reCaptcha

[fisharebest]

Investigate the use of reCaptcha for new registrations and messages from visitors.

[Amgine0]

Optional, modular, allowing alternative solutions. (e.g. Google's reCaptcha does not allow TOR exit IP to solve the puzzle, and sometimes does not allow non-js browsers either.)

reCaptcha also involuntarily supports Google's book scanning project; by loading the captcha user's resources have been used to support a commercial endeavour without opt-in. TAANSTAAFL.

[fisharebest]

reCaptcha also involuntarily supports Google's book scanning project

The "old" recaptcha did this. The "new" one simply asks you to tick a box.

However, I agree that Google already has too much data on us.

does not allow non-js browsers either

I am less concerned with this. There are very few modern websites that will run without javascript.

We could create our own version of reCaptcha. It won't (can't?) work against a targetted attack, but should be good enough to block automated scanners / spambots.

http://uxmovement.com/forms/captchas-vs-spambots-why-the-slider-captcha-wins/

I like the slider.

[Amgine0]

The current reCaptcha is supporting the google maps databases, although admittedly it's in the massive redundancy checking.

According to my logs across my top 8 sites, about 92% of the visitors do not have java enabled or are selectively blocking piwik javascripts. (More than half of those are spiders, but the other 40% or so are probably humans.) Since a large chunk of them are Firefox on Windows with exactly the same screen resolution but from all over the world, my guess is a bunch of them are using TOR browser bundle.

And I use slider captcha. I actually prefer the 'pick the kitties' type image processing, but obviously this will eventually be overcome (e.g. "Select images with street signs" to help google's autonomous car effort.)

[exxamalte]

One alternative I'd like to recommend is visualCaptcha, a nice simple visual captcha library with audio fall-back for accessibility, self-contained/self-hosted, i.e. does not depend on availability of a third-party service, open source, and supports PHP in the backend. I once integrated this library into a node.js project, and that went quite well.

[allendex]

As a disabled user recaptcha and those captcha programs cause me a lot of grief. IF this is implemented I would much prefer that the option to turn it on or off be in the config.

[fisharebest]

Until we get reports of significant numbers of spam registrations/messages, I am going to put this one on hold.