Click Based Animation CAPTCHA - WSEAS

WSEAS TRANSACTIONS on COMPUTERSEman Omar, Thaer Khdour, Sara Tedmoriadditional studies have shown that clicking is thefastest entry method [8].CAC employs funny objects in its video challenge.While the choice of funny objects is neither relatedto the system’s technological requirements nor to itssecurity requirements, the authors believe that theuse of such objects can be useful from a usabilityperspective. To avoid user confusion, the funnyobjects move in a smooth motion from left to rightwith a slight variation in the vertical position. Theuse of other random and uniform motion paths isconsidered as future work.Because foreground objects can be extracted frombackground images, the use of distortedbackgrounds can be confusing without necessarilybeing secure [20]. Hence, in CAC the objects arepresented on a simple background.When compared to NuCAPTCHA [11] (shown inFigure 6) and HelloCAPTCHA [5] (shown in Figure7), CAC can be considered easier, mainly becauseusers can respond to challenges using pointingdevices. Furthermore, CAC is less dependent onnatural language, and therefore may be easier forlocalization in other languages. Moreover, a maindifference between CAC and Animation Captcha [1](shown in Figure 8) lies in their different mainfocus. While the primary focus of AnimationCaptcha is its security, the main focus of CAC is itsusability. Hence, the usability of AnimationCAPTCHA [1] has not been tested. The authors ofthis research strive to create for CAC users apositive user experience, and hence will examinethis by conducting a usability test.When compared to SweetCAPTCHA [16] (shown inFigure 4), the main difference is related to thechallenge response entry method utilised. Whilst,SweetCAPTCHA utilises a drop and drag technique,CAC employs a simple a simple point and clicktechnique. The authors believe that a point andclick approach is more user friendly than a drop anddrag approach as it has been found to be thequickest input method, whilst dragging is theslowest input method [8].One of limitations, common between the proposedscheme and other video and image CAPTCHAs, isthat these challenges can be difficult and notsuitable for users with visual difficulties.input. Moreover, for security reasons, theverification of users’ responses is performed at theserver side and not on the client side. This work isinspired by the hypotheses from NuCAPTCHA,pertaining to mouse interactions that can enhancethe CAPTCHA’s usability, and by the fresh, userfriendly nature of SweetCAPTCHA [16].4 CAC Description4.1 OverviewThe proposed prototype CAC is a motion-basedCAPTCHA, comprising of a video of animatedfunny objects on a plain light background. To passthe CAC challenge, the user must click with themouse on a specified, moving object(s) inside thevideo. The instruction,”click on the smiley face”, isan example of the CAC challenge.4.2 ImplementationCAC uses the traditional client-server model. Adobeflash is used to deliver the client-side animation.When a user requests a page that uses CAC, a serverside generated challenge is presented to the user,with instructions to click on a particular coloured,funny face. When the user clicks anywhere insidethe movie area, the time and position of the click,relative to the video starting time, is recorded andsent to the back-end for verification. For eachchallenge, only the first click is accepted. Serverside code then runs to determine for a particularchallenge, whether the user has clicked on thecorrect challenge response object or not. If the userclicked on the required object, the challenge isconsidered correctly solved; otherwise, a newchallenge is presented to the user.In this work, a static set of videos was generated fortesting purpose. Creating a framework fordynamically generating videos is considered out ofscope of the current research and may be addressedin a future work.4.3 Usability Related Objectives andDecisionsThe data entry methods of responses to CAPTCHAchallenges vary from one system to another. Thesemethods include: typing the answer in an input box,selecting the correct option from a drop-down list,clicking on the answer; or dragging and droppinganswers to boxes. While the most common methodof answering a CATCHA challenge is typing theresponse in an input box, mouse interaction methodsare more usable since they simplify and acceleratethe answering process [13]. To support this notion,E-ISSN: 2224-28724.4 Security Related Objectives andDecisionsAlthough CAC’s usability is the primary objectiveof this study; never the less; some security relateddecisions have been made.348Volume 16, 2017

