting. I was thinking more along the lines of a visual captcha during say, registration time. I think Andrew did a great job showing the basics of how to build one, and I just wanted to get everyones ideas on how they are building thiers.

I just built one, for instance, that:

-has random backgrounds, randomly places the characters on a set text area of the x and y axis of the image

-does a random rotation of the character

-And the greatest thing so far about it, the text is printed as a negative of the actual background image.

I figure that will hold them at bay for a while.

Can you put a demo online?



This is okay as long as the character isn't rotated too much. I find anything above 30 degrees uncomfortable.



This is okay as long as you try to take color blind people into account

I will PM you a link to it.


It's sitting at -25 to 25 degrees right now. I agree with you.



Because it is a negative, there is still enough contrast between shades to recognize letters, I think. But, if it comes down to it, the forum software has an admin assistance link for such a thing.

Actually, because it is a negative, green becomes pink, which is red enough to be able to cause trouble with people suffering from red-green color blindness.

Another thing is selecting a better font. Especially with rotation and character size differences, the following characters can look too similar:

- 7 and 1
- 1 and l
- l and I
- 5 and S
- many lowercase letters and the corresponding uppercase letters (x and X, v and V, y and Y, o and O...)

Of the samples you showed me, I found the 5th and and the 9th from the top to be the most readable. I would describe the first four and the 8th terrible. I am red-green blind.

It's good to get someones perspective from the color blind area. Thanks for the heads up! The owner of the site wanted a camoflauge themed captcha (it's a shooting forum), and I know some patterns don't do well with colorblindness, but I tried to accomodate him all the same.

Oh, and on the font. I wanted to shy away from something that was a standard font on OCR software (that is what broke the other in the first place). I am in the process of eliminating those letters and numbers that look similar. Even though it will weaken the set the entropy can pick from, hopefully it will be enough still.

Also, in the interest of being fair, I think I am going to run these through a "colorblind filter" that I can create very quickly. Can you tell me what exactly it looks like when you see solid red and green? Is it just that the pigment is gone, and grey remains? I would really like to accomodate without having to ask a bunch of people :-)

First, read the Wikipedia page. There are a lot of different types of color blindness, I can only tell how I see things.

To me grass is always green and stop signs are always red, but I have a lot of trouble trying to find a red dart from grass. Also, I never use color codes when I check resistors, I always use an ohmmeter. Badly chosen syntax highlighting in code editors have occasionally been a bit problematic.

If there is a lot of green and a small red spot in the middle, the whole area might look green to me. If there is a large red area with a green dot, it all might look red. I think red is a dominant color for me. By this I mean that a green dot is more easily hidden inside a red area than vice versa.

I think the level of my color blindness varies. Sometimes the same color related thing is easy and sometimes not. This could be caused by the medication I occasionally have to take for a totally different medical condition I have but I'm not sure. Right now I think colors seem easier to distinguish than usual.

Edit at 2006-12-14: A baaaad typo

I would agree with that. I know a few colour blind and what they can and cannot see varies. I think to combat this issue it would be better to have black and white option on some forms. So the page can be reloaded with a black and white captcha. But that in itself can raise further issues.

Ive put together a better CAPTCHA of mine and was considering updating my tutorial so that the finished product would produce something like this:

http://walshdev.com/captcha/new_captcha.php

I don't think the grid would do a whole lot of good, and the rotation can easily be rectified, but that font would be hard to decode with AI. What font is that? It doesn't look standard. That in itself shows promise :-)

its called scrawl. You can get it from http://1001freefonts.com. Yeh i understand about the grid, but it does make it look better. Ive changed it now to move around a little and vary font size and font face (similar fonts). Anyone come up with ideas about the colour blindness issue?

@Nawlej: im intrigued about your captcha, can you pm me a link?

Sure! PM inbound.

The way I see it, 99% of PHP CAPTCHAS rely on the same imagettftext() tricks; rotate, changes sizes, colors, font.

What we need is someway to distort the font; to warp it randomly.

If I were a botter, I would take popular CAPTCHA fonts, and run them through a combination of rotations and sizes until I could "eclipse" it in the original image, and thus, find a match. With a finite number of font sizes and rotation degrees, this is possible, although admittedly tought.

With a randomly warped font, no combination of rotation/size will eclipse perfectly.

How to do this? I have no idea.

True, it is possible. However, it is tough enough to get people to direct bots at sites that don't have capthcas. I'd imagine that -- at least at this point -- it would be a lot more effective to search for sites without captchas than to start excessively analysing current capthcas.

As for more advanced "effects" for capthchas, I believe they could actually make the image generation so slow it could slow down the whole site, at least if there are a lot of users. There's also the problem of making the text still clear enough to be readable by a human.

I think a better way would be to make a custom font, one that can't be found anywhere.