i5hi / slider_captcha_server

a slider captcha puzzle creation and verification library to protect http apis
GNU General Public License v3.0
2 stars 4 forks source link

Evaluation of reverse engineering the puzzle #4

Open i5hi opened 1 year ago

i5hi commented 1 year ago

Mental Model To Evaluate Reverse Engineering

The gist of the challenge is as follows:

The server provides the client with 3 piece of information:

The solution is then the x axis (as a % of the width of the puzzle) that the user has to figure based on sliding the piece into the correct position.

Current implementation

Currently we crop the piece from the puzzle and replace it with black pixels. This can very easily be reverse engineered. We can easily use the same image library in rust to find a set of black pixels the size of the piece, we even have y which gives us the starting point to start searching the image pixel by pixel.

A good start would be to replace the cropped section with randomly selected colors from the image. This would look obvious to a human (maybe also to a well trained AI), but not as straightforward to scan as a set of black pixels.

Keeping this as an open discussion so the method can be constantly improved upon.

i5hi commented 1 year ago

ChatGippity had this to say about reverse engineering this code:

One possible approach would be to use a template matching algorithm to find the location of the puzzle piece in the original image. Template matching involves comparing a template image (in this case, the puzzle piece) to a larger image (in this case, the original image) and finding the location where the template matches the image best.

Another approach would be to use edge detection techniques to identify the edges of the puzzle piece and then search for similar edges in the original image. This could involve applying a filter such as the Canny edge detector to both the puzzle piece and the original image, and then searching for matching edges using techniques such as the Hough transform.

Chatgippity continued:

However, both of these approaches would require some degree of experimentation and fine-tuning to achieve accurate results, and may not be reliable or efficient for all types of images and puzzles. In general, it may be easier and more reliable to simply use the slider puzzle as intended, as this is the method for which the puzzle was designed.

So we are pretty good with what we have. We can look to upgrading as we find spammers abusing it. This should protect from most naive attackers.