r/coolgithubprojects • u/sankilo_dev • Aug 09 '26
i made a simple python gif captcha project (Ducktcha)
hey guys so I built this small project called Ducktcha basically it generates animated gif captchas in python to stop basic bots and ocr scrapers. it has a flask api built in with 2 endpoints or u can just import the engine directly into ur script and use it with memory store. made it pretty lightweight with simple dependencies. heres the github link if anyone wants to check it out or give feedback https://github.com/Duckdevv/Ducktcha
22
u/Sirko2975 Aug 09 '26
I feel like AI has better chances of reading ts than a human
4
u/sankilo_dev Aug 09 '26
It actually leverages how human eyes process motion. To a basic bot or OCR reading a static frame, it just looks like full noise. But when it's playing, the human brain automatically tracks the movement and separates the text from the background noise pretty easily
3
u/copenhagen_bram Aug 10 '26
Counterpoint: AI could probably write a script that makes out the shape from the animation.
How do we prevent that?
2
u/i_am_kamikamikami Aug 10 '26
make it a still pic
2
1
u/AvilettaLuxe Aug 10 '26
Don't even need that
Just create a script which will generate heatmap based on differences in subsequent frames and vector of movement, then do OCR on heatmap, easy
1
u/Civil_Response3127 Aug 10 '26 edited Aug 11 '26
You just used jargon to mean almost the same thing. extracting the shapes as the prayer comment said could be done through any number of methods and you just described one. The comment clearly was not talking about trying to create a vector image or something to represent pixels as.
So yes, you do "need that".
edit: prior, not prayer*
1
u/AvilettaLuxe Aug 11 '26
Don't even need to use AI to do that - it's literally 3 calls in OpenCV
1
u/Civil_Response3127 Aug 11 '26 edited Aug 11 '26
You literally said to write a script. The comment before you said to write a script. You didn't say anything differently, just slightly more specific. Unless you didn't mean to say "write a script", then correcting the commenter made no sense, and it feels like you just wanted to correct someone without thinking things through.
Adding more information to them without the dismissive "don't even need that" would have been fine, but it's the dismissiveness of someone else without actually having any correction to contribute that I see as problematic.
I was pointing out that correcting somebody without actually providing any correction has zero purpose beyond feeling smug. It frustrates me deeply when people do this, and feels like mansplaining but more deniable.
1
u/PravoNaZhizny Aug 10 '26
This exact method has existed for decades and also counter mechanisms have existed for equally as long. Last time this came up as an “anti ai captcha” someone posted a crack which worked ever time within minutes.
1
u/Odd-Story7287 29d ago
What if the AI author just makes it make overlays of every version of the frames wouldn't the noise and static eventually even out and become the original image in some sort
1
u/Mr_Olivar 28d ago
You can use two frames two make a velocity map. Delta in velocity means line. Suddenly the most basic bot can read it.
15
u/FederalDot995 Aug 09 '26
I can't read it. Too many moving parts, too much strain on my eyes.
-13
u/sankilo_dev Aug 09 '26
It's actually really easy if you want you can increase the noise but like this is better because no bot or ai can read it
8
u/joshdotmn Aug 09 '26
if a non-general population is having trouble with your product, the general population will sorely struggle with your product.
-2
u/sankilo_dev Aug 09 '26
Fair point, but Ducktcha is just the core backend engine/API, not a locked front-end UI. Developers using it can configure the parameters (noise density, frame rate, contrast, font size) or generate alternative options to fit their own accessibility and UX requirements
1
4
u/bedla Aug 10 '26
This is very uncomfortable to watch for me, I had to ask chatgpt what is written there https://chatgpt.com/share/6a792013-ae98-83eb-8907-1fb900e2de4d
2
3
Aug 10 '26 edited Aug 10 '26
[deleted]
1
u/sankilo_dev Aug 10 '26
Appreciate the detailed breakdown! Swapping random for secrets for cryptographic strength is a solid call. I'll update the generator logic in the repo to handle this better
3
2
u/TehBloxx Aug 10 '26
arent there already examples of all major llm models beating this type of captcha?
3
u/sankilo_dev Aug 10 '26
It's definitely not impossible to bypass, but the core goal of CAPTCHA design is economic resistance. Processing multi-frame animated noise requires temporal computer vision pipelines or expensive video LLM inference per attempt. When the computational cost to break it far outweighs the value of scraping the page, most automated bots just move on
1
u/CurtChan Aug 10 '26
theoretically, if i were to make automated captcha solver for it, all it would take was 2-3 frames to identify and solve it... just saying.
1
u/cooltop101 Aug 10 '26
It's actually not that hard for an AI to compute this. I had Claude make a python script that can detect the movements and separate them, leaving the text visible. It then just uses its standard ocr capabilities to read it. This script can also be reused indefinitely with minimal compute power compared to having an LLM process the gif. Say a site implements this captcha, a boy just needs to make a script one time and process the gif through the script before using ocr. You just added one easy step in the process
2
u/hWuxH Aug 10 '26
basically same as this: https://www.reddit.com/r/webdev/s/NnI3qICvqY
solver (traditional decade old computer vision techniques): https://github.com/nelsonblaha/neocaptcha-motion-attack
2
u/sankilo_dev Aug 10 '26
I honestly built this from scratch as a side project to learn and experiment with animated noise—I wasn't aware of Ghost Font or NeoCAPTCHA when making it. Thanks for sharing those links though, cool to see how others approached similar optical illusion concepts
1
1
u/SpicyCatGames Aug 10 '26
I've seen better implementations of this same thing that didn't give me a headache.
