Captcha - To Use Or Not To Use

[ralph.m]

they can have the Captcha read out the letters

But have you ever tried that? It's like listening to an announcement over a PA system at a train station—i.e. muffled and incomprehensible.

[Stevie D]

I was under the assumption most Captcha's now a days have a read out feature. So as long as those you have issues can hear, they can have the Captcha read out the letters or phrase to them.

As Ralph says, the audio versions are little better. And sometimes I don't want noise. My computer at work doesn't have sound, and even if it did, I wouldn't want to have the sound on when other people were working. Likewise if I'm on a train or in another public place, or watching TV at the same time, or anything like that ... sounds gets very irritating.

[Cmarenburg]

Wow i never thought about doing anything like this! But i love it!! Captchas make me mad as i can be. Mostly because i can not read them! I am going to use this idea for any forms that public can access.

Not to hijack, one way i used to do is was make a hidden field it was named something like "spam" and it would be an input field. I would check to see what the length of that field was in the PHP script and if there was text in it i presumed it was a bot and the form did not finish and displayed a error message. Weather this helped or not i am not sure.

[ralph.m]

one way i used to do is was make a hidden field it was named something like "spam" and it would be an input field. I would check to see what the length of that field was in the PHP script and if there was text in it i presumed it was a bot and the form did not finish and displayed a error message. Weather this helped or not i am not sure.

Yes, that sounds like the "honeypot" method mentioned above. The only problem with it is that it may not be hidden for all users, so you have to warn them somehow—either with a label saying "don't fill this in" or by offering an answer they can type in.

[cgCody]

I recently had to digitally sign some paperwork on a website by literally drawing my signature in a field with my mouse. I know, what a PITA.

However, how does that sound as an alternative? Require a user to scribble anything into a field, using their mouse or arrow keys. A spam bot wouldn't understand the concept of drawing... yet.

EDIT: taking that concept even further, what about simply monitoring cursor movement and/or page scroll? Any type of movement within the page can be assumed human.

[ralph.m]

Require a user to scribble anything into a field, using their mouse or arrow keys.

Sound interesting, but my problem with that is it means hassling legitimate posters too, which I don't like. I don't like being put through the hoops just because there are @ssholes out there (like at airports, where you have to put up with being studied in the nude now. ). I'd prefer a solution that snags the miscreants but leaves me alone.

what about simply monitoring cursor movement and/or page scroll?

You'd have to make sure it accounts for users such as those with screen readers.

[cgCody]

Very true. I've been pondering that issue. Still, those using a screen reader must still interact (using the keyboard or voice) with content within a browser, such as changing the focus in a decidedly human manner.

As a partial alternative, you could go ahead and monitor cursor movement. Any humans not using a screen reader get a free pass. Bots and - unfortunately - those using a screen reader, or not using their mouse will have to deal with a manual captcha.

[TechnoBear]

Bots and - unfortunately - those using a screen reader, or not using their mouse will have to deal with a manual captcha.

Hmm ... I generally tab through forms because I have some co-ordination problems and it's easier than using a mouse. My elderly friend does the same, because fine movements are difficult with arthritis. And we both struggle with Captcha, although for slightly different reasons. So I suspect that approach may end up penalising the folk who already have the most difficulty with forms.

[microarm]

"Captcha keeps Spammers Away" Hehe Use it in your own advantage. If you don't use it expect spams on your mails.

[ServerStorm]

If it is a database application then just insert a minimum time into a spammer_catch table that matches their PHP Session variable. Even if they have cookies turned off the Session will be written to their URL. Then when the page is posted test if the time matching their session is long enough for a fast human typist, if the time is ok then let them through otherwise stop their attempt. On top of this log how many times they try; if only a few then ok but if hundreds or thousands then try to block their I.P. and SESSION.

You could also not use the DB and instead just write the time to the user's session.

This approach does not bother human typists, people using screen reader or have other accessibility challenges and does not matter if Javascript is on or off, or like I mentioned if cookies are shut off. However this will not work for a non-dynamic HTML only site, PHP or ASP.NET, or Java would need to also be used.

IMHO CAPTCHAS cause way too many troubles for end-users.

Steve