Tag Info

Hot answers tagged

17

I like to use Honeypots in my forms since the user won't notice them, they keep most crap away but are not 100% foolproof. The trick is to make a new form field in your existing form, for example <input type="text" name="email" id="mailfield"/> and put #mailfield { display: none; } in your CSS. If your form is submitted with data in the email field ...


12

Captcha has always been vulnerable to a simple man-in-the-middle attack where the spammer relays the images to its own captcha on a website which offers mp3 downloads or porn for free. It doesn't matter what type of captcha you use. Detecting behaviour patterns is the way to go.


8

Use a combination of timestamp, spinner, field names, and honeypots... Read this article for the detailed example. A timestamp is exactly what it sounds like. A hidden field that marks the time when the form was originally opened. This defeats playback bots that copy a form and replay back the submission process over and over with different data each time. ...


7

I never liked captcha's. I even have seen one instance 'in the field' of someone not able to solve a captcha in the first dozen attempts (don't ask). Up till now, I've been successfull to keep spam off this one website I set up, just by checking all 'periferal requests' are actually performed (stylesheets, scripts, images), confirming it's a real 'flesh and ...


4

There are a lot of free captcha services, but there are also a lot of new tricks you can do to avoid using captcha's altogether. One very popular approach is to add a hidden field inside your form. On your backend, you can check whether the hidden field is filled in. A bot would fill the hidden field, a user not. If you catch a hidden field that is filled ...


4

I'm not the biggest fan of captcha's but when they are useful they should be used. If you validate card number (as I think you should) you could use a captcha only after a certain number of wrong successive tries by a user (identified by its IP address and timestamp).


4

A best practice shows the following user friendly solution: Add a hidden field in your form. Bots will automatically complete all forms, whilst humans will not since they cannot see the hidden field. When all fields are submitted you know that its a bot and you simply won't allow submitting a message. Works great and there is no extra hassle for your website ...


3

Use numbers only. I've seen Russian, Chinese, and other non-Roman language sites take this approach. Presenting Roman captures is unwise, as it's not safe to assume that mangled alien characters will be legible to non-native speakers. (I find them hard to decipher at the best of times.) You might also consider omitting CAPTCHAs altogether by using a service ...


3

I like low-tech: Doing a simple math problem works well. Enter what 4 + 4 adds up to: Then check server-side for 8. This is one I've used successfully on blogs using the Math Comment Spam Protection Plugin. Adding an extra field to your forms like: <input name="bots_only" value="" style="display: none" /> Usually, if bots_only is passed along ...


3

It is quite difficult to tell without adding further checks I would normally add a question that a computer can't answer. Ie "If today is Thursday, what is tomorrow?" "What month comes before October?" etc. I use this technique on our forum as well as a Captcha and it has reduced the amount of spam quite considerably. Just having a Captcha wasn't ...


3

The bots are probably harmless. But I like to think that I'm starring in a Tom Clancy novel and it's a sleeper cell waiting to unleash a tidal wave of spam that could ultimately compromise national security. So I recommend deleting them on a routine basis. ;) When a user signs up, determine what country they're from. I find that MaxMind's GeoIP web service ...


2

Usually, this kind of behavior can be explained in two ways: First, it can be a test to discover vulnerabilities of your site, your application or your server. Forms can be really dangerous, they can open the door to your software or your server configuration. Several attacks try to guess whether your system is vulnerable by sending you requests including ...


2

It's probably a test for a real attack, proof of concept for an attackers new system, or a demonstration of an attack for potential buyers maybe? I would tend to think this was not someone harmless doing it for fun as they would probably just write messages and no be trying to insert URL's. Either way best to remove it asap to reduce the chance you are ...


2

I've also used simple natural language challenges, such as : A ________ is something with numbered pages surrounded by two covers. Hint: Rhymes with look The caveats of this approach is having to maintain a separate challenge/hint/answer file for each language that you want to support, but I'm leaning in this direction more and more as CAPTCHA images ...


2

You have to look at Captcha as a security measure. With that in mind companies use Captcha for two reasons. It is the easiest and fastest solution for them to solve bot problems They are using other means of bot detection but they need additional layers and Captcha is one of those layers As a company becomes bigger, more well known, and hosts more ...


2

Traffic filtering/limiting has to be done on the server and it's easier to add a captcha to a web page then set that up. Also, it's hard to get traffic filtering/limiting to spot a spambot which has the rate it hits a particular site set quite low.


2

If you use reCAPTCHA, you can use their API to log the number of failed attempts (code shown uses the reCAPTCHA Ruby gem): if validate_recap(params) #user validated the captcha, create an account else #user failed to validate, log the attempt and show a new captcha end Using the reCAPTCHA library helps digitise books while reducing scripted ...


2

Security and usability are always going to be at odds. The more secure you make something the harder it typically becomes to use. If you want to keep spammers from abusing your registration form you can use these tips I gave in a previous answer: 1) Putting a fake field that only bots will see. Then if that field is submitted with the rest of the ...


2

Yes and no. While people find captchas annoying, not having one couuld lead to automated bots creating accounts. If your site allows interaction, i.e. commenting, the bots may create accounts and spam links/adverts everywhere. So if your site requires interaction, or a user can submit data that is published on the site, I would recommend keeping the ...


2

The problem with coming up with a solution is that if it is posted on the internet, autopligg will just find a way around it. To fight the spam I have had to hack Pligg and come up with custom methods to keeping spam at bay and even at that, spammers still find a way around my defenses. My suggestion to you is to keep up-to-date on the latest techniques in ...


2

Yes, fake accounts are bad for your site. They could significantly hurt your site's reputation. When they register, your site probably sends an email to a bad address or an address that belongs to someone that didn't register on your site. That makes you look like a possible spammer. They could use the accounts to degrade performance on your site (this ...


1

It's a good question, it's been asked so often that we've added a community wiki answer that summarizes the best methods.


1

See this article from MikeBeach.com, using alternatives to captchas, and explaining in details pros/cons of some well-known captcha libs or services such as reCAPTCHA. Quoting: Personally, I use a combination of Bad Behavior and Defensio on my sites, and I’ve seen a big drop in the amount of spam.


1

Use Google's OCR to digitize those books. As for using your own books to translate, there isn't currently third-party software available for that. For added reasoning against this, an excerpt from the CAPTCHA Site; Should I Make My Own CAPTCHA? In general, making your own CAPTCHA script (e.g., using PHP, Perl or .Net) is a bad idea, as there are ...


1

Your goal is to make the payment process as simple and straightforward as possible. Adding a CAPTCHA to your payment form will do the opposite of that. CAPTCHAs are notoriously difficult to complete. They have to be complex to defeat bots that are continually getting more and more sophisticated. But that complexity makes it more difficult for humans to ...


1

Pre-defined: Completely supported: English Partially supported: Dutch French German Portuguese Russian Spanish Turkish "play sound again", "download sound as MP3", and entire manual (JavaScript-independent) challenge in English. Barely supported: Italian "play sound again", "download sound as MP3", entire manual (JavaScript-independent) ...


1

Captcha2 is another alternative. It works by clicking three letters following instructions on screen. Not sure how this stands up to internationalisation. It's also not free after the first 1000 impressions. If you're after something a little more light hearted then KittenAuth is interesting - click 3 kittens to continue. Finally, to see how captchas are ...


1

figure you take the beta, use IE 9, and then Bing for search instead of google. The 25 cents comes back 100 fold. MSFT is not dumb. They have done their market research and have deep pockets to buy a market.



Only top voted, non community-wiki answers of a minimum length are eligible