How to Prevent Form Spam Without Captchas 272
UnderAttack writes "Spam submitted to web contact forms and forums continues to be a huge problem. The standard way out is the use of captchas. However, captchas can be hard to read even for humans. And if implemented wrong, they will be read by the bots. The SANS Internet Storm Center covers a nice set of alternatives to captchas. For example, the use of style sheets to hide certain form fields from humans, but make them 'attractive' to bots. The idea of these methods is to increase the work a spammer has to do to spam the form without inconveniencing regular users."
And how... (Score:5, Interesting)
Now, lets enter US law: American with Disabilities Act. Target [arstechnica.com] is currently being sued for NOT complying with this federal law. I can understand why businesses would be required for this, but where will the net-boundaries stop?
For example, I have a US corp. I hire an offshore datacenter to handle web processing. Is my website have the compulsory ADA lawss upon it, or do they not apply due to international boundaries? Yipe.
Re: (Score:2)
Click this button, listen to the sound, and then choose the selection what the sound was.
Like birds chirping, babies crying, piano playing and maybe other familiar sound effects that you would choose from a multiple choice list.
Of course if the user is deaf and blind, I'm not sure how they are using a computer to begin with.
Re: (Score:2)
braille display [deafblind.com]
Re: (Score:2)
Re: (Score:2, Flamebait)
Perhaps the vision impaired should just learn to live withing their disabilites and accept the fact that not everything is going to be availiable to them. Harsh, yes but its life. Making resonable requests to accomidate them is one thing but making people liable under law for not is something else.
Re: (Score:2)
Most disabled people accept thier limitations and aren't imposing about it.
Re: (Score:2, Interesting)
Re: (Score:2)
"Of course if the user is deaf and blind, I'm not sure how they are using a computer to begin with."
Pinball [geocities.com] interface.
Let them handle the spammers first! (Score:2)
Well, that's nice then...
Re: (Score:2)
Or actualy listening to the horibly mangled english that is a 419 email.
Re: (Score:2)
I did some research on COPPA at the time because I worked on a kid's web site, and I called the agency that administrated it. They told me that any time I was collecting information from people within the US, no matter where I, the website, or my company was set up, the law affected me.
Re: (Score:3, Insightful)
So? Just put a phone number on the site with a "If you are disabled and can't use our captcha, please call our tech support and we'll set up an account."
Re: (Score:2)
And about the US laws... Im sure disability-discrimination laws exist in the European Union too. ADA is what law Im familiar with.
Re: (Score:2)
Re: (Score:2)
If I dont get inside, MOMun and POPun will kick my ASSun.
(true, i concede that --un is stupid)
Re: (Score:2)
And yes, the EU has even more stringent accessability requirements. Some ADA-bashers might have a point, but pretty much all the ones here and most other places are just trolling anyway.
Re: (Score:2, Informative)
Yes, there are accessibility laws [w3.org] in countries all over the world.
Re:And how... (Score:4, Insightful)
That said, ADA's can go fuck themselves. I can see making exceptions for EMPLOYEES but why would I have to go out of my way to help customers? What if it's simply not cost effective? If it costs millions to placate the handful of noisemakers is it worth the effort?
Being blind really has to suck. And *I DO* wish that companies would help them out. I don't think we should force them though as it can lead to smaller companies who can't afford to deal with it going out of business.
Sure, our websites would then be ADA compliant, but there would only be a handful of mega-corp websites at that point. So you're trading what little free market economy we have left to placate special interest groups.
Frankly, if I were blind I'd make due and where I couldn't I'd rely on friends or family. No shame in asking a family member to order something from a website for you. Granted "disabled" folk want their independence, they also have to be practical about it....
Tom
Re:And how... (Score:5, Funny)
Indeed. I would miss the self-righteous off-the-mark diatribes about how we should run our country. I wouldn't be able to get my daily fill of hubris from people who think they are superior in every way. I don't know what I would do.
Re: (Score:3, Informative)
Mods: go nuts! I have karma to burn, bitches.
Re: (Score:2, Insightful)
This isn't an America vs. the world issue. All I was saying is that non-Americans bring a different point of view to the table.
If you can't tolerate another point of view, then you can just go on being a xenophobic, ignorant, sheltered, small minded individual. e.g., the typical american.
