4 ms·

This stuff kind of seems like an overkill to me. I think asking really simple questions that only a human could understand seems to get the job done most of th

This stuff kind of seems like an overkill to me. I think asking really simple questions that only a human could understand seems to get the job done most of the time. Perhaps something like: "What is the opposite of bad?" or "How many planet Earths are there?" I've used things like this for a handful of projects and have never had any problems: https://github.com/kiskolabs/humanizer https://github.com/kiskolabs/humanizer

SwellJoe 12y ago
That works on a small scale. But, when your site gets enough visitors, it is worth it to a spammer to spend five, or ten, or fifteen, minutes figuring out all of your questions. So, it's a potentially useful trick for sites only targeted by very dumb bots. But, the bigger your site, the less likely it is to work. My sites aren't even that big (anywhere from 40k to 250k visits per month), and this technique isn't tenable for most of them. I do use it on our wiki (mostly as an experiment, since CAPTCHA isn't as accessible as I'd like), which is the 40k visits/month site, and it needs new questions every couple of weeks, or we get hammered. And, all of our sites have other mechanisms for preventing spam, as well.
mavick 12y ago
It varies greatly on the project you're working on. There are people out there trying to automate account creation on web based email's for the sole purpose of email spamming (same with social networks). And with complex botnet proxies and the TOR project, false accounts are getting harder to detect. They have created interesting methods to combat Captcha images. They even have outsourced OCR services, where people in other countries are paid to solve ocr 1 image at a time. [0] [0] http://deathbycaptcha.com http://deathbycaptcha.com
fletchowns 12y ago
That type of solution really breaks down once you have a big enough target on your back for the botters to go after you. What is the most widely used project you have successfully used it on?
- Scorponok 12y ago
  Yeah, we tried this on our product forums and it didn't really help at all. :(
alex_duf 12y ago
Well, we'll get there pretty soon : http://www.wolframalpha.com/input/?i=What+is+the+opposite+of+bad+%3F http://www.wolframalpha.com/input/?i=What+is+the+opposite+of...
fear91 12y ago
There's an annual contest for spam community. It's organized by Botmaster, the producent of Xrumer software. Basically, whoever answers most of these questions correctly, earns $15,000. People submit MILLIONS of answers. This list is then incorporated into the Xrumer itself. I can tell you that these things are easily broken: a) Answering questions and building global list of answers, as in this case. b) Reading image captcha - spammers send it to Pakistani manual solvers for dirt cheap. c) More complex puzzle captchas can also be broken in software if a lot of websites implement them. What works the best is using non standard html form field names. Also, try to not use text labels for the fields ( no "password", "captcha" etc. ) - because the software will try to match the best field by text surrounding it. It is better to use image for labels. This solution will stop spambots because they simply match form field names. Unless someone specifically targets your website, in which case there's not much you can do. From the most common of captchas, Mollom seemed to be the biggest pain in the ass for spammers. Mainly because it banned suspicious IPs ( you could solve the picture correctly and it wouldn't authorize it. )
- minikites 12y ago
  > What works the best is using non standard html form field names. Also, try to not use text labels for the fields ( no "password", "captcha" etc. ) - because the software will try to match the best field by text surrounding it. It is better to use image for labels. Except browser autofill breaks and anyone who needs a screen reader will go elsewhere if the screen reader can't parse the images.
- umurkontaci 12y ago
  There is better solution: http://xkcd.com/810/ http://xkcd.com/810/
comex 12y ago
> "How many planet Earths are there?" "Either one or probably infinity, depending on whether the universe is infinitely sized and whether unobservable parts of it are considered to 'exist'."
- ceejayoz 12y ago
  Zero is also a potential option, if we're running in some alien teenager's version of The Sims.
imaginenore 12y ago
It doesn't work. All you have to do is solve 1% of these questions manually, and voila, you got a bot that can spam, all it has to do is load the captcha 100 times on average. That's the hard thing about captchas, bots don't have to solve them perfectly to completely break them.

SwellJoe 12y ago

That works on a small scale. But, when your site gets enough visitors, it is worth it to a spammer to spend five, or ten, or fifteen, minutes figuring out all of your questions. So, it's a potentially useful trick for sites only targeted by very dumb bots. But, the bigger your site, the less likely it is to work. My sites aren't even that big (anywhere from 40k to 250k visits per month), and this technique isn't tenable for most of them. I do use it on our wiki (mostly as an experiment, since CAPTCHA isn't as accessible as I'd like), which is the 40k visits/month site, and it needs new questions every couple of weeks, or we get hammered. And, all of our sites have other mechanisms for preventing spam, as well.

mavick 12y ago

It varies greatly on the project you're working on. There are people out there trying to automate account creation on web based email's for the sole purpose of email spamming (same with social networks). And with complex botnet proxies and the TOR project, false accounts are getting harder to detect. They have created interesting methods to combat Captcha images. They even have outsourced OCR services, where people in other countries are paid to solve ocr 1 image at a time. [0] [0] http://deathbycaptcha.com http://deathbycaptcha.com

fletchowns 12y ago

That type of solution really breaks down once you have a big enough target on your back for the botters to go after you. What is the most widely used project you have successfully used it on?

Scorponok 12y ago
Yeah, we tried this on our product forums and it didn't really help at all. :(

alex_duf 12y ago

Well, we'll get there pretty soon : http://www.wolframalpha.com/input/?i=What+is+the+opposite+of+bad+%3F http://www.wolframalpha.com/input/?i=What+is+the+opposite+of...

fear91 12y ago

There's an annual contest for spam community. It's organized by Botmaster, the producent of Xrumer software. Basically, whoever answers most of these questions correctly, earns $15,000. People submit MILLIONS of answers. This list is then incorporated into the Xrumer itself. I can tell you that these things are easily broken: a) Answering questions and building global list of answers, as in this case. b) Reading image captcha - spammers send it to Pakistani manual solvers for dirt cheap. c) More complex puzzle captchas can also be broken in software if a lot of websites implement them. What works the best is using non standard html form field names. Also, try to not use text labels for the fields ( no "password", "captcha" etc. ) - because the software will try to match the best field by text surrounding it. It is better to use image for labels. This solution will stop spambots because they simply match form field names. Unless someone specifically targets your website, in which case there's not much you can do. From the most common of captchas, Mollom seemed to be the biggest pain in the ass for spammers. Mainly because it banned suspicious IPs ( you could solve the picture correctly and it wouldn't authorize it. )

minikites 12y ago
> What works the best is using non standard html form field names. Also, try to not use text labels for the fields ( no "password", "captcha" etc. ) - because the software will try to match the best field by text surrounding it. It is better to use image for labels. Except browser autofill breaks and anyone who needs a screen reader will go elsewhere if the screen reader can't parse the images.
umurkontaci 12y ago
There is better solution: http://xkcd.com/810/ http://xkcd.com/810/

comex 12y ago

> "How many planet Earths are there?" "Either one or probably infinity, depending on whether the universe is infinitely sized and whether unobservable parts of it are considered to 'exist'."

ceejayoz 12y ago
Zero is also a potential option, if we're running in some alien teenager's version of The Sims.

imaginenore 12y ago

It doesn't work. All you have to do is solve 1% of these questions manually, and voila, you got a bot that can spam, all it has to do is load the captcha 100 times on average. That's the hard thing about captchas, bots don't have to solve them perfectly to completely break them.