4 ms·

OK, I like the idea to use a "hidden" captcha to block automated spam bots. However, I don't think a hidden blank field is enough. Maybe you could use javascr

by waivej 16y ago

OK, I like the idea to use a "hidden" captcha to block automated spam bots. However, I don't think a hidden blank field is enough. Maybe you could use javascript to set a value in that hidden field. Or make sure the client loaded the empty form page first? Anyone have better tests?

joshfraser 16y ago
remember that spam bots can be designed to work just like a browser and so they can execute javascript too.
pavel_lishin 16y ago
For any programmatic way of checking to see if the user is a human, without them interacting with the system, there's a programmatic way of faking it.
- dennisgorelik 16y ago
  If you not only block problematic comment, but also block abusing IP address from for next couple of months -- it would be pretty hard to figure out what exactly your anti-abuse system checks for. Especially if your system check for several red flags.
iaskwhy 16y ago
Site is down for me at the moment so I'm not sure I understand what you mean by "hidden blank field" but I have a niche social network with around 150k pageviews/month and a simple css hidden input field on the signup form has been enough to keep all the spam away.
honopu 16y ago
Well, one way is to have a form input hidden by css, that is like spam catching 101. I actually found a fairly interesting sort of captcha I am using for signing of rental agreements using jsignature which draws a canvas that people can sign using their mouse. This updates a hidden form element with mouse x/y data to draw the signature again if you need to. You could potentially use something like this, but reCaptcha is incredibly easy to integrate.
thangalin 16y ago
Not my list (original source would be welcome, if known): /* * The types of spammers include: playback bots, form-filling bots, and * humans. This script reduces automated form submission from both bot * types. * * CAPTCHA failure: xrumer (http://www.botmasternet.com/) DeCaptcher * (http://decaptcher.com/client/), http://allbots.info/, and * CAPTCHA bypass (http://www.guruperl.net/products/captcha-bypass/). * * ======================================================================= * Playback Bots * ======================================================================= * Playback bots take data that has already been submitted against a form * and continue to resubmit it. * * [X] Weakness: Hash a timestamp, IP address, and browser name within hidden * input fields, encrypted with a password. * * ======================================================================= * Form-filling Bots * ======================================================================= * These bots mechanically fill in form fields. * * [X] Weakness: Honeypot fields. Hidden from users using CSS, the input field * is not displayed to human users, but shows up for bots. The field should * shift its order randomly (relative to the valid fields). * * [X] Weakness: Misnamed fields. Randomize the names of fields. Record the * real names within a hidden input field. * * ======================================================================= * Humans * ======================================================================= * There is no way to prevent a human from spamming you. However, you can * use JavaScript to make the submit button disabled for a short time. * (Like the time it would take a human to fill in all their contact * details.) * * Weakness: Double submissions. Disable the submit button using JavaScript * once the user has clicked submit. * * ======================================================================= * All Bots * ======================================================================= * [X] Weakness: Timestamp fields. The time between generating the form * and submitting the form must be after a minimum number of seconds (5), * but no longer than a certain number of minutes. TIMEOUT page. * * [X] Weakness: Session variable. This ensures that the form was posted * from the website, not remotely POSTed. See: session_start(), * session_destroy(), and unset. * * [X] Weakness: Cookie variable. This also ensures that the form was posted * from the website, not remotely POSTed. See: session_start(), * session_destroy(), and unset. * * [X] Weakness: Word count. The number of distinct words (characters * separated by spaces) must be above a certain count. * * Weakness: Duplicate data. All form data must be unique. * * [X] Weakness: HTTP REFERER. When the page is initially loaded, the HTTP * REFERER is added as a hidden, encrypted field. The value must be the * same as when the form is submitted. * * [X] Weakness: Email address. The email's doman must have an * MX record in a non-bogus IP-space. See: checkdnsrr( doman, "MX" ) * * [X] Weakness: Links. Comments can only have one website link. * * [X] Weakness: Strip HTML. Comments are stripped of HTML tags. * * [X] Weakness: Name. The name must contain "typically" valid characters for a * person's name. Regex: "/[\^<,\"@\/\{\}\*\$%\?=>:\|;#]+/i" * * [X] Weakness: Mollom. http://mollom.crsolutions.be/ */

by waivej 16y ago

joshfraser 16y ago

remember that spam bots can be designed to work just like a browser and so they can execute javascript too.

