vrCAPTCHA: Exploring CAPTCHA Designs in Virtual Reality
Xiang Li, Yuzheng Chen, Rakesh Patibanda, Florian 'Floyd' Mueller
vvrCAPTCHA: Exploring CAPTCHA Designs in Virtual Reality
Xiang Li , Exertion Games Lab, Department of Human-CentredComputing, Monash UniversityMelbourne, Australia Xi’an Jiaotong-Liverpool UniversitySuzhou, [email protected]
Yuzheng Chen , Exertion Games Lab, Department of Human-CentredComputing, Monash UniversityMelbourne, Australia Xi’an Jiaotong-Liverpool UniversitySuzhou, [email protected]
Rakesh Patibanda Exertion Games Lab, Department of Human-CentredComputing, Monash UniversityMelbourne, [email protected]
Florian ’Floyd’ Mueller ∗ Exertion Games Lab, Department of Human-CentredComputing, Monash UniversityMelbourne, [email protected]
ABSTRACT
With the popularity of online access in virtual reality (VR) de-vices, it will become important to investigate exclusive and in-teractive CAPTCHA (Completely Automated Public Turing testto tell Computers and Humans Apart) designs for VR devices.In this paper, we first present four traditional two-dimensional(2D) CAPTCHAs (i.e., text-based, image-rotated, image-puzzled,and image-selected CAPTCHAs) in VR. Then, based on the three-dimensional (3D) interaction characteristics of VR devices, we pro-pose two vrCAPTCHA design prototypes (i.e., task-driven andbodily motion-based CAPTCHAs). We conducted a user studywith six participants for exploring the feasibility of our two vr-CAPTCHAs and traditional CAPTCHAs in VR. We believe that ourtwo vrCAPTCHAs can be an inspiration for the further design ofCAPTCHAs in VR.
CCS CONCEPTS • Human-centered computing → Interaction design ; Visual-ization techniques . KEYWORDS vrCAPTCHA, virtual reality, CAPTCHA
ACM Reference Format:
Xiang Li , , Yuzheng Chen , , Rakesh Patibanda , and Florian ’Floyd’Mueller . 2021. vrCAPTCHA: Exploring CAPTCHA Designs in VirtualReality. In CHI Conference on Human Factors in Computing Systems ExtendedAbstracts (CHI ’21 Extended Abstracts), May 8–13, 2021, Yokohama, Japan.
ACM, New York, NY, USA, 4 pages. https://doi.org/10.1145/3411763.3451985 ∗ Corresponding author.Permission to make digital or hard copies of part or all of this work for personal orclassroom use is granted without fee provided that copies are not made or distributedfor profit or commercial advantage and that copies bear this notice and the full citationon the first page. Copyrights for third-party components of this work must be honored.For all other uses, contact the owner/author(s).
CHI ’21 Extended Abstracts, May 8–13, 2021, Yokohama, Japan © 2021 Copyright held by the owner/author(s).ACM ISBN 978-1-4503-8095-9/21/05.https://doi.org/10.1145/3411763.3451985
CAPTCHAs (Completely Automated Public Turing test to tell Com-puters and Humans Apart) are used to protect the security of data[15]. These authentication protocols can allow users to access web-sites while preventing automatic bots. The most common typeof CAPTCHA is a series of graphical transformations on a two-dimensional (2D) screen, which makes it is nearly unsolvable byto an automatic bot. Recently, most mobile phones and computerssupport various CAPTCHAs to ensure user’s access to websites.However, with the development of three-dimensional (3D) comput-ing technology such as Virtual Reality (VR) headsets, user’s pursuitof 2D space has moved to 3D environments, where we use mid-air[8] gestures [7] to interact in 3D space and explore more immersiveexperiences.In this paper, we present six CAPTCHA designs in VR, includingfour traditional CAPTCHAs (i.e., text-based, image-rotated, image-puzzled, and image-selected CAPTCHAs) and two interactive vr-CAPTCHAs (i.e., task-driven and bodily motion-based CAPTCHAs).The aim is to explore the future CAPTCHA designs in a VR environ-ment through leveraging the user’s full physical interactions. Weargue that the use of CAPTCHAs with entertaining interactivityfeatures will allow users to immerse themselves in 3D. Besides, webelieve that research on new virtual reality CAPTCHAs will becomemore important due to the proliferation of virtual reality devices,and we propose that our work can serve as a useful springboardfor such future investigations.
