[RESOLVED] Random IMG/Code generator

[FishGuy]

Hi,
I was wondering how this is done, you know sites that require you to login and next to the login requires you to copy some security code from an image that the site generated in order to stop spiders/auto password crackers busting your site.?
i.e
https://secure.overture.com/s/dtc/center/?mkt=us

if you refresh the page a different image is generated.

Is this done serverside and how?

I think something along the lines of generate a random string - stire in a variable - somehow generate image containing string - then on submit compare entered value to variable.

It is known as CAPTCHA.

I am looking at ASP>Net implementation now.

Good article found
http://www.15seconds.com/issue/040203.htm

Any other tutorials feel free to post.

[penagate]

We used PHP (yes, server side always) to generate a random string, written on to a new image using the GD image library functions. A few overlayed translucent circles in the background to fool OCR scanners. there are a couple of ways to store the string to validate against, we used a session variable but I was also considering storing an MD5 hash of the string as a hidden form element and then MD5'ing the user's input and comparing.

Can't help you with ASP but if you are considering PHP I can give you the class we used.

[arbinger]

I was wondering how this is done, you know sites that require you to login and next to the login requires you to copy some security code from an image that the site generated in order to stop spiders/auto password crackers busting your site.?

You might check out HTMLCaptcha, a .NET assembly I am preparing to release. HTMLCaptcha outputs a small icon-sized image -- a real picture, not skewed text -- created entirely in HTML/CSS, and then offers a random selection of choices that best describe the image. The user must select the correct descriptor in order to validate.

It's currently in Beta, but the demo version can be downloaded from

http://www.htmlcaptcha.com

The help documentation is included with the demo, along with samples in C#/VB.NET, and should help in understanding, in general, the way CAPTCHA is generated.

One of the unique things about HTMLCaptcha is that no images have to be created and saved. The output is pure HTML/CSS, so can be inserted directly into the web page.

JA

[CornedBee]

but I was also considering storing an MD5 hash of the string as a hidden form element and then MD5'ing the user's input and comparing.

Well, good thing you didn't. Breaking that is as simple as replacing the MD5 you put in the hidden with the one of whatever was entered.

[penagate]

What a stupid idea. I must have been drunk.