WSEAS TRANSACTIONS on COMPUTERSEman Omar, Thaer Khdour, Sara Tedmoriimproper response harvesting. Minor typing errorswere found and corrected.Even though the movement of objects displayed onthe CAC CAPTCHA is uniform, some motionrandomness has been added. The added randomnessis small enough to be unrecognized by users, but theauthors believe that this randomness will help makeobject auto recognition harder. Even though securityoptimization of CAPTCHAs is not the mainobjective of this work, the authors believe that theuse of the time dimension enhances the security ofCAC compared to other CAPTCHAs that depend onstatic images.Since objects continually move, a particular set ofpixels forms the answer of the challenge only at aparticular point in time. Server side verificationshould be used in order to validate users’ responses.Although, CAC’s security is outside the scope ofthis paper, the authors acknowledge that an objectrecognition algorithm, like the one that is describedin [18], can break this CAPTCHA. To address thisproblem in the future, the authors propose the use ofemerging images as described in [18].5.1 Participants, Demographics, andFamiliarity with CAPTCHAsParticipants were recruited using the social networkof the main author (i.e. relatives, friends, and friendsof friends). Participants can skip any question ifthey want, and may exit the study at any time. Atotal of 49 adult participants were contacted, out ofwhich 33 completed the study. Out of the 33, 7participants did not have a proper player for flashanimation. In this study, the authors report theresults from the 26 participants who completed thestudy and could play the animated CAPTCHAs. Outof the 26 participants, 11 participants reported theirage. About half of them (5 participants) werebetween 21 and 30 years old, whilst the remainingwere between 30 and 40 years old. In relation to theparticipants’ educational level, all participants whoreported educational level had at least a universitybachelor degree.Regarding the frequency of using websites, allparticipants except one, reported that they use theWorld Wide Web (WWW) daily. This oneparticipant reported using the WWW several times aweek.Regarding familiarity with CAPTCHAs, Themajority (15 participants) reported they haveencountered CAPTCHAs before this study (8 ofthem reported they visit websites that requiresolving CAPTCHAs several times a week, 3reported once a week and 4 reported less than once aweek). However, 10 participants reported theyhaven’t encountered CAPTCHAs before this study.5 Usability StudyAn online user study was conducted between theperiod of 5 December 2014 and 8 December 2014 tofind out how users respond to the proposedprototype. Online studies facilitate data collectionfrom more participants. Snowball sampling wasused to enable a larger number of participants.Contact was initiated through email and socialmedia notices passed on through personal contactsor acquaintances. The main purpose behind thestudy was to evaluate ease-of-use and to identifyany usability problems that might arise. To get anindication of how the prototype performs incomparison to a classical text based CAPTCHA,participants were presented with two sets ofCAPTCHAs. The first set contains sample fromreCAPTCHA’s text-based CAPTCHA challenges.The second set contains challenges of the proposedCAPTCHA, CAC.The usability study described here has beenreviewed and approved by the Carleton UniversityResearch Ethics Board. Participants were notifiedthat they are taking part of a study about usingCAPTCHAs in websites. Then they were providedwith a demographics questionnaire before actuallyperforming a real CAPTCHA study followed by auser preferences questionnaire. A pilot study of theusability study was conducted prior the actualusability study. The purpose of the pilot study wasto avoid problems such as missing questions andE-ISSN: 2224-28725.2 User Preferences SurveyA user preferences online survey was conducted tostudy if there is any correlation between the user’sperceived difficulty, the time needed to solve thechallenge, and the accuracy of the response.Participants were asked to rate a total of itemsrelated to their preferences on a 10 point likert scalewith 1 equal to 'strongly disagree' and 10 equal to'strongly agree'. The survey also included two openended questions which allowed participants todescribe freely what they like and dislike about theprototype. The nine questions of users’ preferencessurvey are presented in Table 1. Questions 2through 9 were related to the new proposedCAPTCHA, CAC.Table 1Users’ PreferenceQuestions.349Volume 16, 2017

