12 ms·

"Many developers vastly over-estimate the likelihood of customized spam." I run 100s of small random low traffic low priority sites. Without some form of form

"Many developers vastly over-estimate the likelihood of customized spam." I run 100s of small random low traffic low priority sites. Without some form of form control, the ALL get hit with customized and random other crap spam. I don't have decent experience with many things in life, but I can say this is one topic I have YEARS of experience with. I've never over-estimated the amount of any type of spam any form can get after being on the web for just a few months. Doesn't matter how big they are or what they do. I'm not saying ReCAPTCHA is the only thing out there or even the best, but having an open form is just asking for trouble.

sbov 7y ago
Have an input element that can't be seen. If it has something in it, ignore the submit. Works for all my sites so far.
- charrondev 7y ago
  Doesn’t work as soon as you’re big enough to target. The company I work for makes a SaSS forum product, and while we do have multiple spam prevention methods (akismet, stopforumspam, honeypot, a hidden input), there’s enough stuff out there that has targeted our platform that a Recaptcha on the registration form is needed. We haven’t need it on any other forms yet though. After registration it’s all handled by the other methods and various moderation tools.
  - mattigames 7y ago
    Did you try randomizing the 'name' and 'ids' of the inputs? (including the invisible one)
    - korm 7y ago
      It's trivial to detect element visibility, this just doesn't work in bigger sites.
      - mattigames 7y ago
        You are right it doesn't work but is not trivial at all to detect visibility, there are millions of ways to hide an element using CSS, for example a rare one (without using "opacity", "display" or "visibility") is: transform: scale(0.00001);
        kbenson 7y ago
        The only way I see this being useful is if you do this for one or more elements as well as encrypt the name of every input element and also randomize the layout enough that they can't easily use CSS selectors or regular expressions to fine the relevant inputs by page location. I can and have defeated forms that tried to do all of those things very easily in the past. Keep in mind that if you randomize across a few variations (i.e. 4-5 page layouts), that's easily discerned if you pull the page source down 20-30 times, doa complex diff, scrub out obviously random strings, and check the total unique variations you're seeing. That may seem like a lot of work, but consider that if you don't do it all at once, but instead roll out small change after small change, the person or people using it are not weighing to cost to do everything required to bypass it compared to finding another open mail form, but the cost to bypass just the new fix you put in place. Also, they might think it's fun doing so... And on the site dev's side, they can just choose to outsource it to a CAPTCHA (not that there aren't services to easily bypass CAPTCHAs at scale at sub-cent per CAPTCHA rates, see https://anti-captcha.com/ https://anti-captcha.com/). Note: To forestall any assumptions, I wasn't doing any spamming or helping spamming in any way.
        T-hawk 7y ago
        You're not trying to make your site absolutely bot-proof. Someone deliberately targeting your site can figure out any such measures. (You want legitimate users to do so.) You're just trying to throw in enough friction that most common drive-by scripts won't succeed. It's a "don't have to outrun the bear" situation, make yourself just difficult enough that some easier target gets snagged instead.
        7y ago
    - mobjack 7y ago
      I really dont know how well that will work against a dedicated attacker. I am much more confident in ReCAPTCHA of stopping bots compared to any roll your own solution. I dont want to hope that an alternative is good enough for my needs. I want the best when it comes to protecting my site. Any alternative needs to have a proven track record and support to make consider replacing ReCAPTCHA.
      - deleted 7y ago
        [deleted]
      - jachee 7y ago
        How much does ReCAPTCHA's aggressively targeting non-Chrome and/or privacy-enabled browsers and making completing captchas exceedingly difficult factor in your decision? Do you want your site "protected" from those users, too?
      - briandear 7y ago
        So you force your users to consent to sharing all of their data with Google? That’ll teach ‘em.
        sb8244 7y ago
        What's an alternative that works at scale, though? It's easy to say "this is bad for these reasons, don't use it" while ignoring that there's not really better options once you get targeted.
        sb8244 7y ago
        To clarify, I do think that this post gives good alternatives because most spam is not targeted. However, you must do something like this if you're a big site or a small site who pissed someone off
        atoav 7y ago
        The reasonable thing to do would be to initially create challanges with multiple levels/difficulties so you can quickly change the mechanism when you are really targeted. For my personal blog I managed to be spam free with a simple question/answer pair for 5 years. Took me a minute to implement and leaves my user data where it belongs.
    - charrondev 7y ago
      I was preparing a response here, but many of the other commenters have covered it. I recently spent time ensuring our Auth pages’ HTML could be easily cached outside of our application servers. They were a common target of DDOS attacks because we were generating a unique nonce for CSRF protection. Randomizing form field names does not defeat a targeted attacker (and we have definitely been a target), prevents HTML caching, and will prevent auto filling fields by browsers and password managers. Additionally it will be terrible from a usability and accessibility standpoint. It’s trivial to target a form field by the text/label around it so those would need to be randomized as well.
      - dev_dull 7y ago
        > and will prevent auto filling fields by browsers and password managers. I would MUCH prefer the recaptcha over this!
        tinus_hn 7y ago
        Your browser probably isn’t smart enough to autofill the ‘comment’ part of a guestbook or the ‘body’ of an email.
      - DCoder 7y ago
        > Randomizing form field names […] will prevent auto filling fields by browsers and password managers. I wholly agree that this would not help, but for the sake of completeness, I want to point out that <input autocomplete=""> [0] is designed to solve this, by decoupling input field names from their intent. But Chrome is playing dumb about it [1]. And of course, the spambots will just adapt to parse the autocomplete info… [0]: https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/autocomplete https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes... [1]: https://www.reddit.com/r/programming/comments/ar1qj1/chromium_is_eroding_the_open_web_and_its_our/egl52wk/ https://www.reddit.com/r/programming/comments/ar1qj1/chromiu...
