A couple of days ago, some robots started to sign up on the website (about 30 in a couple of days), they don't do anything on the website (as I'm guessing they don't find what they're looking for).

I'd rather not have a CAPTCHA on my sign up form, is there any risk to letting those robots signing up with the website?

Is there anything I can do besides a CAPTCHA (they have different IPs, passwords, emails...)?

  • 2
    By simply creating an account they may have already gotten what they wanted. Many people just don't like creating accounts at every website they visit. As a web dev you can make that easier using something like OpenID for logins. If you do not use something like that then your users just might. Before there was OpenID there was BugMeNot. BugMeNot handles the problem on the user side by preemptively creating throw away accounts on all sorts of sites. I'd say this is a more likely scenario for why the bots created the accounts but there could easily be a reason the neither of us thought of too. – krowe Sep 4 '13 at 16:21

Look into having a honey pot in your form, this will only work though if it's a generic robot, as the moment a custom script is written the honeypot can easily be bypassed.

Also, if you're not keen on a CAPTCHA you could try Solve Media's alternative and earn a bit on the side at the same time, I think it was Ticketmaster who recently started using them as an alternative.

Something else I've seen to stop cURL automation is to set a cookie in the user's browser then using JavaScript and a combination of that cookie encrypt the _POST data, so that it's gibberish. This can be a real pain if you're working with cURL as you then have to reverse engineer it, again this slows people down, but does eradicate the use of bots if someone has enough time on their hands.

Of course if they really want to get at you they can use Amazon Turk to pay a real human $0.01-$0.05 for each signup / action on your site.

| improve this answer | |
  • Interesting point about Amazon Mechanical Turk, wasn't aware of crowdsourcing for HITs. – dan Sep 4 '13 at 22:27
  • Yeah, me neither. Interesting. – Callombert Sep 5 '13 at 9:35
  • Use easy captcha like 1+2 equals? This will not effect your registration as its user friendly avoid using old style word captchas. – user2434 Sep 11 '13 at 10:48
  • @simon walker - The problem with that is is - The question ie. what is 1 + 2 can be machine readable by parsing the text or if its an image by OCR, it will defeat really basic generic bots, but if the bots designer knows that this type of security is being used it can be really simply overcome. – sam Sep 11 '13 at 13:24

To avoid bots, you can try any of the following, but CAPTCHA is the best way to avoid scripted attacks.

  1. You could use CSRF tokens to avoid this
  2. Insert or remove some value via JavaScript from the form element and verify the same on the server end.
  3. Check for the HTTP referer on sign up
| improve this answer | |
  • Captcha is the best way to avoid scripted attacks Since when? Captcha has been cracked for a long time and most bots can decaptcha for less than $0.001 a site. – Simon Hayter Sep 4 '13 at 18:28
  • what about google.com/recaptcha ? – Sairam Sep 4 '13 at 18:41
  • Cracked, for a long time sadly. I won't list them on here but Google for decaptcha. Your see dozens of services that charge as little as 0.001 per each crack, and even then you can even purchase software now. The reason you pay for the service is that each crack takes CPU time and they charge for the resources. Google come up with awesome ideas but then open up new revenues for the bandits :P – Simon Hayter Sep 4 '13 at 18:52
  • One of the best ways of preventing bots is to confuse them, captcha is still ok, it slows them down but shouldn't be seen as a complete solution, you want to rename the forms and remove visible footprints. – Simon Hayter Sep 4 '13 at 18:53
  • I didn't know that. Great information. Thanks @bybe – Sairam Sep 4 '13 at 19:16

I simply add a hidden input named: name or pseudo and I check if is empty when I process de post. That clears 95% of robot sign-up!

Of course I add a time token in a session and a hidden input and compare it + an time in session for timing between form page and process page.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.