WSEAS TRANSACTIONS on COMPUTERSEman Omar, Thaer Khdour, Sara Tedmorichallenges were more challenging and are courtesyof [4].Table 1: Users’ Preference QuestionsQuestionNumberQuestion TextQuestion 1Based on my experience, it was easy tosolve the traditional text-basedCAPTCHAs that I normally encounteron the webIt was easy to accurately solve thechallenges.The challenges were easy to understand.This CAPTCHA mechanism waspleasant to useI found it hard to solve challengespresented on this CAPTCHA scheme.I found this mechanism well suited forthe websitesOn websites, I would prefer using thisCAPTCHA mechanism compared toother CAPTCHAs.This CAPTCHA mechanism is moreprone to mistakes than traditional textbased CAPTCHAsThis type of CAPTCHA would be easyfor attackers to breakQuestion 2Question 3Question 4Question 5Question 6Question 7Question 8Question 9Fig. 4: Easy reCAPTCHAAs for the CAC challenges, four challenges were of“normal” difficulty. Each included 5 differentobjects; the animation was presented as 12 framesper second with overlapping between objects.Different objects were targeted in differentchallenges. Figure 5-a is an example of a CACchallenge with “normal” difficulty, in whichparticipants were asked to click on the baby image.These challenges will be referred to as moderateanimation variant.To get a better understanding of the effect ofincreasing the movement speed of objects, two otherchallenges were displayed at higher frame rate; onewith 24 frames per second and the other with 48frames per second. Both challenges have 5 nonoverlapping objects. These challenges will bereferred to as double and quad speed variantsrespectively.5.3 TasksA typical session consisted of the following:1. Complete project information which wasmade available online. Accessing the surveyand submitting responses were consideredconsent to participate2. A web page clearly stating that the purposeof this study is not to test the participants’performance in answering the challenges,but to test the effectiveness of the prototypeand uncover its strengths and weaknesses.3. Each participant was asked to solve two setsof ten challenges. The first set of challengesare those of reCAPTCHA, a popular textbased scheme, while the second set arethose of CAC, the proposed motion-basedprototype.4. Each participant was asked to complete aquestionnaire about the participant’sopinion and perception towards the twoprototypes.5. The session concluded with an online thankyou message.A static set of ten reCAPTCHA challenges wascollected from two sources. Five challenges wereeasy and are courtesy of [12]. Figure 4 is anexample of an easy challenge. The other fiveTo help understand the effect of overlappingdistortion on usability, two other challenges weredisplayed. The challenges contain overlappingobjects; one with 25 percent of object widthoverlapping as shown in Figure 5-b and the otherwith 50 percent of object width overlapping asshown in Figure 5-c . Both challenges consisted of 5objects moving at normal speed. These challengeswill be referred to as small and large overlapvariants respectively.The last two challenges contained different numberof objects; one with 10 objects as shown in Figure5-d and the other with 3 objects as shown in Figure5-e. In both challenges, the objects were nonoverlapping and moving at normal speed. Thesechallenges will be referred to as small number ofobjects and large number of objects variantsrespectively.The set of text based CAPTCHA challenges waspresented in a random order before randomlypresenting the CAC challenges.Fig. 5: Click based Animation CAPTCHA (CAC)(a) Moderate Animation CAC.E-ISSN: 2224-2872350(b) AnimationVolume 16, 2017

WSEAS TRANSACTIONS on COMPUTERSEman Omar, Thaer Khdour, Sara TedmoriCAPTCHA with25%objectoverlapping.multiple responses of the same user, theLimeSurvey was configured to use local caching.For each response in the study, an email wasreceived form LimeSurvey. No automated responsewas conducted.5.5 Limitations(c) Animation CAPTCHA with 50% object overlapping.(d) Animation CAPTCHA withten objects.Although the conducted user study hasresulted in some preliminary findings, its design hasa few shortcomings. Hence, a number of limitationsrelated to the user study need to be noted. The firstlimitation concerns participant observation. Asmentioned earlier, an internet based data collectionmethod was employed in this study to help recruit alarger number of participants. Hence, the authorswere not able to observe the participants in theirstudy. The second limitation concerns the samplesize. A sample size of 26 participants whosuccessfully completed the user study cannot beconsidered representative of all CAPTCHA users.