Hacker News Reader

Comment by mich41 | Hacker News Reader

But serious spammers would prefer to spend this time writing a bot capable of spamming all forums based on some widely used engine.

Cracking this captcha won't give you access to any significant audience.

View on HN

by this argument, the captcha would become useless as soon as it saw widespread adoption. The idea of a captcha is to be strong against bots even if it was directly targeted by spammers.

Yes, it would. But this one will never see wide adoption so it's sufficient.

If every forum had a completely different captcha system, forum spam would pretty much die out.

No, a captcha is supposed to get rid of spam without annoying the users. If it gets rid of lichess.com's spam without annoying the users, then it is perfect.

CAPTCHA solve a specific design problem. They are not an IETF protocol or solution to be used everywhere. That's kind of the issue. Once a CAPTCHA is worth enough it will be overcome.

The problem is to design a CAPTCHA that implements just enough headache to make it worthwhile not to overcome and at the same time not frustrating users. I think this chess problem uniquely and elegantly solves the problem for the site in question by achieving both.

Then again, I am not familiar with the users, maybe the site is often trolled by chess mastah wanna-bes.

The design itself could be improved though to make it stronger against scripting, though. For instance, there's no reason the values for the pieces and the boards necessarily need to be human-readable and to follow the notation of chess in the code itself, those variables could be randomly generated per load, perhaps with a salted hash. That could also serve as csrf protection maybe.

if the idea of the chess captcha is to be used once on a single site, (ignoring the fact that it's a chess captcha for a chess community) it's very over engineered. Jeff Atwood gets away with a captcha where all you have to do is type "orange" to post a comment[1] and even that manages to mitigate a lot of spam.

http://www.codinghorror.com/blog/2008/03/captcha-is-dead-lon...

There's no such thing as overengineering if it entertains the users while meeting the mission intent. :P

Reply on news.ycombinator.com