How reliable/secure is QCaptcha?

Question

QCaptcha is an alternative way to protect a website from bots. It required a drag and drop action like this:

---

---

Question

How reliable is this implementation when compared to others mentioned on this site?

Answer 1

Here's how QapTcha works:

1. The JS creates a hidden input field and populates it with a random value.
2. When the user drags successfully, the JS posts that random value to a PHP script and clears the value from the form. It then creates a hidden input whose name is the random value.
3. The PHP script verifies that a session variable hasn't been set, and that the random value has been posted, and sets the session variable to the random value.
4. When the user posts the form, the script verifies that the randomly named hidden input exists.

This is kind of a neat trick, since it exploits the fact that most bots quickly fill out the form and don't parse/run JavaScript.

However, it's relatively trivial to bypass - we just fake the functionality of QapTcha completely. First, we grab the HTML of the page. Then, we send a POST to the initialisation PHP script, containing the random value. Finally, we send the POST with the random empty field set. Bam!

This is somewhat of a security-through-obscurity captcha, because any bot that knows about it can bypass it. However, it's reasonably safe to assume that it'll stop most non-targeted "drive-by" attacks, until QapTcha is prevalent enough to be worth bot developers' time.

An extension of this idea is the zero user interaction captcha, which, instead of testing the user, tests the browser. It tests whether the browser can properly use JavaScript, Flash, CSS, etc, and polls for mouse movement and keyboard presses. This data is sent with the form's POST, then analysed. For each test that is passed, the score is increased. If the score fails to reach a minimum threshold, action is taken, e.g. block the action, place in moderation queue, present with an image captcha, etc. There's also a trick using CSS where an input box is z-ordered behind other elements, which a user would never fill in but a bot would. There is a working example of this scheme somewhere, which someone presented at a talk a few years back, but I can't find it right now.