        deleted 7y ago
        [deleted]
  - PopeDotNinja 7y ago
    Please just don't use the bouncing ball that Dropbox made me use once. It was the first time my lack of athleticism prevented me from a signing in.
    - spongeb00b 7y ago
      I’ve not heard of this one before. Wouldn’t it cause serious problems for accessibility?
      - PopeDotNinja 7y ago
        Almost certainly.
    - peteretep 7y ago
      What is that? This comment is the first Google result for dropbox bouncing ball.
      - PopeDotNinja 7y ago
        I tried from finding it myself, and I've only seen it once. I was logging into Dropbox via Chrome on my Android phone, and I must have done something to trigger captcha spambot hell. I just tried triggering it again and was not able to do so. The ball had an animal in it and I was asked to bounce the ball, causing it to rotate. I had to bounce the ball with just enough force to get it to land so the animal was positioned upright. After several failed attempts, I gave up.
  - buboard 7y ago
    do you eliminate all spam that way? i get signup SEO spam even with recaptcha & stopforumspam.
    - charrondev 7y ago
      No it does not. Some creeps through the registration system, which is why we have additional trust measures afterwards. On my own site I see 1 or 2 spam posts a week although I get the feeling it’s real people doing the registration. They sign up, make 1 comment, get reported very quickly, then banned. We haven’t had to make our signup/registration system that strong in of itself though, because most of our largest clients end up using some SSO method exclusively and will have their own prevention methods.
- savrajsingh 7y ago
  That is smart
- deleted 7y ago
  [deleted]
- netok 7y ago
  It will also ignore people who use browser's autofill form function. Realized this after receiving a dozen complaints.
  - mattigames 7y ago
    You can randomly generate the "name" of the fields and autofill will never fill them, another option to disable autocomplete is to leave them without "name" and handling the submit using JavaScript.
    - smt88 7y ago
      Disabling autocomplete is user-hostile and additionally should be considered a security flaw. It makes it harder to use password managers.
      - analogmemory 7y ago
        You can disable a single input field from autocomplete `autocomplete="off"`
        fybe 7y ago
        'Autocomplete' doesn't work for Firefox (since version 38), Google Chrome (since 34), and Internet Explorer (since version 11 Huge pain
        analogmemory 7y ago
        This totally works in latest Chrome/FF/Safari https://codesandbox.io/s/static-jkvzs https://codesandbox.io/s/static-jkvzs https://jkvzs.codesandbox.io/ https://jkvzs.codesandbox.io/ The other trick is to add a random string/number in from of the name attribute e.g. name="348349_name". This prevents autofill. Interestingly 1Password and LastPass are smart enough to infer that it's a name or email field. For the honeypot, random number + word makes it ignored by autofill/1password
- GordonS 7y ago
  I did this years ago, it expecting it to work - but there hasn't been a single form spam since! I'm sure this won't work for everyone, but if your small, I highly recommend giving it a go.
- tutanchamun 7y ago
  Yeah, these honeypotts work quite well, however the last time I looked into it (circa 2012) I read that it is not ideal for visually impaired users with screen readers.
  - jrphenow 7y ago
    I forget everything that you need to do, but I believe I read that there's a happy medium you can strike such that a script would still input data but it wouldn't be shown to a screen reader.
- darekkay 7y ago
  This field will also been available for all screen reader users. It's important to add an adequate label ("Please do not fill out this field" or similar).
- dasanman 7y ago
  We used to this, does not seem to work at all these days anymore
- UncleMeat 7y ago
  Now your site is terrible for blind people.
deleted 7y ago
[deleted]
atoav 7y ago
I used 5 randomly choosen english questions with easy answers my readers would know — this prevented literally 100% of the unwanted spam, while it was easy on the users. If you want to filter comments you could even make the questions reflect the content of the article, filtering uninformed TL;DR type of comments and giving the users the feeling you value onformed opinions.
- alkonaut 7y ago
  I once used a form with a random math question: 7+2 = __ It prevented 100% of bot spam for years. Granted, I was never a big enough target to make anyone rewrite their bot, but that's the same for most of us. I'd never use a captcha so long as something trivial like that works 100%.
- Tepix 7y ago
  This (or something very similar) is a core feature of phpBB: https://www.phpbb.com/support/docs/en/3.2/kb/article/how-to-configure-q%2Ba-captcha/ https://www.phpbb.com/support/docs/en/3.2/kb/article/how-to-... It works very well.
nprateem 7y ago
I've got some web sites that use javascript to submit a form to an API gateway endpoint which then uses SES to send me an email. I get absolutely zero spam from any of them. I think the vast majority of spammers use non-javascript tools and that recaptcha is unnecessary for most low-profile sites if they'd just use javascript to POST the data instead.
Ntrails 7y ago
A forum I post on has zero restrictions on sign up. No recaptchas, nothing. Couple of times a month we see some (usually Cyrillic) bot post some thread with a link that (probably) no one clicks and we all have a laugh and tell it to post more (it never does). It's a small site, footfall in the 10s, so maybe that's the reason.
- hadrien01 7y ago
  We've blocked cyrillic characters on a contact form, and we went from hundreds of spam messages every day to less than one a month.
alibarber 7y ago
I have next to zero experience in this, but completely agree. Literally 'my first website' I made when I was a kid that had a very basic guestbook that I put together in php (actually it may have even been perl)/mysql got hit with random spam. Everything was something completely custom that I had made and not some package that may have had a common vulnerability - so there was and must still be stuff crawling the web looking for any kind of form to push junk into. In this case it was clearly trying to do some spam 'SEO'/keyword stuffing, because the page would display the static text (I was smart enough to filter out HTML though)...
- konradb 7y ago
  I must lack imagination! I cannot figure out what the ROI is if one codes stuff to randomly submit crap to forms.

