DOOM Captcha

DOOM Captcha(vivirenremoto.github.io)

670 points by jukkakoskinen 5 years ago | 173 comments

jandrese 5 years ago |

While this is too simple (even the website admits that a bot could be written in virtually no time to break it), it does make me wonder if you could have a WarioWare CAPCHA. A minigame with extremely vague description that you have to react to quickly to pass.

Thinking about it some more it fails the primary criteria for a CAPCHA: it needs to be harder to write the bot that cracks it than each test case, by at least a couple orders of magnitude. Otherwise bot makers will just create custom bots for each contingency. They have more time and funding than you do.

GuB-42 5 years ago | |

It mostly depends on what you are trying to protect with your CAPTCHA.

When I managed a small phpbb forum, all I had to do was to change a few lines in the register page to make it non-standard and it stopped all bots. Better than the built-in CAPTCHA. Simply, no one cared enough about our forum to write a specialized tool, no matter how easy it was.

If it is all you have to protect, go ahead with your clever ideas, it can add a bit of flair to your website and stop bots effectively. For accessibility, you can always deal with special requests manually.

The problem is entirely different if you are Google. People will spend months trying to break your CAPTCHA for fun and profit. Hand crafted problems will be solved faster than they can be written so "bot vs bot" is essentially your only option.

qixv 5 years ago | | |

When I managed a purely Danish forum, i simply added a textbox and asked the user to write ‘æ’ in it. Never saw any spam after that.

Ntrails 5 years ago | | |

I am on a forum with like 20 other posters and bots were stopped by the addition of a call/response field. Nobody who wanted to register would forget the classic response, but no bot was going to be able to answer it without some pretty specific google fu

slacka 5 years ago | | |

I can confirm that just a simple modification to the standard registration form keeps out all bot spammers. If your forum or bug tracker is small enough, that will eliminate all spam. The built-in spam countermeasures like CAPTCHA's seemed worthless from my experience.

ganafagol 5 years ago | | |

This is the best comment, by far. Of course we can have lots of brainstorming about other fun captcha-ish constructions, but the key question is whether they satisfy their purpose, which is to filter machines out and only those.

In low scale settings, if it's a place almost nobody knows, then this works, but many approaches work like just asking "What is 1+1?". Scale is low, no bot writer will bother to adjust.

In high scale, high visibility, none of this works. The incentive to break your captcha is so high that you'd need to basically construct a reverse turing test. You need to assume that the attacker is very powerful and very smart and will spend months custom tuning their solution to vreak your captcha. This is really hard and how to do it is the interesting discussion.

In summay, the setting matters. If it's the first one, we can debate toys all day long but they only have entertainment value. If it's the second then this is really hard and state of the art is to click pictures with traffic lights.

grogenaut 5 years ago | |

While I know this is a fun captcha, it does bring up a problem I'm having more and more with the web and mobile. There's no way my mom would ever be able to handle this captcha. Heck I didn't even get the 4 kills on the first one and I regularly play FPSes (I used a trackpad for this).

lamontcg 5 years ago | |

Have the CAPCHA require properly constructing a nonlinear programming problem to solve an optimization problem, where the requirements are not expressed in terms of the NLP and the human has to design it.

Which would have the side effect of putting the bot makers to work on useful and hard problems to solve.

robertlagrant 5 years ago | | |

Good idea! To prove you are a human, mine three Bitcoin.

flanbiscuit 5 years ago | |

The DOOM Captcha is just using html/css/js so it's easy for bots to crack with simple DOM querying/manipulation in an automated browser. But what if canvas was used instead?

> A minigame with extremely vague description that you have to react to quickly to pass.

