Hacker News Reader

Comment by thebigshane | Hacker News Reader

No one has mentioned these specific use cases yet...

1) live charts and graphs of server loads

2) interactive maps (instead of loading new images, just append)

3) I'm also thinking of some kind of captcha, where the user waits for the server to show a certain image and then can submit a comment and the server would know which submits were valid based on timestamp... or something.

4) weather, temperature, stocks

5) collaborative drawing applet? (would still require ajax though)

View on HN

Collaborative drawing would be possible without ajax. Just put a 1px image on the page and change its url to encode the drawing commands. Update the animated gif to show the users what was drawn.

(3) is only secure if no one bothers to write a bot for your site. It would be trivial to do so, however.

I admit that I have only thought about this for a minute or two but I am thinking of something a little more complex than a hard coded image.

More like: Hit submit when a picture of a dog is shown in the slideshow, if its a cat, your comment will be denied. And these images of dogs and cats would be picked randomly by the server from a google image search (...or something). The vulnerability so far is that a bot could just keep trying until it got in but I'm sure a crafty programmer could come up with an attempt limiter.

Still a half-baked idea, but the tech does offer some interesting possibilities. I particularly like that this may work when AJAX/JS is disabled or otherwise not an option.

I worked on CAPTCHAs at Microsoft Research in a past life, and I can tell you, most original forms won't work. In the case of the one you described, I as an attacker can just put it through Tin Eye to find the original, and then do some semantic analysis on the page containing the image, or event just the URL, to figure it out. I have working code for this as a proof of concept for Microsoft's Kitten Auth.

If that is the best attack on my idea, then I'd say that's pretty good! A spammer would have to target the site specifically (for tailor-made script) and parse an animated gif into individual images, then send every image into Tin Eye (which is awesome but the API isn't free right?).

That said, I am a complete amateur at captcha design. Cool research though and I bet a lot of HN'ers would be interested in your PoC if you haven't already submitted it.

Reply on news.ycombinator.com