sbov 7y ago

Have an input element that can't be seen. If it has something in it, ignore the submit. Works for all my sites so far.

charrondev 7y ago
Doesn’t work as soon as you’re big enough to target. The company I work for makes a SaSS forum product, and while we do have multiple spam prevention methods (akismet, stopforumspam, honeypot, a hidden input), there’s enough stuff out there that has targeted our platform that a Recaptcha on the registration form is needed. We haven’t need it on any other forms yet though. After registration it’s all handled by the other methods and various moderation tools.
- mattigames 7y ago
  Did you try randomizing the 'name' and 'ids' of the inputs? (including the invisible one)
  - korm 7y ago
    It's trivial to detect element visibility, this just doesn't work in bigger sites.
    - mattigames 7y ago
      You are right it doesn't work but is not trivial at all to detect visibility, there are millions of ways to hide an element using CSS, for example a rare one (without using "opacity", "display" or "visibility") is: transform: scale(0.00001);
      - kbenson 7y ago
        The only way I see this being useful is if you do this for one or more elements as well as encrypt the name of every input element and also randomize the layout enough that they can't easily use CSS selectors or regular expressions to fine the relevant inputs by page location. I can and have defeated forms that tried to do all of those things very easily in the past. Keep in mind that if you randomize across a few variations (i.e. 4-5 page layouts), that's easily discerned if you pull the page source down 20-30 times, doa complex diff, scrub out obviously random strings, and check the total unique variations you're seeing. That may seem like a lot of work, but consider that if you don't do it all at once, but instead roll out small change after small change, the person or people using it are not weighing to cost to do everything required to bypass it compared to finding another open mail form, but the cost to bypass just the new fix you put in place. Also, they might think it's fun doing so... And on the site dev's side, they can just choose to outsource it to a CAPTCHA (not that there aren't services to easily bypass CAPTCHAs at scale at sub-cent per CAPTCHA rates, see https://anti-captcha.com/ https://anti-captcha.com/). Note: To forestall any assumptions, I wasn't doing any spamming or helping spamming in any way.
        T-hawk 7y ago
        You're not trying to make your site absolutely bot-proof. Someone deliberately targeting your site can figure out any such measures. (You want legitimate users to do so.) You're just trying to throw in enough friction that most common drive-by scripts won't succeed. It's a "don't have to outrun the bear" situation, make yourself just difficult enough that some easier target gets snagged instead.
        7y ago
  - mobjack 7y ago
    I really dont know how well that will work against a dedicated attacker. I am much more confident in ReCAPTCHA of stopping bots compared to any roll your own solution. I dont want to hope that an alternative is good enough for my needs. I want the best when it comes to protecting my site. Any alternative needs to have a proven track record and support to make consider replacing ReCAPTCHA.
    - deleted 7y ago
      [deleted]
    - jachee 7y ago
      How much does ReCAPTCHA's aggressively targeting non-Chrome and/or privacy-enabled browsers and making completing captchas exceedingly difficult factor in your decision? Do you want your site "protected" from those users, too?
    - briandear 7y ago
      So you force your users to consent to sharing all of their data with Google? That’ll teach ‘em.
      - sb8244 7y ago
        What's an alternative that works at scale, though? It's easy to say "this is bad for these reasons, don't use it" while ignoring that there's not really better options once you get targeted.
        sb8244 7y ago
        To clarify, I do think that this post gives good alternatives because most spam is not targeted. However, you must do something like this if you're a big site or a small site who pissed someone off
        atoav 7y ago
        The reasonable thing to do would be to initially create challanges with multiple levels/difficulties so you can quickly change the mechanism when you are really targeted. For my personal blog I managed to be spam free with a simple question/answer pair for 5 years. Took me a minute to implement and leaves my user data where it belongs.
  - charrondev 7y ago
    I was preparing a response here, but many of the other commenters have covered it. I recently spent time ensuring our Auth pages’ HTML could be easily cached outside of our application servers. They were a common target of DDOS attacks because we were generating a unique nonce for CSRF protection. Randomizing form field names does not defeat a targeted attacker (and we have definitely been a target), prevents HTML caching, and will prevent auto filling fields by browsers and password managers. Additionally it will be terrible from a usability and accessibility standpoint. It’s trivial to target a form field by the text/label around it so those would need to be randomized as well.
