Avitar has asked for the wisdom of the Perl Monks concerning the following question:

In the Human Identifiable code that i have for authentication on my site, I have obsfucated images A-Z & 0-9 with each character a seperate image that is not OCR. The idea is that a person reads the code, and the server parses it. Currently i have the perl program copy a random string of images that have these characters on it into a folder with the same name as the authenticating user's session id. The images are renamed when copied to denote their order (not what the represent).

It works, but i would rather generate obsfucated images on on the fly since I am using the same 36 images which can be cached & saved by an individual, who can note which image correlates to which character and then make a program to run comparisons on the images pixels to bypass the human readable code.

Anyone know how to do this? I saw an attempt on an old png image generation (in cpan i belive) but it looked like it was possible to OCR it from what i saw. Ty in advance.

Here is a refence to what i am talking about (when you sign up for yahoo mail): http://xrl.us/c69p (Link to edit.yahoo.com)

BTW: I am using a Win32 based system (not by choice) with activestate perl.

edit (broquaint): shortened 'page-widening' URL + linkified it

Replies are listed 'Best First'.
Re: How do you make on the fly images?
by tachyon (Chancellor) on Sep 24, 2004 at 00:07 UTC
      tachyon,
      Thanks this helps alot, I am pretty sure i will be using GD::SecurityImage to take pre-made images and add text that is blurred and mutilated in real time.
Re: How do you make on the fly images?
by FoxtrotUniform (Prior) on Sep 23, 2004 at 23:10 UTC

    Before you spend a lot of time on this, you might want to have a look at A little fun with merlyn and the discussion around it. In my opinion, it's just not all that hard to OCR even "obfuscated" text.

    As far as munging images goes, GD seems to be a popular choice. (GD::SecurityImage seems to do what you want, in fact, though I don't know whether its images are sufficiently "obfuscated" for your taste. Is that the module you were talking about?) For procedural image generation, especially unique image generation, this book is the best reference I've ever found.

    Going a bit off topic, I wonder what sort of "security images" one could come up with that would be reasonably secure, yet easily recognizable? You'd probably have to get into audience-specific content; for instance, a site for gamers might use screenshots from computer games, and ask the user to identify the level shown. Any ideas?

    --
    F o x t r o t U n i f o r m
    Found a typo in this node? /msg me
    % man 3 strfry

      Merlyn's script has a few problems, but it does give me a good baseline. TY very much.
Re: How do you make on the fly images?
by zeimusu (Sexton) on Sep 24, 2004 at 01:29 UTC

    Consider accessibility when doing this. The W3C has a discussion document about using mangled images and suggests a few alternatives: Logic, word, or trivia questions, sound, credit-card checks. All of these have difficulties at least as great as with the images, but could get one thinking.

    Also see the links at the bottom of that document, especially the CAPTCHA project

Re: How do you make on the fly images?
by punkish (Priest) on Sep 23, 2004 at 23:07 UTC
    Use any of the various image modules (imagemagick, gd, pbm). Generate a random string, create an image, apply a random distortion effect (don't distort it so much that the human can't identify it), and there you go.

    These are captchas (or something like that) that you are talking about. Bet if you google around, you will find someone has already made a module.

    Good luck.

Re: How do you make on the fly images?
by TedPride (Priest) on Sep 24, 2004 at 01:04 UTC
    Another possibility is to scramble the image names for each user based on a randomly generated key, and create links from the generated image names to the real images. Then you delete the links when the form is submitted, and also run a clean-up routine every so often to get rid of extra links.

    The problem with this method is it isn't as elegant as generating a single image on the fly, and perhaps not as efficient either if the images are very small and easily merged.

    Or you could dispense with the human segment entirely and base your pass-fail on how long it takes for the form to be submitted. An automatic script will probably submit in under a second, while even the fastest person is going to take at least a couple seconds to type his response.

      I already have a better script in place; please read the topic. I wanted image generation on the fly not a scrambled link or image copier.
Re: How do you make on the fly images?
by TedPride (Priest) on Sep 24, 2004 at 06:02 UTC
    If you feed the images through a script...

    <img src="/cgi-bin/imgrefer.pl?woijfoeiwjim32&keypart1">

    you can randomly change the image names every time you send the page. Key part 1 (passed) plus key part 2 (contained in the image referral script) will decrypt the hash into whatever the actual name is, and there should be no way for the spider to guess which image it is without much more advanced processing.

    I don't know why I didn't think of this before :)

      I already have this please read the topic. I wanted image generation on the fly.
Re: How do you make on the fly images?
by barathbr (Scribe) on Sep 23, 2004 at 23:07 UTC
    A little offstream, but, why do most people nowadays apologize for using a Win32 based system - is it so wrong to use Windows. I love the powerful features of Linux and/or Unix flavors, but does anybody feel the need for those features all the time, I don't ...

      Mousing around constantly pisses me off (and aggravates a mild rotator-cuff injury I picked up a month or so ago). Give me a console and a well-designed text editor, and I'm much happier than if I have to constantly click and drag. (After all, communication has evolved past the level of crude gestures and pictograms... perhaps interfaces should, too. :-)

      Of course, you can do all that on a Windows system (and I have); cygwin (or msys, which I prefer), bluebox, and a slew of smaller extensions let you make a Windows box feel fairly Unix-like, and still be able to play new-release commercial games. It's just nice not to have to go to all the trouble.

      --
      F o x t r o t U n i f o r m
      Found a typo in this node? /msg me
      % man 3 strfry