Go to navigation
User #55294   3780 posts
Whirlpool Forums Addict
https://whrl.pl/RbXyF1
herring | anchor | mark
posted 2009-Jul-29, 7:07 pm
https://whrl.pl/RbXyF1
posted 2009-Jul-29, 7:07 pm
O.P.

Read this
http://en.wikipedia.org/wiki/CAPTCHA

Then look at how the RTA implemented CAPTCHA
http://www.rta.nsw.gov.au/cgi-bin/index.cgi?action=feedback.form

Or just guess – yep not images but plain text...

I guess no one loves them enough to even send spam.

User #62582   5008 posts
Whirlpool Forums Addict
https://whrl.pl/RbXyGX
herring | anchor | mark
posted 2009-Jul-29, 7:11 pm
https://whrl.pl/RbXyGX
posted 2009-Jul-29, 7:11 pm

It's actually quite clever. It has hidden characters between the visible characters, so any bot that comes along and tries to cheat, will need to take into account CSS rules.

User #36572   10109 posts
Whirlpool Forums Addict
https://whrl.pl/RbXyHt
herring | anchor | mark
posted 2009-Jul-29, 7:13 pm
https://whrl.pl/RbXyHt
posted 2009-Jul-29, 7:13 pm

~~Adam writes...

Or just guess – yep not images but plain text...

I guess no one loves them enough to even send spam.

Well, actually... have you tried to copy and paste the word? It's not all that bad, very specific to the site with obvious easy workarounds... unless the separators change as well...

User #55294   3780 posts
Whirlpool Forums Addict
https://whrl.pl/RbXyJq
herring | anchor | mark
posted 2009-Jul-29, 7:19 pm
https://whrl.pl/RbXyJq
posted 2009-Jul-29, 7:19 pm
O.P.

yeah it is specific, as far as I can tell the separators are always full stops.

User #97652   422 posts
Forum Regular
https://whrl.pl/RbXyKo
herring | anchor | mark
posted 2009-Jul-29, 7:22 pm
https://whrl.pl/RbXyKo
posted 2009-Jul-29, 7:22 pm

~~Adam writes...

Or just guess – yep not images but plain text...

I guess no one loves them enough to even send spam.

Look a little closer at the code. There are hidden spans in between each letter.

User #36572   10109 posts
Whirlpool Forums Addict
https://whrl.pl/RbXyLg
herring | anchor | mark
posted 2009-Jul-29, 7:25 pm
https://whrl.pl/RbXyLg
posted 2009-Jul-29, 7:25 pm

~~Adam writes...

yeah it is specific, as far as I can tell the separators are always full stops.

I would assume that the generator can be easily modified.

User #43787 1989 posts
Whirlpool Enthusiast
https://whrl.pl/RbXyOl
herring | anchor | mark
posted 2009-Jul-29, 7:38 pm
https://whrl.pl/RbXyOl
posted 2009-Jul-29, 7:38 pm

I actually like this. I'd just go with more than just "." as a hidden seperator.

It's probably even harder to automate solving, because currently the spammers just OCR it or ship the image off to a human to solve.

This way, they haven't got an image to ship off to a 3rd party and the only way to OCR it would be to spin up a browser and screenshot the page and OCR that.

Some random/multiple positioning and the OCR way won't be easy.

At the very least it will require so much customisation for your site from the spam robots to make it not worth it for them.

FWIW, you would be surprised at how simple you can make spam protection and still have it work. For example, even though our sites are quite popular news sites we just use the simple "hidden field that should be left empty" to trick out robots that just fill in every field. That always works for a good few months after we change the field names for the robots to be modified for the new field name.

User #36572   10109 posts
Whirlpool Forums Addict
https://whrl.pl/RbXyPg
herring | anchor | mark
posted 2009-Jul-29, 7:41 pm
edited moments later
https://whrl.pl/RbXyPg
posted 2009-Jul-29, 7:41 pm (edited)

cbo100 writes...

I actually like this. I'd just go with more than just "." as a hidden seperator.

The only issue I have with their solution is that, I suspect, they have one global word that expires every few hours. So, instead of generating the captcha for each user, they captcha is reused in every form.

It wouldn't take much effort to make it even more effective.

I agree, the separators should also be randomised. The concept is good though – it should even work for screen readers...

