Comments for The Cutest Human-Test: KittenAuth

How about porn images? Click three double penetrations to submit. :)
Three hot carls? Three rusty trombones? Three double-anals?

Sob, comments don't work? heh.

Just from another point of view:
Regardless of how many images of kittens or (any other animal) you have, a captcha would be more inherently secure in that it's way more difficult to bruteforce (26 possible letters, 52 for upper and lowercase, 10 digits, a handful of symbols, and that's JUST for one in english, let alone any other language) and even with advancing OCR technology, the technology is not good enough to discern characters in an image when there is too much noise (but one where humans can easily tell the difference). (Admittedly, captchas can be defeated in many ways (hiring people to decode, defeating various captcha-generating programs, reusing session IDs of captchas that are known, ...) but there's rarely an incentive to do so.. and you could argue that the same goes towards kittenauth)

Also, both captchas and the KittenAuth system are lacking in one respect: compatibility with certain groups of people, read: vision-related disabilities, image processing disabilities (brain injuries, etc.) , reading disabilities, colorblind people, people on slow connections, people using text-based browsers (lynx, links), people who can't tab over the images to click on them (not a big deal if you fiddle around with the code though) rather than using a mouse...

Basing an auth system on images that computers cannot inherently process is genius. But it's very disappointing that most people don't give a flying **** about the small (but not nonexistant) group of people who for some reason can't read/see/understand. The creator of the captcha himself said that there were accessibility issues, but nobody seems to be paying attention to that because captchas are brilliant in that it takes advantage of something that computers cannot be coded to handle.

So really, KittenAuth is cute (omg, really cute), but not as functional as the captcha nor that great for not-so-average people with disabilities of some sort.

My favorite method of challenge-response test is just asking the user to add/multiply simple but randomly generated numbers, or to type in/copy|paste a particular randomly generated sentence in. It's accessible for the most part (how hard is adding 1 to a number like 20, or multiplying 43 by 10, or typing in the website address?), it's simple, and easier than reading a whole bunch of distorted letters.

and re: how many blind people are there...it's a lot more than you think, and the number only keeps growing as the baby boomers age, etc. i'm a cs major and hci (human-computer interaction) zealot, i've been working with people who are visually disabled for a few years now...they're everywhere, just not noticeably big of a community. in the end, almost all of us are going to be needing glasses, if we don't already, to read and do things.

audio captchas exist, but are very crappy and you're not thinking about the people who are blind and deaf, or have varying degrees of each disability, or have some other thing standing in the way of using an audio captcha effectively.

also, please don't overgeneralize, the internet for the most part is pretty accessible, and there are still efforts to make it more accessible. the issue with screenreaders alone is that the way sites are laid out is rather "flat", instead of having any sort of two/three/four column layout, or anything like that. fortunately, good use of CSS and new versions of Macromedia Flash, things like sIFR (where you can generate flash images of text on the fly in a font you specify) that degrade nicely is making it easier for the blind to use the internet. jaws (the leading screenreading software) can deal with most hurdles, short of reading text in images (which, if that were possible, captchas would be defeated in an instant). there's actually a css media type (well, everyone always put media type all or screen) for braille (tactile devices), aural (speech stuff), embossed (braille printers), tty (teletype/terminal media) and such, but almost nobody uses them...things like
most good websites degrade nicely for those people using screenreaders, other assistive devices and fixed-width font based terminals and such, and it's only being helped along by correct usage of css.

Nice, but why not take the extra 30 seconds and make this work without any javascript (just put checkboxes under each image)?

Great idea Oli! I've wondered about a better captcha system once in a while too. Cute baby animals or a tailored theme could even start a fad that could get some companies using it, although I think it'd stand on it's own merits in some places anyway.

After reading all the comments, I've yet to find anything remotely showstopping for any automation method that I know of (any tech problems were "fixed" in the comments - Firefox access is also just fine). md5 checkers, trained systems, and the like are almost trivially easy to defeat programmatically. Legally, it's a piece of cake (copyright, images, etc). Screen readers can use the audio method, or brailebar method, etc. Excellent!

I'd love to see an OSS package around that would incorporate this, sound munging, and some other ideas to put into a few different httpd installers/formats.

Also, as another poster wrote, "reading text in images (which, if that were possible, captchas would be defeated in an instant)." isn't quite accurate, it just isn't cheap. How do you think some online poker bots work? You just screencap the area, then munge and/or thunk to OCR/recognition software. Why do you think they make the irritating things so tough to read that only a human can (sometimes) do it? ;)

shardis - i meant beyond simple OCR, the only way to make captchas accessible to screenreaders is if the screenreader had some advanced OCR deal that was able to get the right text from the image...which would defeat the purpose of the captcha (as it was intended to keep out computers because OCR isnt advanced enough..). i mean i know its possible for simple text in images of scanned documents, i do it regularly, but when we're dealing with captchas specially designed to prevent that..

I like the idea, though I can see the need for some of the suggested refinements if the method went "prime time".

My (off the top of my head) suggestion is to put the instructions into an image, perhaps one of the images in the grid, or overlaid over one or more of the images. Though you'll need to be careful or you end up on the slippery slope back to the hard-to-read-captcha method :).

This does not protect from "free porn" attacks:
http://www.boingboing.net/2004/01/27/solving_and_creating.html

But as you said earlier Oli - it doesn't have to be kittens. Ie. click the 3 interacial scenes to continue.

=)

I think this is an interesting idea but I think you should be a bit more careful about the implementation. I ran through a bunch of test on the test harness and I noticed that a kitten never appears in the lower right hand corner. Instead of having 9C3 combinations, you have accidentally put in 8C3.

Still, a very interesting idea and don't let the naysayers get you down.

--PatF