viebrock.ca

Turing Protection

12 April 2004 • code | PHP • PermaLink

Here are some pieces of code to prevent access to parts of your site unless the user can pass a simple Turing test (also known as a CAPTCHA.

The code is pretty straightforward. You need two files: the image generating script and the protection script.

Then, for each page you want to protect, just add this code to the top of the file:


<  php

session_start();

if (!$_SESSION['turing_pass']) {

    $_SESSION['turing_redirect'] = $_SERVER['<span class="caps">PHP</span>_SELF'];

    Header('Location: /turing.php');

    exit;

}

unset($_SESSION['turing_pass']);

  >

To see it in action, try clicking here.

Please … any comments on the code are greatly appreciated!

Comments

I’d probably stick to only lowercase or UPPERCASE for the letters purely because some letters are not very easy to determine case.

Thought about making this into a plugin for Textpattern?

— Mike Jones
13 April 2004, 08:20 • PermaLink
A couple of things I would encourage:

1) Encapsulate globals. Always. E.g. provide a function that returns values from $_SESSION or $_REQUEST, rather than access them directly. It adds an extra layer of security and also “future-proofs” all of your code that accesses these variables.

2) Instead of including it at the top of each file, use the auto_prepend_file directive in your .htaccess file in apache and make this code part of that include.

These are more architectural design ideas than they are logic issues, but still are nice things that make your code a little more robust and reusable, not mention make your application a bit more immune to future changes in language spec.

— Ryan
13 April 2004, 08:57 • PermaLink
How about blind/visually impaired users?

Wih your code I see no way to add an alt attribute to the imagetag, meaning your site will exclude those users.
http://www.pcmag.com/print_article/0,3048,a=49598,00.asp

All in all the technique is nice but does it’s work at a cost. And if you’re in a business where you can’t afford to lose customers (or aren’t allowed to by law) you’re better of not using this technique.

— Harold Bakker
13 April 2004, 10:38 • PermaLink
Mike:

Making it a Textpattern plug-in would be sweet, but I’m not sure how it would work. A plugin for the random image would be pretty straight-forward, but you need to modify the PHP code for the protected page to actually use it.

Ryan:

Thanks for the suggestions. Like I said, this was a quick hack. When I get some time to spend on it, I’ll probably encapsulate it in a class, which should make it more portable.

Harold:

Very valid point. I did a bit of Googling to see if there are any CAPTCHA solutions for the visually impaired, and came up with nothing.

Obviously, I can’t put an ALT tag on the image with the “right answer”, since that would defeat the purpose of the CAPTCHA.

I suppose a solution would need to be text-based. Maybe a scrambled phrase that needs to be unscrabled (“Hwo mny eggz r 1n a d0zn?”), or a word problem (“If a train leaves New York at 2am, and another leaves Chicago at 3am, ...”). The problem with the first technique is that, unless you have a very large number of phrases to scramble, someone could brute-force their way through. The problem with the second is that, although it allows access for the visually-impaired, it blocks access for the stupid (which may not be so bad after all).

Has anyone discovered any solutions to this?

— Colin Viebrock
15 April 2004, 06:45 • PermaLink
I don’t think there is any way for a CAPTCHA to be accessible to everyone. For instance your textbased “Hwo mny eggz r 1n a d0zn?” would probably exclude dyslectics.

I know that Yahoo! provides human contact info so disabled people can get assistance from a live human who will setup their account for them. Which illustrates that the technique is just fundamentally flawed. Fine for some uses but if you’re going to deploy this large scale you’re going to run into huge problems.
I would urge everyone to be aware of these issues before deploying CAPTCHA.

Here’s some more links about the problems:
http://www.bestkungfu.com/archive/?id=445
http://www.maccessibility.com/archive/000535.php

— Harold
18 April 2004, 06:53 • PermaLink
LiveJournal.com implements a CAPTCHA system for new account creations that also includes an audio version for the hearing impaired. I’m not really sure how that .wav file is generated, though.

— Josh Santangelo
18 April 2004, 19:52 • PermaLink
Generating an audio version of the image is the only way to make it properly accessible. I don’t know of any freely available alphabetic recordings (or how to merge the individual letters together into one wav file) so I can’t be of much use :)

— Peter Bowyer
15 May 2004, 09:24 • PermaLink
I’ll look into making an audio option as well, but I forsee a few issues with it.

Technical issues: recording the individual letters, then merging them together … although that shouldn’t be too hard.

Making it hard to “crack”: with the images, I can change the colour, size, placement, rotation, etc. of each letter, so each “a” doesn’t look exactly the same. With audio, unless I record several versions of each letter, all the “a”s will sound the same. It wiould then be easy to identify each sound, and crack the code (“easy” is relative here, of course).

Worth a try though. I’ll check out livejournal.com, too.

— Colin
15 May 2004, 14:35 • PermaLink
The other place that does it is PayPal on their signup form – click on the “Help” link to find the audio version.

I think it would be hard to crack (at present) – every site could record their own audio alphabet. Just a thought, but wouldn’t you have to record longer strings anyway, like “Uppercase A”, “lowercase p” etc? Otherwise it becomes a lot less random

— Peter Bowyer
16 May 2004, 04:30 • PermaLink
Why not just use “spelt” letters in the alt tag? Its what i do… like so:

a small chunk of php, and a list of spelt letters (possibly several per letter/number, then selected at random for each letter) would suffice!

Its not foolproof and i suspect that if someone really wanted to crack it they could, but its certainly a quick and easy solution that would work for smaller scale sites.

— ben lancaster
20 May 2004, 08:55 • PermaLink
poo, it stripped my HTML:

alt=”capital eff lowercase pea number seven lowercase zed capital kyoo”

— ben lancaster
20 May 2004, 08:57 • PermaLink
no comment, just testing

— Haumont
3 June 2004, 06:52 • PermaLink
I have made a PHP4 class from your script.
The source code can be downloaded from here
To generate the image:
$tur = new Turing();
$tur->generateKey();
$_SESSION['turing_key']=$tur->getKey();
$tur->displayImage();
Then in another script you check the key form session with GET/POST variable from user.

— Mircea Vutcovici
5 October 2004, 13:33 • PermaLink
Looks awesome! How can I implement this woth Pmachine comments?
Tried the above method, but I get a parse error on a comment page.

— Arne Kuilman
5 December 2004, 19:07 • PermaLink
4545

— 54
16 February 2005, 05:05 • PermaLink
I’m interested in hiring you to add your turing script to my site or explain to me where to add the script so that I may do it myself. I really need this kind of security on my site. Email me and I will give you details.

Thanks.

— Shawn
17 November 2005, 23:20 • PermaLink