I dont know how advanced current bots are at breaking captchas these days but if you're using a canvas then they would have to use some kind of image/video processing and recognition and then also know the rules of the game. Just curious if using canvas would make things harder for bots. Maybe it's already been done, I have no idea

tshaddox 5 years ago | | |

I believe a simple JS browser extension or automation script could easily ask about every pixel in the canvas. For this case I suspect it would be very easy to iterate over each row of pixels looking for a few consecutive pixels that uniquely match the monster and then trigger a click on those coordinates.

dahjkol 5 years ago | | |

Probably by grabbing a pixel of a monster and "clicking" on it. Pixel bots are as old as time. Learned about then playing runescape as a kid but never wanted to be banned. My friend made a few for fishing and woodcutting

testesttest 5 years ago | | |

For traditional text captchas, bots are better than humans. Flow usally goes, pay humans to solve 50000 ($500) then train an ML model. For things like recaptcha things get harder because it is not easy to proxy the captcha puzzles to have humans solve them (which is nessary to collect training data).

tim333 5 years ago | | |

>just using html/css/js

I think a problem is if it's all client side it would be quite easy for hackers to much about with. Now maybe if it sent the mouse movements and target positions to the server it would be possible to tell human movements apart in a way that was quite hard to crack?

dude187 5 years ago | | |

> The DOOM Captcha is just using html/css/js so it's easy for bots to crack with simple DOM querying/manipulation in an automated browser.

I mean, if you're looking at it at that level, it's just giving a "didn't pass" callback. A bad actor could just ignore that, and not care about it.

Without some sort of server side verification of the result, it doesn't really matter how difficult it is to script through the game itself. Even some crazy hard game in canvas isn't any more difficult for a bot to script around, if the server doesn't have any way of knowing anyone actually jumped through the hoop.

ehsankia 5 years ago | | |

Yeah, I was really surprised to see it was basic DOM. Canvas version wouldn't even be that hard to do. And yes, it would definitely be breakable, but at least not with a javascript onliner.

handrous 5 years ago | |

The trouble with anything designed to prevent computers from understanding something, while allowing humans to understand it, is accessibility.

unknown_error 5 years ago | | |

That's easy. Just partner with the CAPTCHA crackers and share revenue from your accessible users.

sillysaurusx 5 years ago | |

Minecraft is devilishly hard for reinforcement learning. You could have a captcha like "build a neat-looking fortress to prove you're human."

Wowfunhappy 5 years ago | | |

How do you validate whether the fortress was “neat-looking”?

rootsudo 5 years ago | |

This is a great patent esque idea. I thank you good sir, now to see if I can steal it as my own.

It also reminds me of only Konami able to have mini games in loading screens.

royjacobs 5 years ago | | |

I believe that was Namco (as evidenced by the Ridge Racer PS1 loading screen).

conception 5 years ago | |

I’ve seen this in the wild, or something like it. Your idea isn’t far away from it- https://www.jqueryscript.net/form/image-puzzle-slider-captch...

arbol 5 years ago | | |

Commercial version https://www.geetest.com/en used on lots of crypto sites

swiley 5 years ago | |

Perhaps you could generate the games/descriptions from parametric components.

bawolff 5 years ago | |

Things that require quick reflexes are probably easier for a computer.

jandrese 5 years ago | | |

WarioWare games aren't twich reflex games. They'll do something like show a bomb with a lit fuse on the screen and flash a single word like "blow" and you have to quickly maneuver the mouth of the character next to the fuse and press the button before it explodes. It's about comprehending the situation quickly, the actual action is extremely simple and low fidelity.

miquelcamps 5 years ago |

Hello! I'm Miquel the author of Doom Captcha

Thanks jukkakoskknen for sharing it on HN and everyone here talking about it, I hope you enjoy it :)

nocturnial 5 years ago | |

The only criticism I have, is that your timer is too fast.

I can listen to their demands and negotiate a peaceful, mutual benificial resolution. After that we can establish a framework to resolve hostilities. But when I want to talk about free trade and opening borders to exchange goods... the timer runs out.

rpastuszak 5 years ago | |

Cool idea, lower the volume!

tootie 5 years ago | |

It wasn't clear in the documentation, but should I take this too seriously?

macspoofing 5 years ago | | |

What do you think?

failwhaleshark 5 years ago | |

I was expecting 2.5D and weapons switching. ); Lol, gj. :-)

jukkakoskinen 5 years ago | |

Thank you for creating it. :)

schappim 5 years ago | |

This is awesome. Just wanted to say "Thank you"!

AzzieElbab 5 years ago | |

Hello and thank you.

xtiansimon 5 years ago |

Men In Black (1997)

“[In a shooting range, confronted with numerous menacing-looking targets, Edwards shoots a cardboard little girl]

Zed: May I ask why you felt little Tiffany deserved to die?

James Edwards: Well, she was the only one that actually seemed dangerous at the time, sir.

