I need a little bit of advice on a Captcha (visual confirmation) solution which I created for my comment form on my CMS. I'm currently using random number in an image with random noise in the form of pixels. I'm also randomizing the background colour and the text colour each time the image is generated. However, the text itself is plain without distortions.

My question is how easily will OCR bots figure out this captcha? It seems a little weak since the text itself is not distorted. I'm not sure how to achieve such an effect, to be quite honest.

Any advice in the right direction will be of great help. By the way, I looked around google and found a couple of interesting captcha scripts, but I would prefer to use my own code if possible.

I _think_ that using mixed case and mixed fonts are pretty effective to drop the precision of OCRs, and is it easier do to compared to distortion. This is just my personal option based on my experience with OCRs.

You can do searches on google for strange fonts that noone really uses - these should be weird enough to do the trick.

The problem of course is that it's an app I'm planning to release under GPL. Would it be possible to install a font from the web for this? What about license conditions?

I supppose if you really wanted to, you could make your own font...I don't know where to point you for that though.

Also, if this app is opensource, if someone really wanted to get in, couldn't they look at the source and figure out a way in?

Actually visual confirmation is supposed to be independent of the code you use. Because it is similar to a one-way encryption, you cannot break an algorithm just by looking at the code which generates the image. At least that is the theory.

It's a kind of Turing test.

http://en.wikipedia.org/wiki/Captcha

There are a few well designed captchas which are virtually unreadable by bots. Some of them are open source as well. But I just preferred to use my own before going to a more complex thing.