The Spanner logo
    • Home
    • Blog
      • Blog home
      • RSS
    • Login
    • Home
    • Blog
      • Blog home
      • RSS
    • Login
    The Spanner logo

    The Spanner
    Web security blog

    Made by Gareth Heyes
    Follow me on Twitter: @garethheyes

    Javascript for hackers!

    Hackvertor logo
    Shazzer logo
    My Github account
    Recent posts
    Introducing Feedworm: A Privacy-First RSS Reader That Lives in DevToolsSpeedy RSVP extensionAutoVaderHackvertor history and tag finderShadow Repeater v1.2.3 releaseBurp Hackvertor v2.1.24 releaseHacking roomsXSSing TypeErrors in SafarivalueOf: Another way to get thisMaking the Unexploitable Exploitable with X-Mixed-Replace on FirefoxThe curious case of the evt parameterCSS-Only Tic Tac Toe ChallengeRewriting relative urls with the base tag in SafariBypassing DOMPurify with mXSSNew IE mutation vectorHow I smashed MentalJSMentalJS DOM bypassAnother XSS auditor bypassXSS Auditor bypassBypassing the IE XSS filterUnbreakable filterMentalJS bypassesmXSSJava SerializationBypassing the XSS filter using function reassignmentRPOSandboxed jQueryX-Domain scroll detection on IE using focusEpic fail IEnew operatorDecoding complex non-alphanumeric JavaScriptHacking FirefoxDOM ClobberingBypassing XSS AuditorThe evolution of codeNon-Alpha PHP in 6-7 charsetTweetable PHP-Non AlphaMentalJS for PHPOpera x domain with video tutorialSandboxing and parsing jQuery in 100ms

    Accessible captchas

    By Gareth Heyes (@hackvertor)

    Published 19 years 1 month ago • Last updated March 22, 2025 • ⏱️ 2 min read

    ← Back to articles

    To create an accessible captcha is not easy task because the very nature of the test creates accessibility problems because it is difficult to tell machines and humans apart. I like difficult problems that people have a hard time in figuring out the right solution :) Usually what I tend to do when coding for something like this is to think of a extremely simple concept and keep the code as simple as possible yet offer enough security for it to work correctly.

    The Heyes method

    My sample code creates a grid of 3 items with 3 checkboxes per item; this can obviously be increased in the code. The idea being is that the "Heyes captcha" tells you which items to select. If you select the correct items then you passed as a human otherwise it is assumed you are a robot. Now the Heyes captcha is recreated every time an invalid request is sent so therefore providing enough security against a brute force attack.

    Update

    <ol> <li> Added some new security features which prevent attacks described by Trev and kuza55. Unfortunately the captcha becomes slightly less accessible because of these new features. </li> <li>20-04-2007 - Added two classes which extends the base class, one randomiser class which places the checkboxes in a random order and then uses absolute positioning to position the checkboxes. The other class will be a fully accessible one which will use random sentences (Still under development)</li> </ol> [Heyes Captcha 1.4](http://www.thespanner.co.uk/wp-content/uploads/2007/04/heyescaptcha.zip)

    Big thanks

    Ronald - Jungsonn Studios kuza55 - sla.ckers forum trev - sla.ckers forum Jeremiah Grossman

    ← Back to articles