Comments on: Pretty CAPTCHA

By: doc

doc — Sat, 04 Feb 2012 11:00:00 +0000

you should put the letters, on average, a little closer together, so that it prevents scanners from easily ignoring your line. overlapping letters are very hard for amateur OCR’s to parse. also, the font should be randomized (catpcha1.ttf, catpcha2.ttf). should have 50 fonts at a minimum. finally, you need to throttle the number of images generates on a per-ip or per-cookie basis…. or else someone will crack it using a random-seed attack or partial-brute-force with an OCR, etc.

By: Constantinos

Constantinos — Sat, 04 Feb 2012 01:01:00 +0000

this is what i get when running the script on my localhost, all GD functions are working on my php conf

Comment out the header("Content-Type: image/png"); line, and visit the script directly (i.e. load http://localhost/captcha/captcha.php in your browser). That should give you the exact errors that are produced, and help you debug it.

By: Angelivene

Angelivene — Sat, 04 Feb 2012 22:12:00 +0000

The image “http://localhost/captcha/captcha.php” cannot be displayed, because it contains errors.

this is what i get when running the script on my localhost, all GD functions are working on my php conf

By: Alix Axel

Alix Axel — Sat, 04 Feb 2012 19:50:00 +0000

Very nice code indeed!

By: James Cooke dot info » Blog Archive » Form spam - PHP CAPTCHAs and Akismet

Sat, 04 Feb 2012 15:42:00 +0000

[...] Constantinos Neophytou’s Pretty CAPTCHA This option looks excellent, although I didn’t give it a go for two reasons – I couldn’t see how to “attribute the work in the manner specified by the author” in order to comply with the CC license that the code is released under, and in looking at the contact form at the bottom of the page I found reCAPTCHA, which distracted me completely! [...]

By: Constantinos

Constantinos — Sat, 04 Feb 2012 22:47:00 +0000

As an addition to the post, I'd just like to mention that what I was looking for from a captcha is:

No processing should happen on the client side
It should not be text based or hidden field based
Should not be readable by a plain OCR program
Have at least some level of complexity for image readers
Be customized, and look nice

Now obviously this is not going to start appearing on any sites like digg.com, and I've only implemented it on a site that won't worth any spammers time to write an image processing script that reads this image. The code chooses the colors randomly, and one suggestion for improvement I received was to add some basic shapes around the letters that were the same color as the letter. That's a pretty good idea and easy to implement, and I might just do that if I can come up with a way that will guarantee the image will always (or most of the time) be readable by humans...