Death to Captchas

I'm sorry, I have a hard time with articles that complain but offer no solutions (and the one line at the end about Akismet doesn't really cut it for me.)

I've seen some captchas that have you do simple math problems or other basic questions, which seemed to be a better alternative. I also remember seeing prototypes of a captcha that showed nine pictures and told users to select the three that were cats. Not sure why that never caught on, though.

He gets it slightly wrong on how it works. One is not verified by a computer and one verified by a user. Here's a quote from http://www.google.com/recaptcha/learnmore

"""But if a computer can't read such a CAPTCHA, how does the system know the correct answer to the puzzle? Here's how: Each new word that cannot be read correctly by OCR is given to a user in conjunction with another word for which the answer is already known. The user is then asked to read both words. If they solve the one for which the answer is known, the system assumes their answer is correct for the new one. The system then gives the new image to a number of other people to determine, with higher confidence, whether the original answer was correct."""

I recently tried turning off our CAPTCHA for a few weeks and instead just blocking all comments with links. I was still getting hammered by 10% of junk comments that don't have a link. Many of them were gibberish; my guess is it's a bot cataloging which sites accept comments in the first place.

Solving a CAPTCHA sucks for the person submitting the comment, but having a page full of Viagara spam burying any legit comments sucks for everyone.

What scares me is the noticeable rise in spam comments being submitted by actual humans apparently in India and China. I set up a ModSecurity rule to block inbound hits coming from a Google search that includes the phrase "post a new comment" but that's only going to work for so long.

>A far more elegant solution is to use some sort of filtering system (like Akismet). Such a system can run behind the scenes and work without complicating the user experience.

I disagree.

An automated system that calculates the probability that user data is invalid will inevitability report false positives, leading to blocked or deleted content. Try explaining that to a user.

It's a 2 of 3 problem; We want three things 1) access to stuff 2) that access to be secure 3) no effort/time/delay for access. But in reality you only get two of those.

In general things of "value" can't be both secure and fast/easy. If it's fast/easy it can(and will) be brute forced and/or Amazon Turked.

http://www.nucaptcha.com/ Offers a solution in video captchas. Moving letters are way easier to read and if fraudulent activity is detected the videos slow down to a rate which becomes uneconomical to solve.

Weird for somebody to complain about visual accessibility and have a site design that's so poorly readable. I mean, OK, I only got 2.5 hours of sleep last night and so I'm more sensitive than normal, but my eyes are still jangling from reading that.

Does anyone have any experience with HashCash or alikes? http://en.wikipedia.org/wiki/Hashcash

Obvious problem is that in case of directed attacks spammers (or other malicious persons) would use native code or even GPUs to perform computations, while ordinary users would be limited by slower JavaScript implementations. It would help (but not solve the problem completely), though, if someone would show us some non-trivial code, that performs computation in background (without any noticeable impact on page interactivity), that'll finish in some minimal time required to write a meaningful comment or fill out a form.

If you can afford to require registration for comments, then using the blacklist at www.stopforumspam.com works quite well. I've cut down my number of spambot-induced accounts by about 90% for a couple of forums I manage.

The next captchas will likely be "choose the animal" from a 2D picture. given the small images across the screen, choose the dogs.

The people working to get through security measures will always be there, we might as well put them to good use. Get them to build innovative AI software to bypass security. The code to identify the animal in the picture will eventually find its way into the public and be put to good use.