I've been working (off-and-on) on a pbbg that's pretty old school. If you've ever played Carnage Blender then you get the idea.

If not, it's a simple idea that's been done a lot: A player is allocated a certain number of "points" each day, and spends those points to attack other players. Points accrue over time, up to a certain cap.

The point system is designed to prevent over-achievers from completely out-pacing casual players.

In the case of carnage blender, a CAPTACHA system prevents a user from "gaming" the system with a bot or a script designed to use all of their points each day with minimal effort. Every once in a while a random CAPTCHA is displayed, and if not passed the user will be suspended for an hour.

What I'm wondering is how to make this more user friendly for my game. I recognize that I must prevent bad behavior like this, and I could easily take the same CAPTCHA approach, but is there a more user friendly alternative?

Initial research uncovered ASIRRA by Microsoft, but the fluffy/cute vibe doesn't work well with my intended game theme.

UPDATE
What I'm most interested in are alternatives to the standard "spell this word" CAPTCHA. I want to try to keep game-play as uninterrupted as possible for the good players.

I've seen what I call One-Time-Use CAPTCHAs, like asking a user "what is five plus six minus two?" But this would require too much effort compiling a large enough database of questions to foil the malicious users. Especially since the CAPTCHA is intended to be used so often.

UPDATE #2
As Joe Wreschnig pointed out in his answer, having a CAPTCHA system to limit bots from playing the game faster than humans is a bit redundant if turns are limited per day. I didn't explain my point system to-the-letter, and that was my fault. In reality, 10 or 20 points accrue every few minutes, and cap off at 200. So, a very competitive player could return every few hours and use his points. I want to reward those people who like my game so much that they return so often. If I prevent them from playing until the next day when they get their points, I would be turning away players who would otherwise be enjoying my webgame. This prevents a player from spending points constantly while still giving them a few points every few minutes.

This is open to abuse.

• Re Update #2: Your described aim of your point system, simplified: "I want to reward players who play at least 2.4 times a day on average." Why? Why do you care if they play 2.4 times a day instead of just once? You say "I want to reward those players who like my game", but whether I log in 5 times a day or just once, that's not a measure of how much I like your game. Consider what you're actually doing here and why you're doing it. Then find a different way to do it so you won't have to come up with a 2.4-times-a-day points system which ENCOURAGES your players to bot. – doppelgreener May 30 '11 at 6:20
• I hope you really recognise that by requiring 2.4 visits/day for optimum play you are encouraging botting since many people cannot make that commitment. It's not even necessary: you achieve nothing with it but bots and alienation of potential players! Consider Kingdom of Loathing, a phenomenally successful game which gives you 40 turns/day (boostable with items). With a cap of 200 you can wait up to 5 days at a time. Kingdom of Chaos does something similar. Neither give any particular reward for frequent play, yet both have players which log in multiple times per day regardless. – doppelgreener May 30 '11 at 6:25
• @Jonathan: Usually the reason you care if people log in x times a day on average is that that's what you need to make your game profitable based on the advertising rates you've got. KoL's monetization strategy is in-game purchases, so that doesn't apply. – user744 May 30 '11 at 12:04
• @Joe: I would consider an alternative advertising/monetization strategy then, bearing in mind that when I don't alienate players, I might actually display more advertising overall due to the higher player population. If my game is designed successfully, the ones that would visit several times a day will do so anyway - because they like the game and they choose to, not because the game mechanics are transparently pressuring them into doing so (note: this means Stephen is not going to be rewarding "those people who like my game so much", just "those on whom my pressure mechanic works") – doppelgreener May 30 '11 at 12:31

"is there a more user friendly alternative?"

A more user friendly alternative to what end? What is the captcha designed to achieve in your system?

It sounds like it's designed to prevent botting, under the premise that bots can play "faster" than regular players. But you have also already capped the number of actions a user can take per day, which achieves the same goal. So the captcha seems redundant.

I would encourage you to look at Kingdom of Loathing's alternate frontends. It uses a similar turns-per-day system, and has several popular alternate frontends such as KoLmafia, which are in many ways indistinguishable from "botting" the game. Most players feel these add to, rather than take away from, the game, even for casual players. They make it easier to batch actions, automate some of the slower parts, and offer more options for in-game UI.

If you already have checks in your game to ensure AIs can't simply play faster than humans - and by having turns-per-day, you have such a check - then I suggest you try encouraging automating your game, as if your design is balanced, it can only improve player experience.

