I want to keep the forms short, without the CAPTCHA. And, with some tricks, like checking server headers, I was able to control the spammers.
Now a days, I find that spammers are researching my sites. Through several attempts, they have now specialized in cracking the systems. For example, the team at 213(.)5(.)71(.)86 is dedicated to crack my sites. I just don’t like to black list their IP because, some day, it could be a legitimate user. And it is not possible to add all spammers IPs in the blacklist.
I would like to discuss here some advanced ways to protect the pages without CAPTCHA and pick your ideas to come up with a really strong method.
My latest model was using js/css/php/html for this.
pre-populate the “email” element with some dummy email address. Use a different name to collect the real email address.
Hide the element with css.
Using a javascript to remove it once the page is loaded.
Checking back if $_POST[‘email’] has some contents.
Checking Headers back (This was broken)
I am safe at the moment now.
If not they can break this automatically through their crawlers, I am sure any of the spammers team will be researching to crack my websites - because they know - if they are successful in doing so, they can send hundreds of emails within my networks, for free.
Exactly what I would recommend, it’s basically a turning test, you ask a question that only a human would be able to answer (rather than providing a math expression like 4+1 or a “what is this text” CAPTCHA which can be recognised). You could have (for example) a picture of an animal (or several on rotation) and ask people to identify the animal (by writing it’s name in a box), that’s what many CAPTCHA’s are leaning towards these days.
I would just like to avoid any kinds of captcha and security passes - so the page visitor does not fill answers to them. In fact, there will be no challenge question in any way. But yet, I want to secure the form filling process, if possible.
I am working on this, and need to collect your ideas.
I think the most secure method to not receive spam messages is to use some CAPTCHA characteristic. I think it shouldn’t be deformed letters and numbers, this is two old and bothersome. The best way is to have to write a word that is given, but written clearly, or something like this. What day comes after Sunday, which is the first month of the year, what number comes after 5…
I was thinking another thing you could do - if your site isn’t “global” and if you dare to implement it - is to only have the form available within a limited time frame. eg. Monday through Friday, 10AM through 3 PM
Kind of like “brick and mortar” reception desk hours. Find out when your legitimate users are most likely to use the form vs. when the SPAM bots are most likely to hit.
@Mittineague
I can check that with Apache’s log - and open the form for a particular time frame, Limited but good idea.
@Alexa12345
I want to assume, everything the user inputs is legal. Thia means he user has only one chance to fill up the form. So, if the form data is correct, and only captcha is incorrect, it is not good to ask for the captcha again.
If I receive more attacks, I must activate captcha again.
I don’t think there is any ‘silver bullet’ solution to this… I think any solution that is secure enough is going to have to involve interaction from the user somehow.
What some sites do is add a simple question. For example, “what number comes after four?”, if the user is a human, they will fill out “five”
Spammers who are so interested in a site that they research it will simply move over to a cheap mechanical Turk or the pr0n version (thus getting real humans to answer the questions for the spambots).
I’m surprised no-one brought it up already. Some nice ideas in there to secure your form without inconveniencing your viewers, or giving them another step.
I’ve used some of these ideas on my newer sites and no problems so far.
Spam solutions I’ve deployed in the past have been of the variety Spam Karma employs - timing how fast the form was filled out (you did the vbulletin user registration in .2 seconds – yeah, right), bayesian filtering ( viagra, v1agra, v!agra). I’ve backed off of blacklisting since spammers sometimes don’t use a domain name for more than a few days so it’s ultimately pointless.
If it’s using something like a comment form, I find Akismet works extremely well. Combined with a dummy “email” field (hidden with CSS, but not removed with JS), it catches 99.9% of the spam, with no false positives, in over 10,000 items.
I’ve had luck with simply asking an easy question that can be checked. Just ask users “What color is the sky?” and you could make a side note that the field is just to help prevent spam.
I created a game and I had problems with people using auto clickers, I personally hate CAPTCHA so I created a stress level for the players, simply if they click too much, the stress level will make them pass out in the game, no being able to play for hours.
This wont be annoying for normal players, but auto clickers will pass out
What you could use, is maybe giving your users ability to mail 1 time a day, for new users. Once they been on your site for some time this limit could increase.
