Tag Info

Hot answers tagged

17

I like to use Honeypots in my forms since the user won't notice them, they keep most crap away but are not 100% foolproof. The trick is to make a new form field in your existing form, for example <input type="text" name="email" id="mailfield"/> and put #mailfield { display: none; } in your CSS. If your form is submitted with data in the email field ...


8

Use a combination of timestamp, spinner, field names, and honeypots... Read this article for the detailed example. A timestamp is exactly what it sounds like. A hidden field that marks the time when the form was originally opened. This defeats playback bots that copy a form and replay back the submission process over and over with different data each time. ...


7

I never liked captcha's. I even have seen one instance 'in the field' of someone not able to solve a captcha in the first dozen attempts (don't ask). Up till now, I've been successfull to keep spam off this one website I set up, just by checking all 'periferal requests' are actually performed (stylesheets, scripts, images), confirming it's a real 'flesh and ...


4

A best practice shows the following user friendly solution: Add a hidden field in your form. Bots will automatically complete all forms, whilst humans will not since they cannot see the hidden field. When all fields are submitted you know that its a bot and you simply won't allow submitting a message. Works great and there is no extra hassle for your website ...


4

There are a lot of free captcha services, but there are also a lot of new tricks you can do to avoid using captcha's altogether. One very popular approach is to add a hidden field inside your form. On your backend, you can check whether the hidden field is filled in. A bot would fill the hidden field, a user not. If you catch a hidden field that is filled ...


3

The bots are probably harmless. But I like to think that I'm starring in a Tom Clancy novel and it's a sleeper cell waiting to unleash a tidal wave of spam that could ultimately compromise national security. So I recommend deleting them on a routine basis. ;) When a user signs up, determine what country they're from. I find that MaxMind's GeoIP web service ...


3

Use numbers only. I've seen Russian, Chinese, and other non-Roman language sites take this approach. Presenting Roman captures is unwise, as it's not safe to assume that mangled alien characters will be legible to non-native speakers. (I find them hard to decipher at the best of times.) You might also consider omitting CAPTCHAs altogether by using a service ...


3

It is quite difficult to tell without adding further checks I would normally add a question that a computer can't answer. Ie "If today is Thursday, what is tomorrow?" "What month comes before October?" etc. I use this technique on our forum as well as a Captcha and it has reduced the amount of spam quite considerably. Just having a Captcha wasn't ...


3

I like low-tech: Doing a simple math problem works well. Enter what 4 + 4 adds up to: Then check server-side for 8. This is one I've used successfully on blogs using the Math Comment Spam Protection Plugin. Adding an extra field to your forms like: <input name="bots_only" value="" style="display: none" /> Usually, if bots_only is passed along ...


2

I've also used simple natural language challenges, such as : A ________ is something with numbered pages surrounded by two covers. Hint: Rhymes with look The caveats of this approach is having to maintain a separate challenge/hint/answer file for each language that you want to support, but I'm leaning in this direction more and more as CAPTCHA images ...


2

Usually, this kind of behavior can be explained in two ways: First, it can be a test to discover vulnerabilities of your site, your application or your server. Forms can be really dangerous, they can open the door to your software or your server configuration. Several attacks try to guess whether your system is vulnerable by sending you requests including ...


2

It's probably a test for a real attack, proof of concept for an attackers new system, or a demonstration of an attack for potential buyers maybe? I would tend to think this was not someone harmless doing it for fun as they would probably just write messages and no be trying to insert URL's. Either way best to remove it asap to reduce the chance you are ...


2

You have to look at Captcha as a security measure. With that in mind companies use Captcha for two reasons. It is the easiest and fastest solution for them to solve bot problems They are using other means of bot detection but they need additional layers and Captcha is one of those layers As a company becomes bigger, more well known, and hosts more ...


2

If you use reCAPTCHA, you can use their API to log the number of failed attempts (code shown uses the reCAPTCHA Ruby gem): if validate_recap(params) #user validated the captcha, create an account else #user failed to validate, log the attempt and show a new captcha end Using the reCAPTCHA library helps digitise books while reducing scripted ...


2

Security and usability are always going to be at odds. The more secure you make something the harder it typically becomes to use. If you want to keep spammers from abusing your registration form you can use these tips I gave in a previous answer: 1) Putting a fake field that only bots will see. Then if that field is submitted with the rest of the ...


