Accessible and effective CAPTCHA
May 20, 2008 – 9:57 am Tags: WebI’ve visited the topic of different CAPTCHA methods for checking that the user sending data is a human being in a couple of occasions in the past.
There’s usually a slight problem with accessibility and ease of use in some methods - take the typical image-based CAPTCHA as an example: How would you use it with a text-only browser, or with images disabled on a mobile browser to save traffic?
I’ve previously mentioned using a form field with a simple question like “What color is the grass?”, which would work quite well. Now, there’s an interesting new kid called Figlet
Figwhat?
FIGlet is basically a tool for generating ASCII “art” out of text using different typefaces. It has been around for quite a while by now, but I haven’t seen it being used on the web very much yet, despite being highly useful.
db db d88888b db db .d88b. 88 88 88' 88 88 .8P Y8. 88ooo88 88ooooo 88 88 88 88 88~~~88 88~~~~~ 88 88 88 88 88 88 88. 88booo. 88booo. `8b d8' YP YP Y88888P Y88888P Y88888P `Y88P' _______ __ _______ __ _______.___________. | ____| | / _____| | | ____| | | |__ | || | __ | | | |__ `---| |----` | __| | || | |_ || | | __| | | | | | || |__| || `----. |____ | | |__| |__| \______||_______|_______| |__|
As you can see, it’s quite easy to read if the font is good. Guess what it looks in a text browser or with images disabled? Exactly the same!
So you can probably see where I’m going on here. It’s easy to read, it works the same in various browsers, it can use multiple fonts, it’s difficult for a computer to parse because of the fonts but easy for a human…
Implementations
There are some implementations of Figlet linked at the FIGlet wikipedia page. An early PHP implementation can be found at Zend Framework’s proposal page for Zend_Figlet, and it also includes some examples on usage and screenshots.
With good tools like this, I hope there won’t be no more incredibly annoying and ridiculous captchas like the one at Rapidshare…

2 Responses to “Accessible and effective CAPTCHA”
It’s not accessible, just viewable in a text-based browser. If someone has eyesight problems and is using a text-to-speech program, this is useless
I prefer using a form field hidden from the visitor with CSS *and* with a message saying it should be left empty. If it’s not, it’s a bot that’s automatically filling in all form fields. Not ideal but goes a long way
By Vincent on May 20, 2008
Ok, bad terminology on my part… Let’s say browser-accessible =)
I’ve heard some advanced spambots can actually detect CSS-hidden form fields… but I think it’s still a quite good method, as not all spammers have the best tools available.
By Jani Hartikainen on May 20, 2008