Captcha v2

[rahularya50]

General behavior:

• When a user opens the CATS site, the cookie user will be stored with a random 32-character string, that represents that user's user_id. The user_id is used to avoid one user occupying multiple slots on the leaderboard.
• When a user completes a match and qualifies for the leaderboard with a wpm (claimed_wpm) greater than MAX_UNVERIFIED_WPM = 90, they have to complete a Captcha in a timed manner.
• They must complete the Captcha with a wpm of not less than CAPTCHA_SLOWDOWN_FACTOR = 0.7 times their claimed wpm, to qualify for the leaderboard. Their accuracy must be at least CAPTCHA_ACCURACY_THRESHOLD = 70 to pass the Captcha.
• Upon success, the cookie token will be stored authenticating that (user_id, claimed_wpm) tuple, so future attempts will not require confirmation. However, they will never qualify for the leaderboard unless they beat their previous time, so this cookie isn't really necessary.

Risks:

• A user could skip the game entirely and just try getting higher speeds using the Captchas, but hopefully the wpm and accuracy thresholds are set so that this isn't any easier.
• A user could reset their user cookie to obtain multiple spots on the leaderboard. However, this would require them to complete the Captcha challenge multiple times, since the token stores their user_id. There's no easy way to avoid this short of using OKPy authentication, which I don't want to do since it can't be used for the SIGCSE version (and is annoying to implement).
• Users can still trivially cheat on multiplayer matches, though it won't affect the leaderboard. I don't see any way to avoid this, hopefully this isn't as tempting a target as attacking the leaderboard.

Future improvements:

• Just do OKPy authentication, and disable it for speedtyper.org
• Verify that the user is in fact typing the paragraph, rather than skipping to the Captcha. A partial implementation is at Leaderboard protection #10 . The issue is that this basically circumvents the project code since the server has to recompute everything, which is sorta missing the point of the project.
• Use CSS to make it even harder to naively cheat by copying + pasting. However, users can always inspect the network requests themselves, which shouldn't be obfuscated since they pass through gui.py and are handled by student code.

[rahularya50]

TODO:

• Test local version
• Use threading solution from CAPTCHA #5 to pregenerate captchas