    - dev_dull 7y ago
      > and will prevent auto filling fields by browsers and password managers. I would MUCH prefer the recaptcha over this!
      - tinus_hn 7y ago
        Your browser probably isn’t smart enough to autofill the ‘comment’ part of a guestbook or the ‘body’ of an email.
    - DCoder 7y ago
      > Randomizing form field names […] will prevent auto filling fields by browsers and password managers. I wholly agree that this would not help, but for the sake of completeness, I want to point out that <input autocomplete=""> [0] is designed to solve this, by decoupling input field names from their intent. But Chrome is playing dumb about it [1]. And of course, the spambots will just adapt to parse the autocomplete info… [0]: https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/autocomplete https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes... [1]: https://www.reddit.com/r/programming/comments/ar1qj1/chromium_is_eroding_the_open_web_and_its_our/egl52wk/ https://www.reddit.com/r/programming/comments/ar1qj1/chromiu...
      - deleted 7y ago
        [deleted]
- PopeDotNinja 7y ago
  Please just don't use the bouncing ball that Dropbox made me use once. It was the first time my lack of athleticism prevented me from a signing in.
  - spongeb00b 7y ago
    I’ve not heard of this one before. Wouldn’t it cause serious problems for accessibility?
    - PopeDotNinja 7y ago
      Almost certainly.
  - peteretep 7y ago
    What is that? This comment is the first Google result for dropbox bouncing ball.
    - PopeDotNinja 7y ago
      I tried from finding it myself, and I've only seen it once. I was logging into Dropbox via Chrome on my Android phone, and I must have done something to trigger captcha spambot hell. I just tried triggering it again and was not able to do so. The ball had an animal in it and I was asked to bounce the ball, causing it to rotate. I had to bounce the ball with just enough force to get it to land so the animal was positioned upright. After several failed attempts, I gave up.
- buboard 7y ago
  do you eliminate all spam that way? i get signup SEO spam even with recaptcha & stopforumspam.
  - charrondev 7y ago
    No it does not. Some creeps through the registration system, which is why we have additional trust measures afterwards. On my own site I see 1 or 2 spam posts a week although I get the feeling it’s real people doing the registration. They sign up, make 1 comment, get reported very quickly, then banned. We haven’t had to make our signup/registration system that strong in of itself though, because most of our largest clients end up using some SSO method exclusively and will have their own prevention methods.
savrajsingh 7y ago
That is smart
deleted 7y ago
[deleted]
netok 7y ago
It will also ignore people who use browser's autofill form function. Realized this after receiving a dozen complaints.
- mattigames 7y ago
  You can randomly generate the "name" of the fields and autofill will never fill them, another option to disable autocomplete is to leave them without "name" and handling the submit using JavaScript.
  - smt88 7y ago
    Disabling autocomplete is user-hostile and additionally should be considered a security flaw. It makes it harder to use password managers.
    - analogmemory 7y ago
      You can disable a single input field from autocomplete `autocomplete="off"`
      - fybe 7y ago
        'Autocomplete' doesn't work for Firefox (since version 38), Google Chrome (since 34), and Internet Explorer (since version 11 Huge pain
        analogmemory 7y ago
        This totally works in latest Chrome/FF/Safari https://codesandbox.io/s/static-jkvzs https://codesandbox.io/s/static-jkvzs https://jkvzs.codesandbox.io/ https://jkvzs.codesandbox.io/ The other trick is to add a random string/number in from of the name attribute e.g. name="348349_name". This prevents autofill. Interestingly 1Password and LastPass are smart enough to infer that it's a name or email field. For the honeypot, random number + word makes it ignored by autofill/1password
GordonS 7y ago
I did this years ago, it expecting it to work - but there hasn't been a single form spam since! I'm sure this won't work for everyone, but if your small, I highly recommend giving it a go.
tutanchamun 7y ago
Yeah, these honeypotts work quite well, however the last time I looked into it (circa 2012) I read that it is not ideal for visually impaired users with screen readers.
- jrphenow 7y ago
  I forget everything that you need to do, but I believe I read that there's a happy medium you can strike such that a script would still input data but it wouldn't be shown to a screen reader.
darekkay 7y ago
This field will also been available for all screen reader users. It's important to add an adequate label ("Please do not fill out this field" or similar).
dasanman 7y ago
We used to this, does not seem to work at all these days anymore
UncleMeat 7y ago
Now your site is terrible for blind people.