Zed: How'd you come to that conclusion?

James Edwards: Well, first I was gonna pop this guy hanging from the street light, and I realized, y'know, he's just working out. I mean, how would I feel if somebody come runnin' in the gym and bust me in my ass while I'm on the treadmill? Then I saw this snarling beast guy, and I noticed he had a tissue in his hand, and I'm realizing, y'know, he's not snarling, he's sneezing. Y'know, ain't no real threat there. Then I saw little Tiffany. I'm thinking, y'know, eight-year-old white girl, middle of the ghetto, bunch of monsters, this time of night with quantum physics books? She about to start some shit, Zed. She's about eight years old, those books are WAY too advanced for her. If you ask me, I'd say she's up to something. And to be honest, I'd appreciate it if you eased up off my back about it.” Source: IMDB

zoltrix303 5 years ago | |

Now i feel like rewatching that movie!

asddubs 5 years ago |

the prophecy has come true

https://www.youtube.com/watch?v=WqnXp6Saa8Y

sva_ 5 years ago | |

Please show that P != NP to prove that you're human. (500 characters remaining)

javajosh 5 years ago | | |

Let the proof of P != NP be A, where A is a proof expressible as a finite bitfield. The proof requires induction over an infinite sequence of proofs. But there is no mechanical way to move from the nth to the "n+1"th proof. Plus, "Galois", Gödel, Reimann and other intimidating names. QED.

asddubs 5 years ago | | |

if P = NP, it logically follows that NP = NNP, and NNP = NNNP, etc. this violates the law of conservation of energy, qed

supernova87a 5 years ago |

I know it's a bit of fun and kind of a joke.... but, makes me wonder:

What will happen some day when solvers and bots get so smart and human-like (and the CAPTCHAs evolving to keep up, with harder and harder tests) that the technology "have nots" human beings of our world will not even be able to prove they're human any more?

snypher 5 years ago | |

If you were walking through the desert and came across a tortoise on its back, would you help it? If so, what would it take for you to not help it?

imron 5 years ago | |

> What will happen some day when solvers and bots get so smart and human-like (and the CAPTCHAs evolving to keep up, with harder and harder tests)

Mission accomplished https://xkcd.com/810/

immibis 5 years ago | | |

the problem is when they learn to write constructive and helpful comments that are also propaganda

shvedsky 5 years ago | |

Maybe the tests will move from requiring some precise correct answer to instead requiring randomness that machines can't yet generate. It would be similar to the captcha that asks you to click inside a box and analysis not the answer but how you do it.

drloser 5 years ago | |

"Please prepare yourself for the blood test."

imvetri 5 years ago | |

Will not happen. Machines are problem solvers not problem creators unlike humans.

xkjyeah 5 years ago | | |

exactly. Captchas should just ask the user to design... CAPTCHAS

tgsovlerkhgsel 5 years ago |

Hitboxes are off, headshots don't count :(

Also, I was hoping for a full 3D FPS version with canvas etc.

gentleman11 5 years ago | |

Headshots in doom 1, the game that had auto aiming and no ability to look up originally? Also, fully 3d might make it slower to load in case somebody actually wanted to use this for real. I played a webgl doom clone once that lagged like crazy

suvakov 5 years ago |

Volume control is crucial part of this Turing test. User is human if lowers the volume immediately :)

abdusco 5 years ago |

Cool! Music is a bit too much, but it's great that it can be turned off.

Link to repo: https://github.com/vivirenremoto/doomcaptcha

da-x 5 years ago | |

Websites with auto-play.

Always a joy at 0:16am when everyone's already asleep.

gentleman11 5 years ago | |

I enjoy the music, but when you click to start, if there were two buttons it would be nice: click to start (silent) and start (with audio)

zlzu99999 5 years ago |

the captcha has been defeated http://telnet.asia/script.html

efreak 5 years ago | |

Now defeat squat captcha:

https://www.producthunt.com/posts/squat-captcha

JeanMeche 5 years ago | | |

It's from the same author btw !

ipsum2 5 years ago | |

That's a nice throwback to scene/warez days

xtat 5 years ago | |

this is beautiful

jaimex2 5 years ago |

Oh man, I just realised what would work really well:

A captcha with a random level from https://www.elizium.nu/scripts/lemmings/

shadowgovt 5 years ago |

It's good. Now if only I can get a version of this where the user has to punch the monkey to solve the CAPTCHA... ;)

maneesh 5 years ago | |

which hamsters are ACTUALLY dancing?

rzzzt 5 years ago | | |

Close all the pop-up windows to proceed.

dvtrn 5 years ago | |

Now that's a call back

Lammy 5 years ago | | |

I'm glad Everything2 is still around https://everything2.com/title/Punch+the+monkey+and+win+%2524...