Constrained by the structure of 2D displays, traditional CAPTCHAsare almost always based on a 2D planar design. According to Fenget al. [5], traditional 2D CAPTCHAs can be divided into two types:(1) text-based and (2) image-based CAPTCHAs.
It is generally believed that the firstpractical text-based CAPTCHA was invented by Lillibridge [10] in1997. Then, von Ahn et al. [14] proposed reCAPTCHA, an authen-tication protocol that requires users to transcribe scanned text. As a r X i v : . [ c s . H C ] F e b HI ’21 Extended Abstracts, May 8–13, 2021, Yokohama, Japan Li, et al.
Figure 1: Four traditional CAPTCHAs: (1) Text-based CAPTCHA; (2) Image-rotated CAPTCHA; (3) Image-puzzled CAPTCHA;and (4) Image-selected CAPTCHA. this is increasingly easier for bots, more recent research has triedto make OCR more difficult so that the bots cannot recognize thetexts. For example, Baird et al. [2] proposed ScatterType CAPTCHA,which prevents the computer from splitting characters from a word.However, the feasibility of text-input CAPTCHA in VR environ-ments has not been fully discussed. Based on previous research oninputting text in VR [19], it may be a misconception to still opt fortext-based CAPTCHAs in VR.
Bongo [6] was one of the first vi-sual pattern recognition problems for CAPTCHAs. Chew et al. [3]were among the first to work on tagging image-based CAPTCHAs.After that, many algorithms based on image recognition were pro-posed and developed. Asirra [4] challenged the user in selectingimages with cats among twelve images of cats and dogs. Matthewset al. [11] presented the scene marker test, where users must rec-ognize relationships between irregularly shaped objects embeddedin a background image. However, the flat image-based CAPTCHAmainly considers devices with a 2D display plane as the carrier, andthe interactive nature of 3D virtual objects unique to VR has notbeen fully investigated.
Koutsabasis and Vogiatzidakis [8] pointed out that mid-air interac-tions should have the following three characteristics: (1) touchlessinteraction, (2) real-time sensors that can track some of the user’sphysical activity and movement, and (3) body movements, postures,and gestures need to be recognized and matched to specific user in-tents, goals and commands [16]. However, traditional CAPTCHAsare difficult to create such mid-air interactions environment in VR.Since most traditional CAPTCHAs rely on horizontal and verticalplanes of interaction using mouse clicks and touch screen taps. Weconjecture that these types of interaction are not applicable to theuser experience of interacting with CAPTCHAs in VR. Therefore,we selected four traditional text- and image-based CAPTCHAs andimplemented them in a virtual reality environment as prototypesfor a preliminary study to examine the associated user experience.
To guide our design, we firstly considered four traditional CAPTCHAs(i.e., text-based, image-rotated, image-puzzled, and image-selectedCAPTCHAs).
In Figure 1.1, the participants wereasked to use the trigger button of the right controller to click onthe blank input field for text input to bring up the virtual keyboard.Participants then used the VR controller to click the correspondingletters or numbers and finally clicked the verify button.
In Figure 1.2, the participants wereprovided with a tilted image. Then, the participant was asked todrag the slider on the progress bar by holding the trigger buttonon the controller. The movement of this slider would change therotation of the image. Once the participant thought that the rotationangle of the image had reached the correct position, they shouldrelease the trigger button to verify it.
In Figure 1.3, the participantswere asked to drag the slider by holding the trigger button onthe right controller. Unlike the previous technique, the movementof the handle changed the horizontal position of the puzzle piece.Once the participant believed that the puzzle piece had been stitchedto the original image, they should release the trigger button.
In Figure 1.4, the participantswere asked to follow the text to select all of the nine images thatmeet the requirements. Participants selected images by moving theslider along the controllers and pressing the trigger button whenthey finished their selections. When all images were selected, theywere asked to press the verify button.
Figure 2: Take-driven CAPTCHA.
We first designed a CAPTCHA thatrequires the user to perform a simple action to authenticate. ThisCAPTCHA requires the user to lift a virtual object (e.g., apple, winebottle or silver knife and fork) by holding the trigger button andmoving it to a specified location (e.g., purple bowl (Fig. 2.1), trash rCAPTCHA CHI ’21 Extended Abstracts, May 8–13, 2021, Yokohama, Japan
Figure 3: Motion-based CAPTCHA. can (Fig. 2.2), or dinner plate (Fig. 2.3)). This task-driven CAPTCHAis based on the participant’s feedback. “I think you can design areal-life scenario to enhance the interaction of CAPTCHA.” (P5).