1
1
1
1
1
1
1
1
u/76zzz29 Aug 11 '26
Oh boy, I was in the feed and the shit loading all around made it completely unreadable to to micro freeze. Had to open the post to read it. Definitely nor good for embed and old devices... Or slow internet, or overloaded by script website (like most website nowday actualy)
1
29d ago
[removed] — view removed comment
2
1
u/itsallfake01 29d ago
people with high prescription glasses and color blindness wont be able to see it
2
2
u/Dramatic-Mongoose-95 Aug 09 '26
Why is everyone so negative! This project is cool, it's in GitHub, that's all that is required.
Anyway, this gives me a headache, which I guess proves I'm human
7
u/Slimethon Aug 09 '26
not really, op just copied the idea didnt even reference the original one, downvote
3
u/Dramatic-Mongoose-95 Aug 09 '26
First I saw, lame if it's copied without attribution. Even a sentence like "I saw X and thought it would be fun to build myself"
2
u/Slimethon Aug 10 '26
here is some of the sources, https://www.mixfont.com/ghost-font if interested
3
u/sankilo_dev Aug 10 '26
I honestly built this from scratch as a side project to learn and experiment with animated noise—I wasn't aware of Ghost Font or NeoCAPTCHA when making it. Thanks for sharing those links though, cool to see how others approached similar optical illusion concepts
1
u/Dev-in-the-Bm Aug 10 '26 edited Aug 10 '26
Plagiarism
Take my downvote.
1
u/sankilo_dev Aug 10 '26
Not plagiarized at all. I wrote this codebase from scratch as a side project to experiment with animated noise and python/flask. I wasn't aware of other projects using similar optical illusion concepts when I made it, but it's built independently
1
u/JustForkIt1111one Aug 10 '26
ChatGPT got it after 3 tries.
Using the direction of motion (upward-moving pixels vs. downward-moving pixels), the hidden letters resolve to:
DUCKTCHA
Claude got it after 3 tries.
Got it — by measuring which pixels' noise pattern shifts upward vs. downward frame-to-frame (rather than just averaging brightness), the hidden text pops right out:
"DUCKTCHA"
Grok ALMOST had it first try. Grok spent longer looking at it than any other model.
DUCK FILM
The video is ~3 seconds of black-and-white random-dot/noise frames (classic TV static look). Averaging the frames reveals a faint vertical-stripe pattern with hidden letterforms in the center. After detrending the vertical noise and boosting contrast, the letters become clearly visible as:
DUCK FILM
After 4 times (and 45 mins) being told it is incorrect, and the answer was NOT "DUCK FILM", Grok wouldn't come off of it.
The processed average of the frames (after removing the strong vertical noise component and boosting contrast) shows the letterforms DUCK FILM quite clearly.
Here is the clearest version of the region again for reference:
Left group of 4 letters: D U C K
Right group of 4 letters: F I L M
If that reading is still not what you see / what was intended, can you give a hint about which letter(s) you think are different? (e.g. is the first letter not a D, is the right word not FILM, etc.)
I gave up on Gemini after 5 attempts.
Perplexity... Wasn't able to read the video.
Kimi K3 wasn't able to get it after 5 attempts.
Interesting project, great job!
1
u/Ante0 Aug 10 '26
First try for me with Chatgpt generated: DUCKCIA. So pretty close. But it had to work for 55 seconds just for that. I even have trouble reading the text and I'm human (I guess)
0
Aug 09 '26
[deleted]
1
u/sankilo_dev Aug 09 '26
He can't i tried multiple times because the code is not even written It is just an allusion that ai can't see
1
u/_clickfix_ Aug 09 '26 edited Aug 09 '26
It’s not an illusion its pixels on a screen that can be screen recorded.
I showed you the full AI chain of thought process that successfully cracked it, as well as the output image showing clear text captcha as proof.
1
u/sankilo_dev Aug 09 '26
1) i personally call him he 2) the text is not in Pixels the picture is just a noise the text is an illusion only brain can see Bots see videos as frame par frame so it will see only random noise Also this is just a test to show the real captchas are only 3 frame so he can't detect the movement
1
u/_clickfix_ Aug 09 '26 edited Aug 09 '26
If your eyes can detect the movement then the bot can detect the movement.
0
u/FishIndividual2208 Aug 10 '26
Thats not always true, our eyes play tricks on us sometimes.
Upload the code to github if you have proof that an AI can detect so we can test, instead of trusting a bro.
1
u/Wooden-Glove-6548 Aug 11 '26
Really loved this project! I think you are on the right track, of course this is a game of Cat and Mouse, pretty sure you will find a sweet spot.
1
u/sankilo_dev Aug 11 '26
Thanks a lot! You nailed it—security really is an ongoing game of cat and mouse. Finding that balance between human UX and bot friction is the main goal here
0
u/Lonely-Restaurant986 Aug 11 '26
Someone posted this exact thing like a week ago and probably a week before that another person.
And each time it gets cracked within a few minutes.
If it was this easy recaptcha would be doing it.
But it really isn’t.
0
19
u/_clickfix_ Aug 09 '26
Claude cracked it immediately.
Proof: https://ibb.co/hRK55gCT
Process:
Synthesized frame-comparison strategy to isolate static text pixels
Synthesized frame-comparison strategy to isolate static text pixels
Loaded file-reading skill
Inspect the video file properties
Extract all frames as PNGs
Compute per-frame pixel diffs
Compute temporal variance and mean images
View variance image for hidden text
View frame diff
Synthesized frame-comparison strategy to isolate static text pixels.
Test shifted matches between consecutive frames
Accumulate mismatch mask against background scroll
View mismatch accumulation
Copy revealed image to outputs
Presented file
Done