When is it necessary to implement a form of CAPTCHA?

[TantekHack]

I am building some simple contact forms and was wondering if there was a general rule for knowing when you should implement some form of CAPTCHA process to keep the bots from filling out the forms and submitting? What are the chances that spam bots would submit a contact form? Thanks.

[Mandes]

If your going to publish your site and link it to the googles of the world you will get your first bot spam shortly afterwards, however if your contact form is hidden behind secure access area, no need to bother.

Its not difficult to put one on, and it worth the extra hassle now rather than later.

[brothercake]

I disagree - CAPTCHA should not be used, because it blocks out a proportion of legitimate users (anyone who can't see it!). Even an audio alternative doesn't solve this problem, because that assumes that the user can hear and has a computer that can make sound.

Having said that ... I'm afraid I don't have a concrete alternative to offer. The best idea I've seen is Eric Meyer's "Gatekeeper" - http://meyerweb.com/eric/thoughts/20...wp-gatekeeper/

[Mandes]

I think your disagreement would be highly dependant on the content of the site. But I take your point of view

[brothercake]

Why dependent on the content?

[Bill Palmer]

Originally Posted by brothercake

Why dependent on the content?

A site catering to teenagers will probably have less people NOT capable of reading a captcha than a site catering to retirees/the elderly.

Not sure if that's what he meant, but that's what I got out of it.

[brothercake]

So there are no teenagers in the world who are blind or have a vision impairment ..?

[Bill Palmer]

Originally Posted by brothercake

So there are no teenagers in the world who are blind or have a vision impairment ..?

will probably have less

Stop seeing what you want to see.

[Mandes]

Originally Posted by brothercake

Why dependent on the content?

If the site is an information site whose content can be parsed by a text reader then yes I agree using a captcha would not be ideal, however if the site relies heavily on jS, Flash and images to make its content viewable then I see no problem with the use of captcha.

For example a gaming site is unlikely to attract persons using a textonly browser, (does anyone still actually use these anyway ??) or requiring the use of a textreading browser.

[brothercake]

Originally Posted by Mandes

if the site relies heavily on jS, Flash and images to make its content viewable.

If the site relies on those things, then it's a badly made and inaccessible site

Originally Posted by Mandes

(does anyone still actually use these anyway ??)

Yes they do; and mobile browsers are often of a comparable spec.

But that's not the point - I'm not talking about browsers that can't parse images, I'm talking about people who can't see. For example, a blind user using JAWS is also using Internet Explorer - a JS capable, graphical browser; but they still can't see your CAPTCHA, or interact with a lot of complex scripting.

[Mandes]

Originally Posted by brothercake

.............. but they still can't see your CAPTCHA, or interact with a lot of complex scripting.

Exactly, which was why I said it depends on the content of the site and therefore the expected target audience. As an extreme example somebody that cant see is hardly likely to want to fill in a form on a site that sells flying lessons.

I understand your point of view, and its an important one, but I'm not prepared to get into a discussion here on the php forum on accessibillty issues.

[mrwooster]

Originally Posted by brothercake

I disagree - CAPTCHA should not be used, because it blocks out a proportion of legitimate users (anyone who can't see it!). Even an audio alternative doesn't solve this problem, because that assumes that the user can hear and has a computer that can make sound.

You say that captchas should not be used because some people can't see them, but the alternative that you suggsted also relies on people being able to see.

I am very much in favour of making the web more accessible to everyone, but I think captchas serve their purpose well, and I think that it is reasonable to assume that anyone who has a sight problem will have the sound turned on on their computer as they will most probably have software to read them text.


Regards

Guy

[brothercake]

Originally Posted by mrwooster

You say that captchas should not be used because some people can't see them, but the alternative that you suggsted also relies on people being able to see.

No it doesn't - the alternative I suggest is based on text and a form - it's perfectly accessible to assistive technologies. It may be problematic for someone with a cognitive disability, and that's why it's not a perfect solution; but there's no problem for blind or partially-sighted users.

Originally Posted by mrwooster

I think that it is reasonable to assume that anyone who has a sight problem will have the sound turned on on their computer as they will most probably have software to read them text.

Well that's where we disagree - it is not reasonable to assume anything at all. Not everyone with a sight problem uses reading software. Heck, I have 20-20 vision, and I have difficulty reading CAPTCHAS.

To say that you're "very much in favour" of making the web more accessible is a cop-out if you're not prepared to see that through to its logical conclusion - it pays lip service to the idea of accessibility, without being prepared to do what's necessary. If the web is not accessible, it's broken, because technology is the last bastion of accessibility; it's not like physical accessibility where there are tangible reasons why some kinds of access are impossible - with technology, there is no good reason, only excuses.

Originally Posted by Mandes

I understand your point of view, and its an important one, but I'm not prepared to get into a discussion here on the php forum on accessibillty issues.

Well maybe you should be As a PHP developer you can't just hide on the server and disregard the client - what you produce has a client-side, and you need to consider that. I don't care how difficult or inconvenient it is - that's our problem - and CAPTCHAs, just like anti-spam opt-in systems, are unfair - they force users to take responsibility for our problem.

What really matters is what the client gets, and making it easy for them, because that's what we do all this for.

[mrwooster]

BTW: I have just noticed that php.net use the technology suggested by brothercake, when you want to write a comment, you are asked to do a simple arithmetic sum.