captcha for registration

[pypingou]

I believe we may want to add some captcha or equivalent to the registration page to prevent script kitty to automate the process.

Note that email validation is not enough, a number of services on the internet offer throw-away mailbox that are basically only valid for the duration of your browser's session (or a few minutes/hours).

[abompard]

We need to think about the best way to do that (while staying privacy concious)

[nirik]

Yeah, do note that reCapcha is not at all free. :(

in fas we had a seperate app called 'basset' that did checking on new users, perhaps we want to look at adding in that functionality? It basically looked at spam/nonspam users and tried to 'guess' if a new account is a spam one based on all the info it had.

[abompard]

Yes, integrating with Basset has been our longest running needinfo ticket: #27. If you have any idea on how we could do that, I'm very interested.

[pypingou]

in fas we had a seperate app called 'basset' that did checking on new users, perhaps we want to look at adding in that functionality? It basically looked at spam/nonspam users and tried to 'guess' if a new account is a spam one based on all the info it had.

In FAS basset was ran once the account was created, FAS has its own captcha on the top of it :) (Basset was added because the captcha wasn't enough though)

[abompard]

Possible candidate library: https://github.com/Tethik/flask-session-captcha

[bkmgit]

There are some other options for example:

• https://github.com/dtschump/CImg/blob/master/examples/captcha.cpp
• https://github.com/ArgoZhang/SliderCaptcha
• https://github.com/fvitas/slider-anti-captcha

While not open source, Keycaptcha is fun https://www.keycaptcha.com/ and one could possibly implement something like this.

Overview of captcha advantages and disadvantages: https://www.w3.org/WAI/GL/wiki/Captcha_Alternatives_and_thoughts