3 ms·

Instead of captchas, which I can't stand doing myself and didn't want to impose on my site users, I implemented a three-pass filter for anonymous comments: 1.

Instead of captchas, which I can't stand doing myself and didn't want to impose on my site users, I implemented a three-pass filter for anonymous comments: 1. Answer a simple math question (e.g. "What do you get if you multiply 5 by 1?"). 2. Hidden form field that is supposed to stay empty. 3. Spam word filter ("cialis", "levitra", etc.). After I put this in place a couple of years ago, the daily number of spam comments my site got dropped from 200 to zero. I was worried that it wouldn't last, but to this day I've only had to delete about five spam comments in total - and they were posted in registered user accounts.

terryjsmith 17y ago
We did this with a PHPBB install (which are awful for spam). We added one custom question to the registration (check this box if you're not human) and we instantly got rid of 99.9 percent of our bot spam problems.
- dmoney 17y ago
  I wonder how many humans you lose that way.
po 17y ago
If you have a high-value site, none of those will work. By making your form different than the masses, you've protected yourself from common attacks. Diversity is good. However, if you are implementing a sign-up form for an email service there really isn't a great way to detect fraudulent signups without using a captcha. That being said, the end game is that the bots will be able to detect anything a human can. Already, they can detect better than elderly or disabled humans. The path to take in this is to get better at automatically detecting behavior we don't want (wether via human or bot) and to block or delete it.
- Retric 17y ago
  I think the simplest solution is adding your phone number and have the website call you back with the first password. Granted it's not anonymous for the user and not free for the website. You would still need to ban accounts that generated spam, but that now becomes a useful tool. PS: Runs to the patent office...

terryjsmith 17y ago

We did this with a PHPBB install (which are awful for spam). We added one custom question to the registration (check this box if you're not human) and we instantly got rid of 99.9 percent of our bot spam problems.

dmoney 17y ago
I wonder how many humans you lose that way.

po 17y ago

If you have a high-value site, none of those will work. By making your form different than the masses, you've protected yourself from common attacks. Diversity is good. However, if you are implementing a sign-up form for an email service there really isn't a great way to detect fraudulent signups without using a captcha. That being said, the end game is that the bots will be able to detect anything a human can. Already, they can detect better than elderly or disabled humans. The path to take in this is to get better at automatically detecting behavior we don't want (wether via human or bot) and to block or delete it.

Retric 17y ago
I think the simplest solution is adding your phone number and have the website call you back with the first password. Granted it's not anonymous for the user and not free for the website. You would still need to ban accounts that generated spam, but that now becomes a useful tool. PS: Runs to the patent office...