pavel_lishin 16y ago

For any programmatic way of checking to see if the user is a human, without them interacting with the system, there's a programmatic way of faking it.

dennisgorelik 16y ago
If you not only block problematic comment, but also block abusing IP address from for next couple of months -- it would be pretty hard to figure out what exactly your anti-abuse system checks for. Especially if your system check for several red flags.

iaskwhy 16y ago

Site is down for me at the moment so I'm not sure I understand what you mean by "hidden blank field" but I have a niche social network with around 150k pageviews/month and a simple css hidden input field on the signup form has been enough to keep all the spam away.

honopu 16y ago

Well, one way is to have a form input hidden by css, that is like spam catching 101. I actually found a fairly interesting sort of captcha I am using for signing of rental agreements using jsignature which draws a canvas that people can sign using their mouse. This updates a hidden form element with mouse x/y data to draw the signature again if you need to. You could potentially use something like this, but reCaptcha is incredibly easy to integrate.

thangalin 16y ago

Not my list (original source would be welcome, if known): /* * The types of spammers include: playback bots, form-filling bots, and * humans. This script reduces automated form submission from both bot * types. * * CAPTCHA failure: xrumer (http://www.botmasternet.com/) DeCaptcher * (http://decaptcher.com/client/), http://allbots.info/, and * CAPTCHA bypass (http://www.guruperl.net/products/captcha-bypass/). * * ======================================================================= * Playback Bots * ======================================================================= * Playback bots take data that has already been submitted against a form * and continue to resubmit it. * * [X] Weakness: Hash a timestamp, IP address, and browser name within hidden * input fields, encrypted with a password. * * ======================================================================= * Form-filling Bots * ======================================================================= * These bots mechanically fill in form fields. * * [X] Weakness: Honeypot fields. Hidden from users using CSS, the input field * is not displayed to human users, but shows up for bots. The field should * shift its order randomly (relative to the valid fields). * * [X] Weakness: Misnamed fields. Randomize the names of fields. Record the * real names within a hidden input field. * * ======================================================================= * Humans * ======================================================================= * There is no way to prevent a human from spamming you. However, you can * use JavaScript to make the submit button disabled for a short time. * (Like the time it would take a human to fill in all their contact * details.) * * Weakness: Double submissions. Disable the submit button using JavaScript * once the user has clicked submit. * * ======================================================================= * All Bots * ======================================================================= * [X] Weakness: Timestamp fields. The time between generating the form * and submitting the form must be after a minimum number of seconds (5), * but no longer than a certain number of minutes. TIMEOUT page. * * [X] Weakness: Session variable. This ensures that the form was posted * from the website, not remotely POSTed. See: session_start(), * session_destroy(), and unset. * * [X] Weakness: Cookie variable. This also ensures that the form was posted * from the website, not remotely POSTed. See: session_start(), * session_destroy(), and unset. * * [X] Weakness: Word count. The number of distinct words (characters * separated by spaces) must be above a certain count. * * Weakness: Duplicate data. All form data must be unique. * * [X] Weakness: HTTP REFERER. When the page is initially loaded, the HTTP * REFERER is added as a hidden, encrypted field. The value must be the * same as when the form is submitted. * * [X] Weakness: Email address. The email's doman must have an * MX record in a non-bogus IP-space. See: checkdnsrr( doman, "MX" ) * * [X] Weakness: Links. Comments can only have one website link. * * [X] Weakness: Strip HTML. Comments are stripped of HTML tags. * * [X] Weakness: Name. The name must contain "typically" valid characters for a * person's name. Regex: "/[\^<,\"@\/\{\}\*\$%\?=>:\|;#]+/i" * * [X] Weakness: Mollom. http://mollom.crsolutions.be/ */