I have a javascript canvas game with pixi.js that requires a player to press a certain combination of buttons to complete a level. They basically have to press the button that matches a certain color.

It turns out that players are writing bots in python to do this task and they are getting the maxium score each time. The game is already live and users enjoy playing it so I can't really change anything gameplay wise.

So I thought about a few possible solutions but I have some concerns

1. Captcha between each level
2. Check the speed of the input
3. Check how consistent the input is

The captcha will hurt user experience, and there are tons of video's how to bypass it. 2 and 3 will fail after the creators of the bots understand what is happening. So I am really stuck on what I could do.

CodePudding user response：

I would consider a random grace period before allowing the buttons to be clicked. this may stump some bots, but is citcumventable.

Besides that, I would profile the timing of the clicks/interactions. Every time next level is requested, compare to the profile, and if they are consistently the same introduce a randomized button id, button shape (circle, oval, square, etc.), button placement (swap buttons) to avoid easy scripting. Also the font and the actual text could be varied.

I would also chagne the input element to <input type="image"> since it will give you the exact coordinates (if possible - I'm not familiar with pixi.js) and this will aid in the profiling.

You could also implement some sort of mouse position tracker, but people on touchscreens will not produce data for this. You could supplement with additional check if the user input is touch, but a bot would easily be able to circumvent it.

CodePudding user response：

I think your approach is valid. It seems a bit excessive to add Capcha between each level, perhaps add it before the game starts.

It might be a good idea to check interval between individual clicks, and define some threshold when you can safely assume that it was a bot who clicked the button.

Another approach you could take is to make it more complicated to look up the correct buttons. Approaches like randomizing the element IDs, not rendering the label inside the buttons but as separate elements (I assume it is a game with some fixed window size and you don't care about mobile that much).

I am not familiar with Pixi.js, but that could be an approach to consider.

----------------------- Edit -----------------------

What if you run your game in an iframe ?