Hacker News Reader

Comment by C1D | Hacker News Reader

It really isn't that secure since a bot could be used to calculate the checkmate and it takes more time than a normal CAPTCHA.

View on HN

But then someone would have to target that forum specifically. The bots out there now won't have this functionality.

Also, as someone else mentioned, it might keep beginners out, which could be what they want? Seems like a bad idea, but it's not my board so...

That is definitely true, it's not good enough to secure yourself against a persistent attacker but I do think it's a good captcha:

It's a topical captcha that the target audience of the site will recognize and most likely enjoy.

It's significantly different from any other captcha so that automated untargeted bots will not be able to beat it

It has a high enough entropy that untargeted bots that repeatedly attempt to guess the answer will fail

People without a chess background most likely have to think about the answer in a way that makes buying human workers a less attractive option (maybe)

topic filtering ... and suddenly they noticed a sudden raise in quality in the forum.

Anyway, the same effect could be obtained by writing a "captcha" that simply asks: "Click on the queen", a fixed chess board picture. They are assuming no one targets them, so it's not so important how hard it is. (until someone targets them)

I have to agree with most if not all of those points but for some people that don't know how to play chess it would be harder. I thinks is pretty innovative but I definitely wouldn't try to release it publicly as an attack could easily use a DOM parser to bypass it.

For it to even be nominally effective, the state of play would need to be non-scriptable - but the piece types, positions, number of necessary moves are all available in the DOM (and some in handy data statements no less). And it appears to post by ajax to a url which returns a boolean for success or failure. And it lets you retry. So yeah, other than being pretentious about chess it would appear to be more or less pointless at actually detecting whether someone is a human or a bot.

> it takes more time than a normal CAPTCHA

Most of these captchas are very easy. If the targeted king was easier to spot (e.g. marked red) I'm sure I would solve them faster than the omnipresent reCaptchas (even knowing that I only need to type the less legible word).

Yes but for some people that don't know how to play chess it would be very hard.

I'd hazard a guess that most people posting on a chess forum know the rules.

And as somebody else pointed out, maybe they don't want new topics asking what are the possible moves of a queen.

>for some people that don't know how to play chess it would be harder Opps.. I didn't realize.

It is on a chess forum.

Reply on news.ycombinator.com