Spot the kittens

New method of authenticating that a human is filling out form

[Demaestro]

So you may have noticed more and more on websites that when you are filling out a form it will ask you to enter in the letters you see being displayed in an image to confirm that you are a human filling out the form and not some bot.

Someone emailed me a new method that is being proposed to handle this.

[thepcspy.com...]

You must identify 3 kittens out of 9 fuzzy little animals to auth the form submition.

Much nicer UI, still doesn't get around the seeing impaired issues where this is being seen as a hinderence to software that allows seeing impaired persons to surf the web. But it is sooo much cuter.

[Lilliabeth]

Love it!

[FrostyMug]

that's great

[httpwebwitch]

Love it.
I guess you'd call it a "Cat-cha"

I'm already inventing variations.

[DoppyNL]

I like the idea :) Would be a lot more user friendly.

Downside however is that you will need A LOT of images.
Still, even if you got a lot of images, it is possible for someone who wants to fool the system to learn a computer to recognise an image; this would be quite simple as it is not a generated image.

But still, it's cool.

[netchicken1]

Thats great!

You don't need many images, just move them around

[Demaestro]

I think that is why they use other small fuzzy animals, so that it can't be tricked, trust me I am a programmer and it hurts my brain to think of all the little nuances it would take to teach a computer the difference between a hamster and a little kitten. Visually that is.

[Essex_boy]

to learn a computer - Then TEACH it to do something more useful?

[DoppyNL]

I think that is why they use other small fuzzy animals, so that it can't be tricked, trust me I am a programmer and it hurts my brain to think of all the little nuances it would take to teach a computer the difference between a hamster and a little kitten. Visually that is.

Been there, done that, didn't succeed.

I don't think it is simple to teach a computer to recognise a little kitten on an image.
I do think it is quite simple for a computer to recognise an image that it has allready seen before. When a human has told the computer that THAT image is has a kitten on it, it is quite simple to let a computer succesfully pass this test.

Current captcha's are mostly generated images with some string on it. They will allways be different, so you can't let the computer recognise the file, it will have to interpret the contents of the image.
I don't think you are planning on generating images of kittens? or storing loads of images?

I still like the idea though, alltough I think the current generated captcha's are more secure and better capable of keeping bots out.

[Demaestro]

All you have to do to get around that though is dynamically name the images so that a kitten image of the name 67564tfg.jpg the next time it comes to the screen can be called tuiy8687iuj.jpg and then the next time it can be tuyitu675y46.jpg

Same image different name, this sounds tricky but if you have "pil" installed on your server then it can be done with a very simple script.

[DoppyNL]

Then the bot will simple make a hash of the contents of the file and compare it to a set of information it allready has.

Changing the name doesn't change the content of the image.

[Demaestro]

Very true... I hadn't considered them making a hash of the file.

I wonder if generating things like the background color or color filters would be enough to get around that... getting more compliacted now though.

The real catch 22 is when you try to comply with a screen scraper used by the seeing impaired that will allow the user to move past the screen.

I know a big site was sued over access for the disabled because of these captchas. The one solution I have heard of for this is using sound bytes. Same issue as with generated images though, the file can at some point could be recognized by an intellegent enough bot.

So how do you allow software for the disabled to get passed these screens and still be tricky enough to fool bots?