WheelsAtLarge 5 years ago |

What this highlights is that CAPTCHAs/Security can be fun and not a never ending drag. Yes, this one is easy to break, even the author says so, but it's a fun concept. I hope this spurs a bunch of new thinking on what security can be. Miguel, GREAT JOB!

jacobmischka 5 years ago |

I failed this 3 times in a row as a human (I promise) on a touchpad.

pofjer 5 years ago | |

Nice try, Mr Robot. :)

jedberg 5 years ago |

It took me 15 tries to finally pass it with my touchpad. I almost broke out my mouse just to pass!

endisneigh 5 years ago |

Interesting. Fundamentally, I believe CAPTCHA, and attempting to distinguish humans from computers is pointless. I think it's better just accept it and design applications accordingly.

nerevarthelame 5 years ago | |

I don't understand. How would you propose protecting a website from DDoS attacks? What sort of design would address that?

neop1x 5 years ago | | |

Avoiding DDoSability of your app (removing bottlenecks, scaling up replicas, implementing rate-limiting, etc). There are probably some rare cases where captcha is useful, though. For example some account creations where you wish to have more human accounts created, especially if you need to later manually approve them by humans (verifying documents, etc) and don't want to deal with thousands of cat photos instead of passport scans.

arbol 5 years ago | | |

A reputation system that grew from captcha and was eventually self referencing - so high rep IPS could vouch for other unknowns. Assumes most people's IPS remain static though.

I realise parent commenter was probably talking about identifying upfront.

ninkendo 5 years ago |

My hands went straight for the arrow and ctrl keys, assuming it was real DOOM controls. I was disappointed :)

Waterluvian 5 years ago |

Captchas need to all be warioware games.

graderjs 5 years ago |

This was cool. Had a big smile on my face. Then I checked out your other work at

https://vivirenremoto.github.io/

You're incredible! This work is insane. "Uncle Roger Game" hahaha

smoldesu 5 years ago |

Just took a break from playing Doom Eternal to find this, it's so cute! The simple embed is a great idea too, I hope as the internet starts to decentralize we'll see more fun things like this floating around.

bitdestroyer 5 years ago | |

People think they can't figure out which images have stop lights, crosswalks, or bicycles in them now, wait until they introduce the Marauder Captcha.

eurasiantiger 5 years ago | | |

The Cthulhu Captcha tests whether the user becomes insane upon viewing it.

watersb 5 years ago |

Doesn't work on my old ipad. Or I don't know the magic gesture controls to make it happen. I'm not a robot, I think. But keyboard-only input systems are not obvious to me from an ipad.

maxk42 5 years ago |

THIS is the captcha I've been looking for all these years!

paxys 5 years ago |

This is fun but quite literally the opposite of what a captcha should be. I bet a bot will be able to solve this far easier than my grandma ever could.

pnine 5 years ago | |

I recommend reading the description in the link that mentions that concern is acknowledged.

paxys 5 years ago | | |

I did read the description, but that doesn't make the criticism any less valid.

gcp123 5 years ago |

The music made this a hostile user experience for me. No thanks.

proc0 5 years ago |

Amazing! This opens so many possibilities for captchas.

dividuum 5 years ago |

I‘d rather solve Super Turbo Turkey Puncher 3.

olswan 5 years ago |

Fun captcha but headphone warning needed!

0xbadcafebee 5 years ago |

Thank you for making silly technology

aussieguy1234 5 years ago |

Doesn't work on my phone

hirundo 5 years ago |

Am I the only one that has a problem with audio that defaults to maximum volume? Amazon does this too. But I keep my default to a volume that lets me crank up soft stuff enough to be audible. For pages like this, the sound just about makes my ears bleed before I can mute it.

thrdbndndn 5 years ago | |

My pet peeve of these is not the volume being too high (which they normally are), but the lack of volume control on web/desktop.

