Persistent Browser Based Game: To Captcha or not to Captcha?

Question

I've been working (off-and-on) on a pbbg that's pretty old school. If you've ever played Carnage Blender then you get the idea.

If not, it's a simple idea that's been done a lot: A player is allocated a certain number of "points" each day, and spends those points to attack other players. Points accrue over time, up to a certain cap.

The point system is designed to prevent over-achievers from completely out-pacing casual players.

In the case of carnage blender, a CAPTACHA system prevents a user from "gaming" the system with a bot or a script designed to use all of their points each day with minimal effort. Every once in a while a random CAPTCHA is displayed, and if not passed the user will be suspended for an hour.

What I'm wondering is how to make this more user friendly for my game. I recognize that I must prevent bad behavior like this, and I could easily take the same CAPTCHA approach, but is there a more user friendly alternative?

Initial research uncovered ASIRRA by Microsoft, but the fluffy/cute vibe doesn't work well with my intended game theme.

UPDATE
What I'm most interested in are alternatives to the standard "spell this word" CAPTCHA. I want to try to keep game-play as uninterrupted as possible for the good players.

I've seen what I call One-Time-Use CAPTCHAs, like asking a user "what is five plus six minus two?" But this would require too much effort compiling a large enough database of questions to foil the malicious users. Especially since the CAPTCHA is intended to be used so often.

UPDATE #2
As Joe Wreschnig pointed out in his answer, having a CAPTCHA system to limit bots from playing the game faster than humans is a bit redundant if turns are limited per day. I didn't explain my point system to-the-letter, and that was my fault. In reality, 10 or 20 points accrue every few minutes, and cap off at 200. So, a very competitive player could return every few hours and use his points. I want to reward those people who like my game so much that they return so often. If I prevent them from playing until the next day when they get their points, I would be turning away players who would otherwise be enjoying my webgame. This prevents a player from spending points constantly while still giving them a few points every few minutes.

This is open to abuse.

Answer 1

"is there a more user friendly alternative?"

A more user friendly alternative to what end? What is the captcha designed to achieve in your system?

It sounds like it's designed to prevent botting, under the premise that bots can play "faster" than regular players. But you have also already capped the number of actions a user can take per day, which achieves the same goal. So the captcha seems redundant.

I would encourage you to look at Kingdom of Loathing's alternate frontends. It uses a similar turns-per-day system, and has several popular alternate frontends such as KoLmafia, which are in many ways indistinguishable from "botting" the game. Most players feel these add to, rather than take away from, the game, even for casual players. They make it easier to batch actions, automate some of the slower parts, and offer more options for in-game UI.

If you already have checks in your game to ensure AIs can't simply play faster than humans - and by having turns-per-day, you have such a check - then I suggest you try encouraging automating your game, as if your design is balanced, it can only improve player experience.

Answer 2

I'd never bother to play a game that demands captchas: they are really a terrible practice that should be avoided.

Your game seems to have deeper problems than that anyway: ideally a game should give no advantage to a stupid bot, so that it would be pointless to use a stupid bot in the first place. If you cannot achieve that, that's a design problem that will have no real solution, only more-or-less valid workarounds.

With "stupid bot" I mean bots that do not take any meaningful decision and instead just "farm" (that's what happens here). Smart bots (such as aim-bots or chess playing bots) are a completely different matter.

Still, assuming you are comfortable with the idea of making a design-flawed game, there is still room for improvements.

Accept the fact that you can't stop a really determined bot and instead focus on the only thing you can do: make it useless to use a bot. If people have no reason to use a bot... they won't use them (and if they do anyway it won't matter).

A possible solution is to allow one login per week instead of one per day. If people will forget to login for more then a week, they are unlikely to be really interested in playing anyway, so they won't be using bots to keep gaining credits. If, on the other hand, there is someone so screwed that makes a bot that logs once a week and then comes back three months later to attack random people, well, you have just found someone so determined that would have cracked you anyway, whatever system you chose (unless you chose a non-flawed system, of course).

ps: don't make the mistake of putting more effort into working-around design flaws then actually solving them in the first place!

Answer 3

I would not ban a failed CAPTACHA for an hour, that seems harsh, I would just prevent them moving forward until they successfully complete the CAPTACHA and allowing for a new CAPTACHA image to be shown.

I would also only display the captcha if they making requests too quickly, I'd store the a DateTime on every request, and then compare it to the next request, if its less than 2-4 seconds, you display the CAPTACHA, otherwise let them go. You'll need to determine what a reasonable interval is for your game, server, and bandwidth.

You could also do a "forced" CAPTACHA every X times that an action is taken, this will prevent even an automated script with a pause built in so it doesn't trigger the time limit CAPTACHA.

Answer 4

If players spend point to attack other players, and points are limited, the obvious abuse seems to me to be to create multiple accounts.

If you successfully manage to limit people to a single account, then the issue with bots to me would be that under your system people can fire them off when they are asleep or at work.

So given the constraints: (1) no advantage for bots (2) reward people for logging in multiple times per day

It seems to me the ideal thing is to cap the number of actions they can use during a day to some reasonable number.

E.g. you might decide that someone could reasonably log in multiple times over an 8 hour period, and tweak the system appropriately. Or someone might check it before they go to school/work in the morning, check it when they get home, check it again after dinner, and check it before going to bed.

Determine what your 'ideal' user is doing, and then make the point system reward that.

---

I'd build a system that rewarded spending a chunk of points all in one go. To do this I'd have a variable recharge rate on the points. Every time you spend points, the recharge time to get the next point increases... so if a bot is spending points as fast as they get them, it will take longer and longer to get the next one, whereas if a person spends all the point they accumulated overnight before leaving the house in the morning, they will have got them all back by the time they get home from work/school (8-12 hours later).

Answer 5

In a game, I would recommend replacing "captcha" with "puzzle mini-game". The difference being the level of fun involved. There're really little reason for a captcha in a game unless you have tried a custom mini-game and that is still getting botted. In which case make it require more intelligent tactics.

Answer 6

As suggested by Tchalvak, I would go the 'puzzle mini-game' route, however I would reward a few points for passing it so as to make it more user-friendly