Hacker News Reader

Hacker News

Comment by bdg | Hacker News Reader

Full thread

bdg

Can brute force answer from the server quicky:

http://en.lichess.org/captcha/0nbdeigw?solution=a1+a2 returns either 1 or 0.

The total complexity of this to brute force is 768 possible moves.

Most of us here could write a bot to spam their site with less than 30 minutes of time and effort.

View on HN

But serious spammers would prefer to spend this time writing a bot capable of spamming all forums based on some widely used engine.

Cracking this captcha won't give you access to any significant audience.

by this argument, the captcha would become useless as soon as it saw widespread adoption. The idea of a captcha is to be strong against bots even if it was directly targeted by spammers.

Yes, it would. But this one will never see wide adoption so it's sufficient.

If every forum had a completely different captcha system, forum spam would pretty much die out.

No, a captcha is supposed to get rid of spam without annoying the users. If it gets rid of lichess.com's spam without annoying the users, then it is perfect.

CAPTCHA solve a specific design problem. They are not an IETF protocol or solution to be used everywhere. That's kind of the issue. Once a CAPTCHA is worth enough it will be overcome.

The problem is to design a CAPTCHA that implements just enough headache to make it worthwhile not to overcome and at the same time not frustrating users. I think this chess problem uniquely and elegantly solves the problem for the site in question by achieving both.

Then again, I am not familiar with the users, maybe the site is often trolled by chess mastah wanna-bes.

The design itself could be improved though to make it stronger against scripting, though. For instance, there's no reason the values for the pieces and the boards necessarily need to be human-readable and to follow the notation of chess in the code itself, those variables could be randomly generated per load, perhaps with a salted hash. That could also serve as csrf protection maybe.

if the idea of the chess captcha is to be used once on a single site, (ignoring the fact that it's a chess captcha for a chess community) it's very over engineered. Jeff Atwood gets away with a captcha where all you have to do is type "orange" to post a comment[1] and even that manages to mitigate a lot of spam.

http://www.codinghorror.com/blog/2008/03/captcha-is-dead-lon...

There's no such thing as overengineering if it entertains the users while meeting the mission intent. :P

Philistine! At least plug it into a chess AI and do it properly.

I don't think a chess AI would offer much benefits to execution time with a brute force that is that small.

At the least, the HTTP response time overhead might be a reason to use an AI.

Then implement a check for checkmates and brute force it on your computer before relaying the HTTP response. The real AI part is somewhat uneccesairy.

You would do an online bruteforce? I think hundreds of moves in a few seconds kind of rule out a human...

Just implement your own check-mate check if going the brute-force route.

Blocking bruteforce is 'easy', just make any attempts after X attempts be void for the given board/ip

For the humans, just give another board (and add a time delay)

It's chess. You don't have to use this board to check every possible move, as any engine that knows the chess rules can verify if the result is indeed checkmate, without using this site's engine.

But, basically you're right. If the bot is not using an external chess engine, it could effectively be blocked from brute force attacks the way you describe.

Or use Rybka which can do it much quicker.

Reply on news.ycombinator.com