Comments for The Cutest Human-Test: KittenAuth

I loathe the typical "Human Tests" and this is much easier. It would be fun to be able to customize it to our own websites. So if our website is about puppies, then we can load up our own pictures of puppies.

Instead of asking for exactly 3, you could ask for ALL of the kittens. There could be as many as nine kittens occupying the whole grid. Then instead of 84 possible options, you would have 511 different possibilities. And you would not have to add a bigger grid. Just make sure that there is at least one kitten in the grid so that the submit works.

I really like it, but to maybe suggest something similar that might make it work more with other people's suggestions in other comments.

This system is similar, but uses next to no bandwidth because it uses only text, similar processing power (maybe a bit more - it needs to reorder words), is not very easily breakable by brute force, and is easily swappable for new sets with the addition of words to a database. The only major difference is I don't know if it still fits into your specs.

More details:
The interface would be set up so that it asks the user to spell a specific word by clicking on the scrambled individual letters in order. It can still use a 3*3 box setup, and takes up less space on a page. While this may be a bit more difficult, I think it solves a lot of problems. By asking them to spell a word, you can create the whole system using text, just seperate the letters into boxes. You can also easily add new sets by adding words to a database or file or other storage mechanism. In addition, the letters could be assigned meaningless numbers in a session to not be traced. Finally, the with longer words, the number of combinations EXPLODES - with a nine letter word, assuming no duplicate letters (which admittedly may be rare with words of that length) you have a relatively huge 9 factorial combinations, or 362880 combinations. However, it uses more processing power, though I would argue significantly less than the current scrambled code method, simply because it doesn't deal with generating images and obscuring them through heavy manipulation.

Anyway, this isn't to say I don't like your system. I think it's great and a definite step in the right direction.

Someone mentioned that images could be catalogued by bots and thus the method broken after a while. Well, to fix that, the images could be steg-processed very quickly before sending them to the browser (embed a random string into each image with steganography methods). That way, the images would be different every time (by checksum, number of bytes, etc), but would look the same to the human eye.

Something similar was thought out before:

http://www.captcha.net/captchas/pix/

Classic ASP wont let you do this unless you have access to an imaging component.

NOT TRUE: http://www.rodsdot.com/ee/dynamicImage.asp

You can stream images in calssic ASP without a third party component. Just use an ADO stream, Response.ContentType and BinaryWrite.

Example simply shows streaming can be done in Classic ASP, it is not meant to be robust.

I submitted something about a spelling thing about and just realized how it is completely not secure. You can simply ignore it.

Great idea, I'd still like it to be built on, and it sounds like you are.

Hey there.

Great idea. I understand the need for Captcha's but I also find them frustrating.

Suggestion for blind or visually impaired testing, is to maybe use a text to speech api to generate random words, using different voice and speed settings, and to ask the user to select words in a specific "cat"egory. To save server resources you could have the server randomly generate the .wav or .mp3 or .au (whatever) files and store them in your directory once a day, then using a similar random picker like you have made for the kitties, send those to the browser.

Not sure how all the technical bits would work (although I imagine you can stream audio from a script just like the pictures.)

very cute idea! and more fun than the letter thing...

Just wanted to try this kitten auth out :O