Anti-Captcha Using Mouse detection

captcha, javascript, security

Solution

No it is not possible to create a secure mechanism that detects a human by relying on mouse movements. Check out the java.awt.Robot class for just one example of how to hack it using software only. I used this class to write an Easter egg into a program that jacks with the mouse and makes it dance some crazy patterns. The user's loved it ;-) You could also hack it with the USB Rubber Ducky.

Problem

I want to know if it is possible to create a secure human detection mechanism (not using captcha) for a form with just javascript to detect mouse movement since jquery nor operating system code can move the mouse (so Im told). Here is my plan: - With jQuery I can detect if the mouse has moved, and then allow a form to submit if it has. - I already have cross site scripting enabled so no one can submit directly to the site outside of the webpage, and Im requiring javascript to sumbit the form. - The mouse movement will add a value to the a mouse field in the form and the value is what will determine on the server side that it was submitted by a human. - The mouse field will use some form of algorithm that the mouse movement will seed, then decode it on the server side so a bot can just enter any value into the mouse field. So Im wondering if there are still holes in this approach or ways for a bot to still bypass it.

Original source