Tom
Re:And how... (Score:5, Insightful)
Adding ADA compatible facilities and also making sure you're compliant costs money that most small companies don't have to spend. Given that it's to cater to a SMALLER market segment it's not good business sense to do it.
And why should disabled people not expect to be 100% independent? Because majority rules. Sorry dude. Why should I cripple my business so you can read my literature? You don't have a right to be my customer. You have a right to employment, and to that end I'd have to at least accept the resumes of disabled folk. But i don't have to cater to the whims of every nancy out there with a problem.
Not that catering is bad. I think if a company has the means and market it should attempt to go all ADA compliant. I think it's a good thing to get ramps, lifts, braille/etc. I just don't think it's a good idea to FORCE it upon people.
Tom
Re:And how... (Score:5, Insightful)
It's not about being 100% independent, it's about being as independent as possible. It's about all the small shit that YOU take for granted. It's being able to take a hot bath without worrying if you're going to boil your nerveless legs off, get an infection, and die. it's being able to cook your own meals, at least once in a while; or get your own groceries, or buy the things that other people are buying. Why does a disabled person have to do without, or beg for help from someone? And what if there -isn't- anyone to help, an all too common situation? Shit, my buddy can't even leave the house without someone to help him right now. He's got a visiting nurse who is nice and brings him some fast food once in a while so he can have a bit of variety.
If you're running a small enough shop, being ADA compliant isn't hard anyways, and can amount to a ramp and a handrail. Get some lumber, nails and a hammer and do it yourself! Shit, grants and tax incentives are even available for that shit! And offer assistance to the blind guy or girl, don't tell him/her to fuck off and learn to read. If you don't have regular blind customers, wait until someone asks before you spend the money on braille if you're gonna be cheap.
Goddamn, it's not asking you to suck a dick and buy a ferrari for every cripple who walks or wheels into your storefront! Just let people do their thing, regardless of their physical abilities! It's not about making a ton of money, it's about DOING THE RIGHT THING FOR PEOPLE. And yeah, yeah I DO have a right to be your customer. You cannot deny me custom in your public shop because of my race, gender, religion, or physical ability. That's the law. You have the right not to sell and expose yourself to a lawsuit, but I do have the right to enter your shop until you tell me to leave.
You know why it's law? because without the law, nobody would do it, because so many people are amoral cheapasses, particularly business owners. That's why we developed employee, child labor, and consumer protection laws - business owners weren't exactly chomping at the goddamn bit to be nice to people, not when it might cost a few dollars off the top.
Re:And how... (Score:4, Insightful)
Maybe gp doesn't, but I do, and I also happen to be visually impaired (not blind, but bad enough to never be able to drive a car, not be able to read any signs that I can't get close to etc)
Adding ADA compatible facilities and also making sure you're compliant costs money that most small companies don't have to spend. Given that it's to cater to a SMALLER market segment it's not good business sense to do it.
It costs money in quite some cases, but this is to expand your market, not to cater to a smaller market.
And why should disabled people not expect to be 100% independent? Because majority rules. Sorry dude.
What you just described is tirany by the majority, not a democratic society. You may not have noticed, but the system in the USA has all kinds of provisions to try to prevent exactly that. Actually taking into account the needs of minorities, upto individuals, is a fundamental part of the system.
Why should I expect to not be 100% dependent? because there is no reason why I should be. I am actually in a situation where I am not much more dependent on others then I would be without being visually impaired. That is for a substantial part a consequence of my own choices, and it is first of all my own responsibility to see to this. That said, I am hindered by many things that would not have costed money to prevent, will cost little to fix, and mostly happen out of ignorance, not because of it costing money. I don't see anything wrong with getting people to put a little thought into this, if needed by means of the law.
Not to mention that when as many disabled people as possible can be as independent as reasonably possible, the outcome for society as a whole is surely better from a social point of view, and it is quite likely cheaper on the whole as well.
Why should I cripple my business so you can read my literature?
Expanding your potential market is not in itself crippling your business.
You do have a point that it may not be worth it financially when you have to do things like install ramps, elevators etc, it may not fit into your specific building for cosmetical or whatever other reasons, and you can quite rightfully ask how far this should go anyway.
