This is different to the other questions on this topic. I’ll try to make this relevant to as many people as I can, though it is a fairly specific problem.
Imagine a button(html button) on a website that, after it has been clicked a certain number of times, will give the user a ‘point’. The points are stored in a database for many users and these points can be transferred between accounts.
I don’t want someone to just make a quick macro to keep clicking the button while they sleep and so I need some sort of solution. Here’s the options that I think have some potential:
- Use a recaptcha for every single time they want to click the button (painful).
- Use cookies and recaptcha so it allows them 10 clicks (say), but then asks for recaptcha verification. (they could just delete the cookie).
- Use an alternative to captcha that isn’t too painful.
And other ‘iffy’ ideas:
-Simply moving the button around the page in combination with some other sneaky strategy.
-When the user presses the button they are required to submit some sort of puzzle which will be used to check if others are human.
What do you think?
Also, is it at all possible to have the points system almost 100% unhackable/unmacroable? It’s very important that the system is secure. Any potential problems you can with such an idea?
Thanks.
Rather than a button, make a clickable image with a target. Make the image dynamic and the target be something specified elsewhere on the page (maybe just above the image). So, for instance, one time it could be “Click on the square” with a square and a triangle showing in the image. The next time it might be “Click outside the circle” with a circle in the lower half of the image. The possibilities are endless. (I’d stay away from using color as the only clue, out of consideration for the color-blind.) Any bot would have to know what coordinates to send back to simulate the mouse clicking in the correct target area.