deleted 7y ago

[deleted]

atoav 7y ago

I used 5 randomly choosen english questions with easy answers my readers would know — this prevented literally 100% of the unwanted spam, while it was easy on the users. If you want to filter comments you could even make the questions reflect the content of the article, filtering uninformed TL;DR type of comments and giving the users the feeling you value onformed opinions.

alkonaut 7y ago
I once used a form with a random math question: 7+2 = __ It prevented 100% of bot spam for years. Granted, I was never a big enough target to make anyone rewrite their bot, but that's the same for most of us. I'd never use a captcha so long as something trivial like that works 100%.
Tepix 7y ago
This (or something very similar) is a core feature of phpBB: https://www.phpbb.com/support/docs/en/3.2/kb/article/how-to-configure-q%2Ba-captcha/ https://www.phpbb.com/support/docs/en/3.2/kb/article/how-to-... It works very well.

nprateem 7y ago

I've got some web sites that use javascript to submit a form to an API gateway endpoint which then uses SES to send me an email. I get absolutely zero spam from any of them. I think the vast majority of spammers use non-javascript tools and that recaptcha is unnecessary for most low-profile sites if they'd just use javascript to POST the data instead.

Ntrails 7y ago

A forum I post on has zero restrictions on sign up. No recaptchas, nothing. Couple of times a month we see some (usually Cyrillic) bot post some thread with a link that (probably) no one clicks and we all have a laugh and tell it to post more (it never does). It's a small site, footfall in the 10s, so maybe that's the reason.

hadrien01 7y ago
We've blocked cyrillic characters on a contact form, and we went from hundreds of spam messages every day to less than one a month.

alibarber 7y ago

I have next to zero experience in this, but completely agree. Literally 'my first website' I made when I was a kid that had a very basic guestbook that I put together in php (actually it may have even been perl)/mysql got hit with random spam. Everything was something completely custom that I had made and not some package that may have had a common vulnerability - so there was and must still be stuff crawling the web looking for any kind of form to push junk into. In this case it was clearly trying to do some spam 'SEO'/keyword stuffing, because the page would display the static text (I was smart enough to filter out HTML though)...

konradb 7y ago
I must lack imagination! I cannot figure out what the ROI is if one codes stuff to randomly submit crap to forms.