We also considered using bodilymotions to implement authentication interaction, and we namedit motion-based CAPTCHA. With this CAPTCHA, the users areasked to follow the movements of a virtual character that appearsin front of them (e.g., body movement like front flat raise (Fig.3.1), side flat raise (Fig. 3.2) and up raise (Fig. 3.3)). This motion-based CAPTCHA is inspired by previous exergame research studies[1, 9, 13, 17, 18] which demonstrate the immersion that upper bodylimb movements can bring in VR. It is engaging for users to followthe virtual character and move their bodies.
We recruited six participants to finish the pre-user study for thesefour traditional CAPTCHAs and our two new vrCAPTCHAs. Ac-cording to our subjective ranking feedback from participants, allparticipants ranked the task-driven CAPTCHA as their favourite.“I think it is the most interesting CAPTCHA!” (P1). “It is very inter-esting; I enjoy using this CAPTCHA in VR.” (P6). Four participantsthought that the motion-based CAPTCHA is the second best. “Ilike this (motion-based) CAPTCHA, it makes me feel that I amplaying a VR game.” (P2, P4). All participants thought that the twovrCAPTCHAs could greatly improve their motivation to experi-ence CAPTCHA in VR. Four participants ranked the text-basedCAPTCHA last in their preferences. For example, P1 complainedthat the “text-based CAPTCHA was too time consuming and cum-bersome in VR.”
We acknowledge the limitations of our two vrCAPTCHAs. Fortask-driven CAPTCHAs, we only considered simple movements ofobjects. In fact, for virtual 3D spaces, we can design richer interac-tive environments, such as simulating daily activities like playingbasketball or pouring tea. For motion-based CAPTCHAs, we con-sidered only the top half of the user’s body. This can be done byintroducing other sensors to enable full body interaction and thusprovide fuller immersion, for example, using a Kinect camera.We also acknowledge that the security of our vrCAPTCHAs isinsufficiently validated. Given that, we here provide a discussionabout interactive vrCAPTCHAs. Unlike the traditional CAPTCHAs, previous CAPTCHAs are verified by computational processingof images or text that cannot be recognized by computers. OurCAPTCHA requires the user to follow the CAPTCHA to performthe relevant physical actions to complete the submission of theCAPTCHA. Besides, according to Mueller et al. [12], our subsequentwork in the future will focus on proposing fuzziness validationtests based on the characteristics exhibited by the user as a humaninteraction, thus distinguishing the concept of absolute accuracyachieved by the computer.
In this paper, we propose two interactive vrCAPTCHAs (i.e., task-driven and bodily motion-driven CAPTCHAs), inspired by the pre-vious 2D traditional CAPTCHA designs (i.e., text-based, image-rotated, image-puzzled, and image-selected CAPTCHAs) and com-bined with the 3D interactivity of VR. We conducted a user studywith six participants to evaluate the feasibility of traditional CAPTC-HAs and vrCAPTCHAs in VR. We believe that our two vrCAPTCHAscan be an inspiration for the future design of CAPTCHAs in VR.
ACKNOWLEDGMENTS
We are grateful to the six volunteers who were willing to comeand participate in our pre-user study. Xiang Li would like to thankhis internship advisors Prof. Florian ‘Floyd’ Mueller and RakeshPatibanda, and other members at the Exertion Games Lab of MonashUniversity for their valuable feedback during the prototyping ofthis work.
REFERENCES [1] Peter Arnold, Rohit Ashok Khot, and Florian ’Floyd’ Mueller. 2018. "You BetterEat to Survive". In
Proceedings of the Twelfth International Conference on Tangible,Embedded, and Embodied Interaction . ACM, New York, NY, USA, 398–408. https://doi.org/10.1145/3173225.3173238[2] Henry S. Baird, Michael A. Moll, and Sui Yu Wang. 2005. ScatterType: A legiblebut hard-to-segment CAPTCHA. In
Proceedings of the International Conferenceon Document Analysis and Recognition, ICDAR , Vol. 2005. 935–939. https://doi.org/10.1109/ICDAR.2005.205[3] Monica Chew and J. D. Tygar. 2004. Image recognition CAPTCHAs. In
LectureNotes in Computer Science (including subseries Lecture Notes in Artificial Intelligenceand Lecture Notes in Bioinformatics) , Vol. 3225. 268–279. https://doi.org/10.1007/978-3-540-30144-8_23[4] Jeremy Elson, John R. Douceur, Jon Howell, and Jared Saul. 2007. Asirra: ACAPTCHA that exploits interest-aligned manual image categorization. In
Proceed-ings of the ACM Conference on Computer and Communications Security . 366–374.https://doi.org/10.1145/1315245.1315291[5] Yunhe Feng, Qing Cao, Hairong Qi, and Scott Ruoti. 2020. SenCAPTCHA: AMobile-First CAPTCHA Using Orientation Sensors.
