2

Have recently seen their ad where they claim to be able to do it due to the fact that unlike most OCR CAPTCHA crackers which are bots, they use workforce, humans behind the scenes. Although I still don't get the technical side of the problem, I'd like still know if it is an issue or a rumor. And, of course, how can I protect my website in case it's true.

1 Answer 1

4

The answer is to not use a captcha, or use something in addition to it. Look to alternate methods such as hidden form fields that should never be filled in. Bots will most likely still fill them in, your validation will know immediately that it is a spammer.

Another method would be the time based trigger. If a bot hits page then fills out a form, it will be submitted immediately in many cases. This is because of both automation, and because they don't load assets in many cases. So using a timer function to calculate the time page parse stops to the time submit is clicked can reduce abusive actions. This is not foolproof though because some [return] users with autocomplete can fill a form and submit very quickly. You might want to combine this timer with other bot heuristics such as known user agents.

Finally an identifier check on POST can prevent a lot of abuse. This includes checking blacklists such as http://stopforumspam.com or http://projecthoneypot.org after the form is submitted, but before the logic/controllers take over the request. This works from ISP/server level REMOTE_ADDR header which is very hard to spoof, but very easy to proxy. If you do use this method, remember to make a proxy buster and only check via a POST (or throttled) action. If you try to use the blacklists like a API firewall, you will be quickly banned from their services.

If you do indeed insist on captcha, there are methods to embetter it. Example, using a homebrew captcha that uses different/unique structure and classes, or CSS :before and :after combined with layered component background images may throw off bots. Or, slicing the captcha images up so that there are a handful of squares may help. Or, randomizing classing and overkill nesting so there are no targets could help. Or, flickering/strobing/moving it around constantly could help by preventing screenshots. There are other variations of concepts like these too that will fragment captcha enough to throw off abusers. Basically, the more people who use things like recapthca means the more easily abusers will have free reign once the syntax is cracked. At least in a homebrew captcha you can change it up on a whim and make it more crypticy and hard to "understand" from a coded source angle.

5
  • Dang thoughtful answer!! I regret but that I have only one up-vote for this answer. (I think I heard something like this in history class...)
    – closetnoc
    Jun 24, 2015 at 16:54
  • 1
    I include an unsubscribe link in all of my transactions. The link does not use the word 'unsubscribe' in its description or URL, but the words tell any human that it is an unsubscribe link. Most bots will click every link in an opt-in email, so, in effect, the bot bypasses the bot-checks and creates an account, then unsubscribes from the account, disabling it.
    – Paul
    Jun 24, 2015 at 17:18
  • @Paul thats a good idea! Never thought about honeypotting the emails
    – dhaupin
    Jun 24, 2015 at 22:15
  • Awesome answer, thank you. I will try it and see how it works. Yet I still have doubts because the service I mentionned above claims to have people guessing CAPTCHAs for them, and that is what bothers me.
    – JaJames
    Jun 25, 2015 at 9:27
  • @JaJames Yeah that seems pretty foolproof...if they actually receive the captcha. Automation must send the captcha via an API, which requires a screenshot or something and then the ability for the automation to actually input the captcha data back into the correct spot. Making this as confusing as possible for the bots means that unless they "have it out for you" they will just leave to go harass some lesser protected site. Its not worth it for them to program "special case" macros when there are so many cookie cutter clone forms out there.
    – dhaupin
    Jun 25, 2015 at 14:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.