Hence I don't think that there should be laws forcing this onto companies, rather, those who do try to be accessable to disabled people should get the possible cost compensated in the form of tax breaks for example.
You don't have a right to be my customer.
No, but depending on where exactly you live, you might not be allowed to discriminate against me based on disability.
You have a right to employment,
Again this depends on local law, this is different from state to state in the USA, and even more different between countries..
and to that end I'd have to at least accept the resumes of disabled folk. But i don't have to cater to the whims of every nancy out there with a problem.
Making sure you do not create obstacles for disabled people out of ignorace is not catering to the whims of everyone out there with a problem, it is being a decent human who tries to better the society he lives in. Being forced to incure cost for the sake of a better society however is not a good thing (because of the forced part of it), encouragement to do a bit extra in the form of compensation however seems like a worthwhile idea to me.
Not that catering is bad. I think if a company has the means and market it should attempt to go all ADA compliant. I think it's a good thing to get ramps, lifts, braille/etc. I just don't think it's a good idea to FORCE it upon people.
This I completely agree with, and since for all I can tell this was your real point also, maybe do yourself the favor to slow down a bit before posting such rants as the one in front of it, you have a reasonable and well defendable point of view I believe, but much of your post is going to prevent people from seeing that because it rather makes you look unreasonable and extremist.
What is wrong with Captchas? (Score:5, Insightful)
The slashdot captchas are among the easiest I have ever seen to read, however I still havn't seen any spam on slashdot. Is there something else goign on here? It can't be anything like IP banning or flood controlls as those don't stop botnets. Is it that spammers just don't target slashdot? or is it that captcha reading bots are not nearly that good at breaking them and we could tone down the level of those horrible tiwsted-doted-lined Captchas?
Re: (Score:2)
Luxury gifts for both sexes (Score:5, Funny)
These replicas have all the presence and poise of the originals after whome they were designed at a fraction of the cost. The attention to detail is paramount and they are comparable to the originals in every way.
To view our huge inventory visit our website now at:
http://pwned31337.ku/ [pwned31337.ku]
: Replicated to the smallest detail
: 98% A+ Accuracy
: Includes all Proper Markings
: Wide selection and fast worldwide shipping
: Authentic Weight
: True-to-original self winding and quartz mechanisms
: Guaranteed worldwide Christmas delivery
Probably because /. isn't prime real estate (Score:4, Funny)
Re:Probably because /. isn't prime real estate (Score:5, Funny)
You must be new here.
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
Re:What is wrong with Captchas? (Score:4, Interesting)
instead of obfuscated images, just put in plain text questions.
What is 2+2?
What is the 3rd word in this sentance?
What is the name of my blog?
All of these can be answered by some one using a screen reader, and take less time then figguring out a captch. Sure it does not stop manual spamming, but what does?
Re: (Score:3, Informative)
That's been considered before. The problem with that approach is that, unlike image-based CAPTCHAs, there are a limited number of templates available for natural-language questions. The spammer just has to compile a list of the various patterns of questions and answers, a much easier task than designing an OCR program capable of extracting random, disconnected letters and numbers from a randomly distorted image. The problem is essentially on
Re:What is wrong with Captchas? (Score:5, Insightful)
How about:
Which word is spelled incorrectly in my sentance?
Re: (Score:3, Informative)
These questions or pictures again need to be either automatically generated or generated by humans. If automatically generated, they would need to follow a pattern, and so the challenge would then be on the spammers to identify the pattern and train their bots to read the pattern and respond appropriately.
If, on the other hand, they're generated by humans, it would be expensive to generate each one, and so they'd be limited in number. Therefore the spammers simply go about collecting each one, identifyin
Re: (Score:2)
On an older blo
Re: (Score:3, Insightful)
Re: (Score:3, Funny)
Re: (Score:2, Informative)
Numerous times there is confusion between I and L. Since every site uses its own set of images and its own 'set of rules to obfuscate', the user has all the reasons to be confused. Then there is 3 coupled with something that makes it look like B etc.
Ofcourse, you will fail one time only, as on next reload you will get a new image to read, but as the article says, user response drops. People want to help you and you are making it, kind
Re: (Score:2)
However, as I said, I have never failed a slashdot captcha, probably because they are all words....