Proceedings of the ACM onInteractive, Mobile, Wearable and Ubiquitous Technologies
4, 2 (jun 2020), 1–26.https://doi.org/10.1145/3397312[6] Martin Golubitsky and David G. Schaeffer. 1985.
The Recognition Problem . Tech-nical Report. 51–116 pages. https://doi.org/10.1007/978-1-4612-5034-0_2[7] Karine Jospe, Agnes Flöel, and Michal Lavidor. 2017. The role of embodiment andindividual empathy levels in gesture comprehension.
Experimental Psychology
64, 1 (2017), 56–64. https://doi.org/10.1027/1618-3169/a000351[8] Panayiotis Koutsabasis and Panagiotis Vogiatzidakis. 2019. Empirical Researchin Mid-Air Interaction: A Systematic Review.
International Journal of Human-Computer Interaction
35, 18 (2019), 1747–1768. https://doi.org/10.1080/10447318.2019.1572352[9] Xiang Li and Yuzheng Chen. 2020. Auto-Hierarchical Data Algorithm: Focus onIncreasing Users’ Motivation and Duration in Virtual Reality. In
HI ’21 Extended Abstracts, May 8–13, 2021, Yokohama, Japan Li, et al. [11] Peter Matthews and Cliff C. Zou. 2010. Scene tagging: Image-based CAPTCHAusing image composition and object relationships. In
Proceedings of the 5thInternational Symposium on Information, Computer and Communications Security,ASIACCS 2010 . 345–350. https://doi.org/10.1145/1755688.1755736[12] Florian Mueller and Andrea Lockerd. 2001. Cheese: Tracking mouse movementactivity on websites, a tool for user modeling. In
Conference on Human Factors inComputing Systems - Proceedings . https://doi.org/10.1145/634067.634233[13] Rakesh Patibanda, Florian ’Floyd’ Mueller, Matevz Leskovsek, and JonathanDuckworth. 2017. Life Tree. In
Proceedings of the Annual Symposium on Computer-Human Interaction in Play . ACM, New York, NY, USA, 19–31. https://doi.org/10.1145/3116595.3116621[14] Luis Von Ahn, Maunei Blum, and John Langford. 2004. Telling humans andcomputers apart automatically.
Commun. ACM
47, 2 (feb 2004), 56–60. https://doi.org/10.1145/966389.966390[15] Luis Von Ahn, Benjamin Maurer, Colin McMillen, David Abraham, and ManuelBlum. 2008. reCAPTCHA: Human-based character recognition via web securitymeasures.
Science
Proceedings - 2020 IEEE Conferenceon Virtual Reality and 3D User Interfaces, VR 2020 . 204–211. https://doi.org/10.1109/VR46266.2020.1581268453415[17] Wenge Xu, Hai-Ning Liang, Qiuyu He, Xiang Li, Kangyou Yu, and Yuzheng Chen.2020. Results and Guidelines From a Repeated-Measures Design ExperimentComparing Standing and Seated Full-Body Gesture-Based Immersive VirtualReality Exergames: Within-Subjects Evaluation.
JMIR Serious Games
8, 3 (jul2020), e17972. https://doi.org/10.2196/17972[18] Wenge Xu, Hai Ning Liang, Xiaoyue Ma, and Xiang Li. 2020. VirusBoxing: AHIIT-based VR boxing game. In
CHI PLAY 2020 - Extended Abstracts of the 2020Annual Symposium on Computer-Human Interaction in Play . 98–102. https://doi.org/10.1145/3383668.3419958 arXiv:2010.03781[19] Shumin Zhai, Per Ola Kristensson, and Barton A. Smith. 2005. In search ofeffective text input interfaces for off the desktop computing.