Comments for Improving KittenAuth

Lets see how this works

How about an LOLcat Auth :) There's hundreds of lolcat images on the web with varying lolcat phrases on each one.

asda sfasgas gasgasdasf asgasg asgasdasfasgasgasgasdasfasgasgasgasdasf asgasgasg

Pretty cute system (pun definitely intended).

A buddy showed me KittyAuth, and the first thing that came to mind is the utter simplicity of caching image bytesizes... while it's important to keep the images 'unique' and 'recognizable' to be decyphered by a human user, it's equally important to keep them as ambiguous as possible to a computer.

I completely agree that a single 'stitched' image is superior to an array of individual images for this reason. Just four unique images become 24 unique 4x1 stitched images, quickly increasing your entropy pool just by moving them around. Each individual image added to the pool increases that exponentially. Add a little bit of random noise to the images, maybe blur the edges to prevent (or at least discourage) pixel comparison, and it becomes an unreasonable task for a data parser to keep up.

The idea of ajaxing positional clicks with JS / xml maps, while good, may be too server intensive for some sites (and overly complicated for their creators ). If your stiched image is auto-generated, and the server knows which 'position' each image is in, simply dropping the checkboxes below each individual 'image' in the larger meshed version would have the same effect.. There's little practical difference in sending the selections as single clicks to be collected/verified sequentially versus sending them all at once. More often than not the user will click them in left-to-right order anyway.

Just my 2 cents.

asdcc

KittenAuth sounds like a great idea.
I suspect that it's already overkill for most blogs, but people (such as myself) can't resist thinking up minor improvements.

Brainstorming: Tell the user "click on the three dogs once, then click on the three cats twice."
Then Javascript can autosubmit after exactly 9 clicks -- so it's better usability than "click all the kittens, then press submit".
For a 3x3 grid of images, with exactly 3 cats, 3 dogs, and 3 other, I figure that gives you 1680 combinations -- so it's better security than "click all the kittens" in a 3x3 grid.
(And of course you can get more combinations by going to a bigger grid).

Brainstorming: perhaps you could put the instructions in the picture(s).
Even when the instructions are in easy-to-read, legible letters, it's still going to slow down spammers if they have to OCR each one.
And of course, submitters can't just type in the OCR'ed characters, a submitter has to make sense of the instructions.

Brainstorming: In an image, tell the user "In the textbox below, copy-and-paste the URL of this site followed by the 5 letters "cutie". Thank you." This helps you figure out if there really is a "free p*rn" man-in-the-middle attack.