Doom Captcha (2021)

Original Article ↗ Hacker News Discussion ↗

A novelty “Doom Captcha” replaces traditional image puzzles with a browser-based shooting mini-game, delighting many users frustrated by Google’s traffic-light and crosswalk tests. Commenters critique its confusing UI and trivial bot resistance, but note that with server-side randomness, input-rate limits, and behavioral analysis, similar game-like captchas could become both more usable and harder to automate. Others point out that obscurity alone offers some protection, while broader AI advances in vision and gameplay suggest any popular approach would eventually be reverse‑engineered.

Overall Reception

  • Many find the Doom-themed CAPTCHA fun, creative, and a welcome change from standard image CAPTCHAs.
  • Some express nostalgia for Doom and appreciate touches like music and references to classic mechanics.
  • Others are underwhelmed that it’s more a simple shooting gallery than “real” Doom, and note it’s a few years old.

Usability & UI Confusion

  • A large subthread criticizes the start UI: users often click “click to start” text instead of the sound ON/OFF buttons, assume it’s broken, and leave.
  • Several propose small fixes (e.g., “Click to start:” label, “Start with sound / Start without sound” buttons, separate “Start” button plus a sound checkbox).
  • Some argue this confusion is non-trivial and detracts from the demo; others say it’s minor and that nitpicking UI distracts from the idea itself.

Security & Bot Resistance

  • Consensus: the author explicitly says it’s “just for fun” and easy to break.
  • Multiple comments argue it wouldn’t stop serious bots, and that bots and AI already defeat many CAPTCHAs.
  • One commenter describes quickly scripting a vision-based solver using fixed enemy colors and limited regions.
  • Others discuss how stronger versions might work: canvas rendering, varying rules (shoot X, not Y), rate limits, cursor-movement analysis, server-streamed enemy positions.
  • Some suggest that obscurity and interaction complexity might still put it on par with or better than some standard CAPTCHAs for low-stakes use.

Comparisons to Other CAPTCHAs

  • People contrast it with Google’s CAPTCHAs, which some find increasingly unreliable or difficult for humans.
  • Several share experiences with alternative CAPTCHAs: simple math questions, empty “honeypot” fields, lore questions, calculus problems, esoteric-language puzzles.
  • There’s concern that making puzzles too hard filters out humans more than bots, especially when attackers can combine OCR with LLMs.

Ideas, Variants, and Extensions

  • Suggestions include:
    • Full 3D or WebAssembly Doom, or Freedoom assets to avoid copyright issues.
    • Men in Black–style “identify the real threat” modes.
    • Hostages/barrels you must not shoot.
    • WoW-style fishing mini-game CAPTCHA.
    • A Doom progress window mini-game during long tasks.
  • Several note it’s easy to “spam click” to win, suggesting adding fire-rate limits or changing enemy positions.