posted on 3:45 PM, August 3, 2007
Captchas are small puzzles you have to perform to prove to a website that you are not an automated program. The word stands for "Completely Automated Public Turing test to tell Computers and Humans Apart".
ExSite supports a few types of captcha which you can use when required. Some plug-ins will use captchas automatically.
When to use a Captcha
Captchas are required whenever you have a concern that an automatic program may exploit a form on your website to:
As a general rule, captchas are usually not required in member-only areas, or on forms that require the user be authenticated before using. (Eg. member-only forums.) By entering their password earlier, the user has already proved their identity, so in most cases captchas are no longer required unless you are concerned that a member may put together an automated program to exploit one of your services.
Captchas are not completely fool-proof, and there are ways of exploiting them using partially or fully-automated methods. However, at the very least they may slow down the undesirable posts to a more manageable level.
This is an example of an image captcha:
The user must be able to read the text in the image and transcribe it back to normal text. This is a difficult (but not impossible) task for a program, which would have to use OCR algorithms that could cope with the text distortions and noisy background.
Image captchas can be difficult for the visually impaired. ExSite provides a fallback in the form of plain-text captchas.
Here are some examples of plain-text captchas:
Which one of these is not like the other?
9 × 8 = ?
Enter the first and second letters of the last word in the following list:
Text captchas are relatively easy to defeat programmatically, so ExSite uses several different text catpcha algorithms to expand the problem space. Some of the algorithms (such as the last one in the above examples) make use of random words, and ExSite uses the system dictionary to provide a large pool of source data.
To generate an image captcha (complete with form elements):
To generate an image captcha that includes a link to fall back to a plain-text captcha if the user requests it:
The form HTML that the captcha object returns looks like this:
01: <div class="captcha">
Note that text captchas also include the captcha and captcha_solution form fields. These fields can be renamed in the declaration of the captcha object, if necessary.
To test whether the user has passed the captcha, use this template code:
We use the combine() method here because we don't know whether the form in question is using GET or POST. Otherwise you can use get() or post().
This self-contained perl script illustrates how to use ExSite captchas. It does not include a check for missing captcha data.
Image captchas are drawn onto the blank captcha file _ExSite/images/captcha.png. You can create your own captcha background by replacing this file.
The Captcha module makes use of the following configuration settings:
The parameters that are most likely to need special attention on your installation are dictionary and font.
charsize is the horizontal spacing of characters in the image captcha.
color is the color of the characters in the image captcha, if the ImageMagick on your system will accept this parameter.
dictionary is a file containing a source of random words, one per line. The default points to a common system dictionary on Linux servers.
distort is the degree of distortion desired (captchas currently use the "implode" method of distorting text.
font is the font of the characters in the image captcha. Values of ps:Courier-Bold and Courier-Bold have been found to work well. Consult the documentation for the convert program in the ImageMagick suite to see what other fonts you may be able to use. You must have some fonts installed on your server to make use of.
max_password_size is the number of characters that have to be extracted from random dictionary words in some text captchas.
pointsize is the height of the characters in the image captcha.
start_x is the X coordinate of the first character in an image captcha.
start_y is the Y coordinate of the first character in an image captcha.
word_set_size is the number of random dictionary words to use some text captchas.
To test alternative captcha parameters, you can run the captcha generation program directly:
best practices (5)
content management (12)
data handling (7)
graphic design (21)
html formatting (7)
plug-in modules (28)
visual tutorial (29)
web protocols (9)