• Very good insight! turns-per-day is misleading, and that was my fault. I'll update the question to elaborate. – Stephen Sep 23 '10 at 19:30
• The more I think about this, the more I like it. I'll have to give it a little more thought, and let it the question brew on here a bit. – Stephen Sep 23 '10 at 19:41
• As an example, KolMafia's automated combat systems were so genuinely useful that they actually integrated a combat macro system into the real game. – coderanger Sep 24 '10 at 2:24
• I remember on RuneScape that there are simple questions asked by a Genie, if you get them right, he gives you a present. – Jonathan Connell May 30 '11 at 11:32

I'd never bother to play a game that demands captchas: they are really a terrible practice that should be avoided.

Your game seems to have deeper problems than that anyway: ideally a game should give no advantage to a stupid bot, so that it would be pointless to use a stupid bot in the first place. If you cannot achieve that, that's a design problem that will have no real solution, only more-or-less valid workarounds.

With "stupid bot" I mean bots that do not take any meaningful decision and instead just "farm" (that's what happens here). Smart bots (such as aim-bots or chess playing bots) are a completely different matter.

Still, assuming you are comfortable with the idea of making a design-flawed game, there is still room for improvements.

Accept the fact that you can't stop a really determined bot and instead focus on the only thing you can do: make it useless to use a bot. If people have no reason to use a bot... they won't use them (and if they do anyway it won't matter).

A possible solution is to allow one login per week instead of one per day. If people will forget to login for more then a week, they are unlikely to be really interested in playing anyway, so they won't be using bots to keep gaining credits. If, on the other hand, there is someone so screwed that makes a bot that logs once a week and then comes back three months later to attack random people, well, you have just found someone so determined that would have cracked you anyway, whatever system you chose (unless you chose a non-flawed system, of course).

ps: don't make the mistake of putting more effort into working-around design flaws then actually solving them in the first place!

• "ideally a game should give no advantage to a stupid bot," good advice +1 – Stephen Sep 29 '10 at 16:01
• Good advice, but un-achievable by humankind? – Kzqai Jun 16 '11 at 5:35
• Totally achievable, you just have to do some actual game design instead of coding random stuff. Quality costs. – o0'. Jun 17 '11 at 6:12

I would not ban a failed CAPTACHA for an hour, that seems harsh, I would just prevent them moving forward until they successfully complete the CAPTACHA and allowing for a new CAPTACHA image to be shown.

I would also only display the captcha if they making requests too quickly, I'd store the a DateTime on every request, and then compare it to the next request, if its less than 2-4 seconds, you display the CAPTACHA, otherwise let them go. You'll need to determine what a reasonable interval is for your game, server, and bandwidth.

You could also do a "forced" CAPTACHA every X times that an action is taken, this will prevent even an automated script with a pause built in so it doesn't trigger the time limit CAPTACHA.

• Right. These are all valid ideas for making a CAPTCHA more user friendly, and of course I would implement concepts such as these if I go the CAPTCHA route. What I'm looking for are good alternatives, if there are any. – Stephen Sep 23 '10 at 18:42
• Write your game in Flash or Silverlight such that a bot will have a harder time remote-controlling your application? – Nate Sep 23 '10 at 22:02
• I don't know much about it, but KingsOfChaos.com has a very similar system as yours (points/turns every minute) you could see how they implement it. – Nate Sep 23 '10 at 22:03

If players spend point to attack other players, and points are limited, the obvious abuse seems to me to be to create multiple accounts.

If you successfully manage to limit people to a single account, then the issue with bots to me would be that under your system people can fire them off when they are asleep or at work.

So given the constraints: (1) no advantage for bots (2) reward people for logging in multiple times per day

It seems to me the ideal thing is to cap the number of actions they can use during a day to some reasonable number.

E.g. you might decide that someone could reasonably log in multiple times over an 8 hour period, and tweak the system appropriately. Or someone might check it before they go to school/work in the morning, check it when they get home, check it again after dinner, and check it before going to bed.

Determine what your 'ideal' user is doing, and then make the point system reward that.

I'd build a system that rewarded spending a chunk of points all in one go. To do this I'd have a variable recharge rate on the points. Every time you spend points, the recharge time to get the next point increases... so if a bot is spending points as fast as they get them, it will take longer and longer to get the next one, whereas if a person spends all the point they accumulated overnight before leaving the house in the morning, they will have got them all back by the time they get home from work/school (8-12 hours later).

• I never thought about a variable recharge rate based on usage. That sounds genius at first glance. I'll have to think about it. TBH, it sort of rewards the casual player and punishes the hardcore/die hard player, so I dunno. – Stephen Sep 23 '10 at 19:59

In a game, I would recommend replacing "captcha" with "puzzle mini-game". The difference being the level of fun involved. There're really little reason for a captcha in a game unless you have tried a custom mini-game and that is still getting botted. In which case make it require more intelligent tactics.

As suggested by Tchalvak, I would go the 'puzzle mini-game' route, however I would reward a few points for passing it so as to make it more user-friendly