Hardening CAPTCHA

[Arantor]

http://www.simplemachines.org/community/index.php?topic=290610.0 http://dev.simplemachines.org/mantis/view.php?id=3022

Even for accessibility reasons the user cannot read the captcha, they can request a new version of the image.

In addition allowing the user unlimited requests of new images surely gives the spammer the chance to request enough images to be 100% certain of each captcha code.

Suggestions: 1) On ONE failed captcha, NEW image code 2) On THREE requests for 'new captcha image', NEW image code.

Whilst it might take some coding/time to get this done, I feel both of these measures are needed quickly by smf forums, as the spammers continue to take over.

[Xarcell]

I'm against captcha altogether. All it does is make it harder for the human, not the bots. I say rip the whole damn thing out, and create a mod from it(or use recaptcha).

A javascript checkbox is more effective than the captcha, why not use that instead? Even randomized are you human questions seem to be more effective.

[XinYenFon]

recaptcha already hacked... so it has no use but extra load. You are not thinking as general, we all dislike IE8 but we have to support it because our core product must be useable by general users, we have visually impaired users. :)

[Xarcell]

@Antes I don't understand what ditching captcha had to do with impaired user's? Maybe I'm just misunderstanding you. I know recaptcha has already been cracked, I was just throwing that out there if a developer was too lazy to convert the current captcha to a mod. Recaptcha does support the visually impaired though.

[XinYenFon]

I was actually said that against using JS Checkboxes, as you know SMF also has questions in core against spam and it does very good job, general usage problems is also the base of that feature never become core-enabled (also questions needs to be different :P)

About recaptcha, we already have captcha system working as it needs to be, why should we spend some time on converting it something else already cracked/hacked ? :)

[Xarcell]

@Antes I wasn't suggesting converting to recaptcha. I was suggestion removing SMF catpcha and making it a mod. If the developer ripped out captcha, but was too lazy to turn it into an official mod, then use recpatcha(mod may be easy to make). FYI, SMF captcha has been cracked also.

As far as the JS checkbox, how does a visually impaired handle input fields anyway? What would be so different about it? The only problem I see here is those that have JS turned off, but that's a easy work-around.

[Arantor]

If CAPTCHA was removed, that would leave forums near enough completely defenceless again spam by default. As opposed to mostly defenceless. Even if it stops a single spam bot, it's done its job.

The JS checkbox is not really an option because one of the criteria is as much as possible should work with JS disabled. And you don't win anything from it because once you go mainstream, the bots will simply adapt around it because it's worth doing for them.

Visually impaired users are shown input fields (it would be... interesting... for them to try to use a forum if they could not)

[Xarcell]

I know it's not plausible to remove captcha for SMF. I was just saying "if it were me", because the way I see it is that if captcha turns 3 human users away, and only stops one spam bot, it has NOT done it's job. Just my opinion, and we can leave it at that.

[rogledi]

hi guys, you raised an important issue here. But the solution you're searching for does already exist. Have a look at keypic.com - it's a user verification method without CAPTCHAs which is good for visually impared as it doesn't require any action from the user. The verification is invisible for users! A really cool technology worth attention

[butchs]

Yea, as far as I can tell, I was the first to do that type of thing. I did it years ago with FF. I made it simpler and took it farther.

I tried to add a few things here to move in that direction (before my computer was obsolete for GH). But I was shot down.

[MissAllSunday]

Depending on third party sites is something SMF isn't very fond of for a myriad of reasons so I don't see that happening.

With that been said, the features that site offers are pretty much the same as any other spam protection sites, a check on an external spammer DB.