Re: (Score:2)
Re: (Score:2)
I've wondered why the big spam services haven't setup this kind of scheme. I fear that I am just ahead of the times on this particular vulnerability
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Informative)
Re:What is wrong with Captchas? (Score:5, Funny)
Re: (Score:3, Funny)
Re: (Score:2, Informative)
Security through obscurity dogma be damned! When a breach isn't fatal, there are cases where obscurity works well enough.
Re:What is wrong with Captchas? (Score:5, Informative)
You obviously don't browse the comments at -1.
Re: (Score:2)
Re: (Score:2)
* A "lameness filter" which excludes certain posts (ill-defined and probably continually changing to keep up)
* A 20-second rule which prevents you from blasting the board
* Moderation, which puts anonymous posts in a place most people don't read anyway. They may be there and you don't see them.
That's still not sufficient for some jackass not to at least try, especially since the audience is so large. It may not be worth the trouble, since Slashdotters are r
Re: (Score:3, Insightful)
I still have yet to see anything that was an ad, I have seen pleanty of trolls, but those are not bots. I forgot about the lameness filter, and I admit to being curious if that is catchign things....
Re: (Score:2)
Re: (Score:2)
Not to mention that more than a few of us believe the proper response to spam involves the use of hired goons and blunt objects.....
OT: Lameness filter (Score:2)
Re: (Score:2)
What SlashDot captchas are these? Are they subscribers only?
Re:What is wrong with Captchas? (Score:4, Insightful)
Because anything difficult to OCR can be a real pain for humans too. Still, it's not that spammers are mass-OCR'ing images, it's that they actually get humans to enter the captchas, sometimes providing porn as a reward, but it's sometimes also a paid operation with goldfarming-style sweatshops. In a way, this is fine, because it scales far worse than full scale automation, but it does keep captchas from being a panacea.
It's the combination of the captcha, rate controls, and moderation that keeps spam out of here. All links here have rel="nofollow" as well, making them useless for google spamming, and the spammers know it. Basically it's a poor return on investment when you can spam a bunch of blogs that are wide open.
Javascript (Score:5, Interesting)
It's easy, you just have the javascript create all or part of the form. Or modify the form in some way. It would happen before the user even sees the form, and the spambot would have to implement a javascript parser to get it. (Or a parser, that's unique to your site.)
I would think AJAX would be a huge hamper to them as well.
That still fails ADA requirements (Score:2)
Re: (Score:2)
It would amaze me if the bot writers weren't already using JavaScript-capable bots. Internet Explorer is an ActiveX control that bots can use. Firefox offers plenty of ways to access its browser programmatically. (Imagine a SpamBot extension.) Firefox's JavaScript engine is open source, and I think Internet Explorer exports their via the Windows Scripting... thingy. (You'll have to forgive me for being more knowledgeable of how Firefox works than Internet Explorer.) In any case, the JS engines can als
People would be more likely to notice (Score:2)
Re: (Score:2)
There's absolutely no reason why a bot would have to actually display the browser. The browser engines themselves are designed to allow embedding into other applications. There's no reason why a bot application would ever have to bother actually displaying the window created to house the browser's control. It would still run in the background, never displaying any UI, simply hosting the browser's control in an invisible window. (Windows has a class of windows that do not appear in the task bar, so the b
Re: (Score:2)
TFA page has an example of the "hidden form", and it is indeed invisible -- so one less thing to confuse the user. Confused users were part of the issue they wished to resolve, so...
I suppose spambots will evolve to check for how a form is set up, but meanwhile, I like this idea much better than the alternatives.
Re: (Score:3, Informative)
"I hadn't read the article yet," is NOT the same as "I haven't read the article yet,"
I've read it. You can stop posting the same 'rtfa' over and over. Jeez.
Re: (Score:2)
I don't see why CSS wouldn't cause the same issues. If you're using lynx, or curl, and many other older browsers, the CSS won't hide the form fields they added.
I've never used a screen reader, but unless they actually read the pixels on the screen and translate them, instead of reading the text, they'll probably be confused, too. And if they are complicated enough to read/process the pixels, the javascript isn't a problem at al
Re:Javascript (Score:4, Informative)
Blind users (Score:4, Insightful)
Re: (Score:2)
Unless readers for the blind start scraping HTML source instead of visible text, it shouldn't be an issue.
