Wednesday, October 31st, 2007

Human Automated Captcha Reader

A quote from the article, "A new way of social engineering" by PandaLabs:

Now, look at yourself, you are a human automated captcha reader. If you type the correct interpretation of the image, you are sending the information necessary to break the protection of the targeted site. This attack could be used to create massive mail accounts, for comment posting…

My blog has recently begun attracting its first comment spam and I found this really interesting. Personally, I've never liked captchas. Apart from being really hard to read they also present accessibility issues. I think I'm going to stick to moderating my comments — at least until I've created a better solution!

Having said that, I'd really like to put some comment spam protection in place for Whird before its first release. It seems only the proper [responsible] thing to do. I can guarantee it will not involve the use of a captcha.

Thanks to Adrian von Bidder for pointing out the PandaLabs article.

Tagged with: antispam, projects, whird


2 Responses to “Human Automated Captcha Reader”

  1. Daniel wrote,

    Tried Honeypot Captchas?

    Create a blank field in your form, hide it with CSS so the user won't populate it (but the spam bot will), if input is detected in the field that should be blank, tarpit the spammer & abort the commit.

    http://haacked.com/archive/2007/09/11/honeypot-captcha.aspx

    Have managed to reduce 50 spams a day to 0 spams a day. Works well for me.

    Cheers

  2. Philip wrote,

    @Daniel: Hi and thanks for the link. The idea looks simple and effective, just how I like them :) I'll have a play with this and see how things go.

    If it works out I should be able to add it as a feature to Whird without too much effort. Of course the input name/id would have to be custom set by the user — but again this shouldn't be too difficult.

    Thanks again.

Add Your Comment

Use the form below to add your comment. Markdown syntax is available. Note, comments are moderated by me for spam filtering. Alternatively, feel free to contact me privately.