(e) AnimationCAPTCHA with 3Objects5.4 Environment SetupA web application was used to gather users’responses to both CAC and reCAPTCHAchallenges. At a later point, the users’ responseswere validated off line. A static set of ten clickbased animated CAPTCHA challenges wasprepared and presented randomly to users. Anotherstatic set of ten reCAPTCHA challenges, withdifferent distortions, was used. Each challenge waspresented once to each user; only first response wastaken into account.Each set of challenges was presented on singlewebpage. In the reCAPTCHA challenges page, eachchallenge has a designated text field for the users toenter their answers. The images of reCAPTCHAchallenges were approximately 300 x 50 pixels. Theframe size for CAC was 800 x 300 pixels. Allimages embedded in the animation were scaled to50 x 50 pixels.Javascript was used to record users’ responses to theCAC challenges. The response values were in thehorizontal and vertical mouse coordinates of thefirst mouse click on the CAPTCHA, in addition tothe time elapsed from the moment the animationwas loaded until the moment the participant clickedanywhere on the frame. This is important forvalidating participants’ answers, since recording thepositions of clicks alone is not sufficient to verifychallenges’ answers as target images are changingpositions over time. Participants were asked to clickon a link to load a CAC’s challenge. The link wasaccessible only once per CAC challenge.Survey length refers to the amount of time arespondent needs to complete the survey. Thislength is very important because it has a directaffect on response rates and data quality. The longerthe survey is the lower the response rates andqualities of responses are [7]. Hence, the thirdlimitation concerns the survey length. The surveyincluded 20 challenges in total. The authors believethat the addition of more challenges (with differenttypes of distortions) will affect the response ratesand quality of responses. Finally, due to timeconstraints, no usability comparison was conductedwith the related works such as [11], [5] or [1]. Thiscomparison is left as future work.6 ResultsThis section summarises the results obtained fromthe user study. A discussion of these results isprovided in the next section.6.1 Accuracy ResultsOnly one attempt was given to each participant tosolve each CAPTCHA challenge. Figure 6summarises the accuracy rates for CAC variants,and reCAPTCHA challenges. Results shown in thefigure indicate that the highest accuracy rate isachieved with the moderate animation variant ofCAC. Most other variants of CAC achieved betteraccuracy than reCAPTCHA. As expected,increasing the speed of the animation, results inTo prevent auto responding, a simple CAPTCHAwas used as a protection mechanism. To avoidE-ISSN: 2224-2872351Volume 16, 2017

WSEAS TRANSACTIONS on COMPUTERSEman Omar, Thaer Khdour, Sara Tedmorilower accuracy rates. Surprisingly, doubling theoverlap percentage does not have a large effect onthe accuracy rate. Furthermore, the number ofobjects, whether small or large number, have verylittle effect on the accuracy rate.Fig. 8: Users’ PreferencesFig. 6: Accuracy rates of CAC and reCAPTCHA6.2 Users’ PreferencesFigure 8 summarises the participants’ preferences.The questions themselves are presented in Table 1.Overall, participants had a more positive attitudetowards the new Click Based Animation CAPTCHAthan towards the text based CAPTCHA. Participantsfound the new approach easier than the text basedalternative. Furthermore, participants expressed apositive attitude towards most of the usabilityfeatures of the proposed scheme. Participants foundCAC pleasant, easy to understand, preferred, andwell suited for use in websites. Participants’expressed a neutral response towards the securityfeatures of the proposed scheme.6.2 Response TimeFor technical reasons, response time was calculatedfor the new CAPTCHA challenges only, and not forthe text based CAPTCHA challenges. Figure 7summarises the users’ response times for theproposed CAPTCHA. As shown, the shortestresponse time was achieved with the highest speedof animation, and the longest response time was thatof the CAPTCHAs with a large number of objects.Surprisingly, challenges with small overlap, have aslightly shorter response time compared to regularchallenges. Using a smaller number of objectsresulted in a shorter response time compared toregular challenges.In relation to the open ended questions, participantsprovided some positive such feedback such as: “Ienjoyed the animations. They were very nice”,“Yes, I enjoyed the CAPTCHA with the animatedfaces more than the letters and numbers”, “I like itmore than text-based CAPTCHA” and “Easy andinteresting”.Responses to the open ended question also includedsome negative feedback such as: “some of theimage-based CAPTCHA were very slow. I alsosuggest if more images are included in theCAPTCHA”, “there should be more options in thefaces (in future), and the motion should be quicker”,“it is easy and fun. But I won’t prefer using it all thetime especially when I’m in hurry. It would be greatif websites provide

Click Based Animation CAPTCHA . EMAN OMAR1, THAER KHDOUR2, SARA TEDMORI3. 1School of Electrical Engineering and Computer Science (EECS), Faculty of Engineering, University of Ottawa, 800 King Edward Ave., Ottawa, Ontario, K1N 6N5, CANADA, esyomer@gmail.com . 2Department