Re: (Score:3, Insightful)
Blind people can't see. They aren't stupid.
Blind users? Use proper CSS (Score:3, Informative)
Aural, braille, and embossed are all media types that would hide the fields for blind users if done correctly (i.e. used and the reader supports it, which you'd think they would want to). This technique is not the only reason why blind user's tools need to work differently based on mediate type in CSS.
Foiling spammers without a captcha (Score:2, Funny)
KFG
Re: (Score:2)
You are a horrible horrible person!
field name encrypt (Score:2, Interesting)
Re: (Score:2, Interesting)
If CSS being off reveals a hidden field... (Score:4, Insightful)
Subject: _______{-enter your spam topic here if you want me to disregard your email
Can the label/tag telling someone to leave a field blank be hidden form a bot but clearly visible to a live person?
Search engines? (Score:2)
Re: (Score:2)
My Method (Score:3, Interesting)
Re: (Score:2)
Here's an alternative. (Score:2)
Make it a contract to post there.
If someone posts spam then make them a 1 or 2 bucks. Money$$
Or even organize other blogs and websites to sue them.
Related Story (Score:4, Informative)
What Ways Can Sites Handle Spambot Attacks? [slashdot.org]
Bots are really annoying (Score:2)
I quickly eyeball the 100+ bot submissions daily for the few *real* submissions. The rest are for "Laboratory Equipment", Viagra, mail-order brides, porn, and other crap.
And before anyone asks, I *have* looked into modding the scripts to add a simple barrier
Standard Forms (Score:2)
However, the one with the customized style sheet receives no bot spam! The 'Comment' link is actually called 'Talk about this', and the whole section of the Blogger posting is set up differently (i.e. left to right rather than top to bottom). The one t
15 second delay... (Score:2)
-b.
This is news? (Score:2)
Still Doesn't Stop Humans (Score:2)
Sesame Street method (Score:2)
Cat dog fish *car*
Black *stapler* white red
car truck *J-lo* SUV
*Madonna* J-lo K-fed Ja-rule
Where? (Score:2)
Just serve as application/xml+xhtml (Score:3, Funny)
Newlines (Score:2)
Turing Test (Score:2)
Vbulletin forums? (Score:3, Informative)
I use an anti-spam e-mail technique: blacklist.
Vbulletin has a censoring system where words you choose can be replaced with your choice of characters - by default it's an *. www.clickmeforspam.com, where I would use the "clickmeforspam.com" as the censored word, shows up as www.******************
It's quite hilarious to see the humans behind the spam, who have registered, gotten through a human image trap, clicked on a link e-mailed to them, logged in and posted their spam re-post it like 2-3 times only to realize they got owned by my filter. They get all pissed off, and by that time a user has reported the post or we've seen it and banned them. It's very fun to make fun of them in their spam posts filled with ***s.
Email Verification (Score:2)
However, I really haven't heard much
Been doing this for a while (Score:3, Insightful)
I won't stand for that, so the simple fix is to remove the "WEBSITE" input from the form. If "WEBSITE" gets POSTed along with the other data, I know it's a robot and post a message to kindly go away. Genuine users can edit their profile once the account is activated, if they want to plug their website.
use dnsbls (Score:4, Interesting)
dnsbl_check rails plugin [spacebabies.nl]
Basically what the plugin does is check clients against one or more DNSBLs. You might know them from mail servers. You see, it turns out that the forms are almost always abused by bots. These bots are quite well known. sbl-xbl from spamhaus catches 80% in my setup, spamcop catches the rest. You enable the plugin for key controllers and it really does work.
(/end shameless self promotion) mod me down if you wish
Re: (Score:2, Interesting)
Re: (Score:2)
Re:HTTP_REFERER (Score:5, Insightful)
A lot of legitimate users have the Referer header switched off or otherwise unavailable. Apart from the privacy factor, it's also common for "firewalls" [sic] to disable or change them.
Of course, you wouldn't know this, because anybody who finds out is automatically banned from your website, so they don't have a chance to leave a comment or even find your email address letting you know about the problem.