Unfortunately it would be more and more common as the mobile world take the dominance.

squarefoot 5 years ago | | |

Firefox already displays a small speaker icon on each tab playing audio that can be used to mute it. A nice addon could display also a volume slider when hovering above it with the mouse, therefore allowing volume control.

colechristensen 5 years ago | |

I don’t, the “volume” adjusters on websites are all ... fake?

There are several layers of volume control but the last one on the stem level is the only real one (ok maybe one more level on a physical speaker amp if you have it)

Application levels can only cut dynamic range by adjusting volume, i would expect the default level to be full, if i want something quieter i’ll turn down the system loudness

The nominal loudness of a sound is sometimes inconsistent but that is on the sound mastering level not the application level.

0xTJ 5 years ago | |

I get annoyed when sites don't have things at their maximum volume, and I keep all my applications at the max too, unless I need to mute one. The master volume is the only thing I touch regularly.

bob1029 5 years ago | |

No. This is a problem in a lot of places.

See: Every video game ever made with audio settings locked behind a 2 minute unskippable cutscene.

ehsankia 5 years ago | |

This but with video games. 90% of them default to every volume being set to 100%. They're always so damn loud, I usually use windows Volume Mixer to set them process to 50%, then go in and tweak individual stuff in game.

FooHentai 5 years ago | |

I'm not sure how I'd cope without a volume knob right there on my desk. Having to tab out and adjust the OS audio sliders would drive me mad pretty fast.

It's almost my prime reason for having an external DAC.

donkarma 5 years ago | |

Yeah it is awful, I should just turn down Firefox to low and watch all videos on VLC

forgotmypw17 5 years ago | | |

You can use browser permissions to allow/deny sound privileges just like with JavaScript

MeinBlutIstBlau 5 years ago |

As long as I don't have to click a damn bus or find the traffic lights again I'm all for it.

city41 5 years ago | |

If you are on desktop, when clicking the "I am human" checkbox, hold your mouse down for a few seconds, and move it around just a touch for good measure, before letting go. This is usually enough to convince the system you are human and it skips the image hunt.

ryantgtg 5 years ago | | |

This is great. Do you have any more tips about how to be more human?

middleclick 5 years ago | |

Have you encountered the CAPTCHA from this monstrosity of a company called Arkose Labs? I don't get angry but I was trying to redeem gift cards for an elderly relative and I was shouting and gave up.

Not sure if I am allowed to paste links but search for "arkose labs reddit" or just the name of this company on Twitter. Or search "arkose labs san francisco" on Google and just read the reviews.

Xplune13 5 years ago | | |

^This.

That CAPTCHA on Epic Games Store is hell. Worst part being you have to do it all over again if you fail even once and that one is enough for me to not login.

donkarma 5 years ago | | |

Easily the worst captcha there is, it makes you do the captcha 10 times (it says 10 to go after you do the first one) and if you get one wrong it doesn't tell you until the end after you've done them all, in which case you have to repeat it.

gentleman11 5 years ago | |

You can click whatever you want. Every captcha I’ve done in the last year says I missed something, then lets me pass. If I just click on trees and rocks, same thing, it lets me past. I think all they are doing is deeply fingerprinting you and the image matches are a red herring

joshmn 5 years ago | |

Have you met the sidewalk?

tgv 5 years ago | | |

May I introduce you to our lovely collection of traffic lights?

failwhaleshark 5 years ago |

I killed init. Whoops.

https://www.cs.unm.edu/~dlchao/flake/doom/chi/chi.html

miquelcamps 5 years ago |

It would be great to see John Carmack and John Romero reaction to DOOM Captcha. Can you help me with a RT so they can see it?

https://twitter.com/vivirenremoto/status/1397149833429987335

lostgame 5 years ago |

The music is terrible - (gives me 90's website MIDI audio PTSD :P) - but it's a cute idea.

Would this actually be an effective CAPTCHA? E.G. Security-wise?

Also, speaking of 90's-internet PTSD, I actually almost mistook this for a spam banner ad knowing already what I went into. Wayyy too many of those 'punch the monkey' or 'shoot the duck' animated banner ads that didn't even care where you shot. :P