Form Image Verification

Dysan

Hi,

Using the GD Library, how do I create a image verification image, that requires the user to enter a code as displayed inside the image, before form submission?

roscor

Do you mean Captcha?

JPnyc

Honestly, don't waste your time. Bots can get right by it like it's not even there, now. It's a meaningless annoyance to your users.

rsmith

How are bots circumventing captcha and what is being used to replace it?

daredevil14

If you mean a Captcha image... then create your own one ( using GD library of course )

1) Start a session
2) Generate a salt ( by looping ) & return it
3) Save the returned salt result to a session variable
4) Generate an image using GB library, and string it the returned value of our salt function
5) On the register page, start the session
6) Frame your image.php ( which include steps 1) -> 4) )
7) Create your HTML form as usual, and after submitting, check if the submitted value of the <input> text of the image verification is equal to the session variable value...

That's it...

bradgrafelman

rsmith wrote:
How are bots circumventing captcha

Easy - text recognition. Most CAPTCHAs out there don't obscure the text enough to disguise it.

rsmith wrote:
what is being used to replace it?

shrug You could always do some logical test - ask "what is 6 multiplied by two?".

Dysan

Would you say logical tests are better than just entering characters from an image, inside a text box?

Dysan

Would you agree?

bpat1434

If you read Wikipedia, there are plenty of CAPTCHA crackers out there. Some of the viable alternatives are to ask them to finish a famous saying like:
"One fish, Two Fish, Red Fish, _________" (Blue Fish)
Or ask them for some simple math:
"What is the square root of one hundred?" (10)

Problem with those solutions are that you usually have to have a "database" of sayings that you can randomly draw upon to use. So having like 5 or 6 sayings is no good, having 5 or 6 hundred is better 😉

But since some CAPTCHAs are being cracked via OCR software, you're better off using some "misspellings" sometimes to help counteract OCR software. Something like:
"What is three plus fuor?"

While that may be a fine for a while, it really won't stop them. One of the better systems I've seen is reCAPTCHA which uses millions of lines of text from books to make a fuzzy image of two words. For examples, just go to their homepage.

Just some more information for you to go on 😉

blackhorse

i have taken advices installed recpatcha now. but to me recaptcha is a little bit hard to read. and i am still wondering with the better ocr software coming later on, would recaptcha have to follow it up and make the image be too hard for human to read? and if you have installed recaptcha on dozens sites and then maybe soon, the ocr can read image better than human, then the whole visual confirmation approach would be in trouble.

could this world have less bad guys out there?

i begin to tend to the approach to write your own captcha and use logic questions. but begin to think we should use the forms conservatively. if not have to have forms, don't. if not have to have comments fields, don't. if we don't have to offer comments form to public, then limit it to members only etc.

rsmith

Here's a thought, would it be possible to generate a captcha but require the captcha to be input in reverse? This should confuse the OCR software as OCR will just try to put it left to right instead of right to left