Question for token generation and verification mechanism

[asheswook]

Hello, I have some questions for you. (Disclaimer: I didn't reviewed all of your code)
I checked this repository codes, and noticed that the token data generates by client side, not a server side.

Generally, in the captcha system like this, the "correct answer" is generated by server side. The server delivers "question data" to client that is not directly related to "correct answer" - unpredictable by "question". It just for show in frontend; Then the "human" inputs the answer, server verifies human's input data is the "correct answer".

But this captcha system generates token data by client side. It means the malicious actor is able to know client's token generation algorithm anytime. Then the malicious actor requests to server with malicious token treats as "correct answer" by server. So I wonder how can this achieved without security problems.

[ComputelessComputer]

Hi Jaewook, To be direct with you, I wasn't very familiar with how CAPTCHA actually works, so I misunderstood the core concepts and implemented it incorrectly. If you’re interested in the project, I'd love to chat with you more about it. I’m currently based in Seoul. Here’s my scheduling link <https://cal.com/john.jeong/30min>. Thanks again for showing interest in the project.

[asheswook]

It's simple.
First, the "correct answer" is created by somewhere the client side never knows.
Second, the "question" matched with the "correct answer" should generated by same side, it'll served to the client side. This means the "correct answer" should be hard to predict from the "question" by machine - automated bot, crawler... etc.
Anything the client knows is predictable by machine, and the data from client that the server gets is unreliable in any way.
This is why the server generates every "correct answer" data and "question"s.

So, we wanna get the unpredictable question and correct answer. The question must be unpredictable by the machine. How? What question is?
Machines don't know, only humans know and be able to recognize the "question".

This is why the "question" generally created in the way of Image. The image is easy solution - human knows and recognizable, but the machine cannot knows. (If the malicious actor don't use OCR or AI or something using GPU...)

In this project, in a nutshell, you can make the client captures all of user's keystrokes when playing game captcha, the server receives "answer"-all of user's keystrokes and verifies that the keystrokes can be derived from that question. This is like kind of Proof of Work (PoW) that checks the human working.

If you have any questions for this or want to get in touch, you can reply or email to me. Or zoom meeting is alternative option.