2

Yes and no. While people find captchas annoying, not having one couuld lead to automated bots creating accounts. If your site allows interaction, i.e. commenting, the bots may create accounts and spam links/adverts everywhere. So if your site requires interaction, or a user can submit data that is published on the site, I would recommend keeping the ...


2

The problem with coming up with a solution is that if it is posted on the internet, autopligg will just find a way around it. To fight the spam I have had to hack Pligg and come up with custom methods to keeping spam at bay and even at that, spammers still find a way around my defenses. My suggestion to you is to keep up-to-date on the latest techniques in ...


1

See this article from MikeBeach.com, using alternatives to captchas, and explaining in details pros/cons of some well-known captcha libs or services such as reCAPTCHA. Quoting: Personally, I use a combination of Bad Behavior and Defensio on my sites, and I’ve seen a big drop in the amount of spam.


1

I have this on some of my sites, whilst not a perfect solution I used MaxMInd GeoIP to block countires in Eastern Europe & China. This reduced the number of bad signups by over 90% for me. GeoIPEnable On GeoIPDBFile /path/to/GeoIP.dat SetEnvIf GEOIP_COUNTRY_CODE CN BlockCountry SetEnvIf GEOIP_COUNTRY_CODE RU BlockCountry # ... place more countries ...


1

My guess would be that they're crawlers which haven't received a particular order to sign up for your site, just sites in general. I can't imagine why they would sign up and then never post anything; perhaps your post button/form is oddly set up so that they can't use it? If you want to prevent them from registering (the ones which get past the captcha), you ...


1

My suggestion is Don't use CAPTCHA. It's terrible for your users and bots can solve even the very best ones with about 20% success rates. Instead, you can identify bots by them not running javascript and not requesting supporting files such as .js, .css and image files. This will work effectively and with a low false positive rate until you get big enough ...


1

Using JavaScript for validating a CAPTCHA is absolutely pointless because 99% of spambots don't execute JavaScript. They are not advanced web browsers with "inspect element" features, they are basic programs that fetch the HTML of a page, look for a form, then send a POST request to the form's action parameter. Their purpose is to trawl as many web pages ...


1

On small sites, a static CAPTCHA can provide some security against automated spambots that trawl e.g. Google for sites to attack. Even though the CAPTCHA is fixed for each site, each site (hopefully) has a different one. Basically, with a normal (dynamic) CAPTCHA, the payoff for solving it is the ability to make one post. With a static CAPTCHA, you get to ...


1

This may seem a little ridiculous, but if you're getting the traffic you say you are from the SAME IP addresses, would it be possible to install Fail2Ban on the server itself? (not Apache module). Some info: http://www.fail2ban.org/wiki/index.php/Main_Page but this scans Error logs from the server (Apache's logs, for example) and finds patterns where someone ...


1

Use Google's OCR to digitize those books. As for using your own books to translate, there isn't currently third-party software available for that. For added reasoning against this, an excerpt from the CAPTCHA Site; Should I Make My Own CAPTCHA? In general, making your own CAPTCHA script (e.g., using PHP, Perl or .Net) is a bad idea, as there are ...


1

Your goal is to make the payment process as simple and straightforward as possible. Adding a CAPTCHA to your payment form will do the opposite of that. CAPTCHAs are notoriously difficult to complete. They have to be complex to defeat bots that are continually getting more and more sophisticated. But that complexity makes it more difficult for humans to ...


1

Pre-defined: Completely supported: English Partially supported: Dutch French German Portuguese Russian Spanish Turkish "play sound again", "download sound as MP3", and entire manual (JavaScript-independent) challenge in English. Barely supported: Italian "play sound again", "download sound as MP3", entire manual (JavaScript-independent) ...


1

It is not too difficult to roll your own basic CAPTCHA, or there are numerous tutorials and scripts out of the web. I've used a simple one in PHP based on random letters/numbers, feel free to take and modify for your purpose: // first generate random $string $pa_captcha_salt = 'random stuff'; $hash = md5( $string.$pa_captcha_salt ); $filename = ...


1

One thing that it's worth noting is that more and more spammers are using real people to do their work, rather than bots. In which case, worrying about which captcha or honeypot to use isn't going to be very useful.



Only top voted, non community-wiki answers of a minimum length are eligible