User #43787 1989 posts
Whirlpool Enthusiast
https://whrl.pl/RbXyQ0
herring | anchor | mark
posted 2009-Jul-29, 7:47 pm
https://whrl.pl/RbXyQ0
posted 2009-Jul-29, 7:47 pm

Yeah, it was "debts" for me with something about 2 hours.

That's probably the biggest flaw if that's how they are doing it. A spammer only needs to check it manually 12 times a day and then spam away.

User #210776   861 posts
Whirlpool Enthusiast
https://whrl.pl/RbXzQy
herring | anchor | mark
posted 2009-Jul-29, 11:21 pm
https://whrl.pl/RbXzQy
posted 2009-Jul-29, 11:21 pm

cbo100 writes...

A spammer only needs to check it manually 12 times a day and then spam away.

Huh?

I managed to copy the value and paste it and submit nothing in any of the fields... I was told it was submitted OK – I wonder if it actually was – because if so – that's pretty ordinary..

User #213300   4201 posts
Whirlpool Forums Addict
https://whrl.pl/RbXzWD
herring | anchor | mark
posted 2009-Jul-29, 11:35 pm
https://whrl.pl/RbXzWD
posted 2009-Jul-29, 11:35 pm

cbo100 writes...

For example, even though our sites are quite popular news sites we just use the simple "hidden field that should be left empty" to trick out robots that just fill in every field.

Thats called a honeypot :)

User #28190   1896 posts
Whirlpool Enthusiast
https://whrl.pl/RbXDDA
herring | anchor | mark
posted 2009-Jul-30, 10:58 pm
https://whrl.pl/RbXDDA
posted 2009-Jul-30, 10:58 pm

Carpoint have an interesting one. In order to view the full car specs you need to get past the standard image captcha. Next, when it shows the specs, they are in a fixed width font and look normal. But it's when you highlight the text, when it looks weird. Looking behind the scenes for the word '4 Stroke' shows this:

<div class="doubledivrandom">
<div class="float">4 S r k </div>
<div class="absolute">   t o e</div>
<div class="clearboth"/>
</div>
User #67421   8141 posts
Whirlpool Forums Addict
https://whrl.pl/RbXDFc
herring | anchor | mark
posted 2009-Jul-30, 11:05 pm
edited moments later
https://whrl.pl/RbXDFc
posted 2009-Jul-30, 11:05 pm (edited)

cbo100 writes...

FWIW, you would be surprised at how simple you can make spam protection and still have it work. For example, even though our sites are quite popular news sites we just use the simple "hidden field that should be left empty" to trick out robots that just fill in every field.

I like this idea. Then ban the IP of anyone that fills it out

User #213300   4201 posts
Whirlpool Forums Addict
https://whrl.pl/RbXDFD
herring | anchor | mark
posted 2009-Jul-30, 11:07 pm
https://whrl.pl/RbXDFD
posted 2009-Jul-30, 11:07 pm

dealerkim writes...

Then ban the IP of anyone that fills it out

Which is REALLY flapping stupid considering you may be blocking a proxy, dynamic ip, or a static ip which ends up on a legit user at some point.

User #55294   3780 posts
Whirlpool Forums Addict
https://whrl.pl/RbXGwz
herring | anchor | mark
posted 2009-Jul-31, 7:18 pm
edited moments later
https://whrl.pl/RbXGwz
posted 2009-Jul-31, 7:18 pm (edited)
O.P.

dealerkim writes...

Then ban the IP of anyone that fills it out

I can see an intentionally malformed packets taking out your entire site. Be careful with IP Bans.

User #38306   27241 posts
Whirlpool Forums Addict
https://whrl.pl/RbXG33
herring | anchor | mark
posted 2009-Jul-31, 10:04 pm
edited moments later
https://whrl.pl/RbXG33
posted 2009-Jul-31, 10:04 pm (edited)

Boodu writes...

But it's when you highlight the text, when it looks weird. Looking behind the scenes for the word '4 Stroke' shows this:

<div class="doubledivrandom">
<div class="float">4 S r k </div>
<div class="absolute"> t o e</div>
<div class="clearboth"/>
</div>

Yep, a news site called MIS does the same.

http://www.misaustralia.com/viewer.aspx?EDP://1248995767008§ion=news&xmlSource=/news/feed.xml&title=Motorola+dials+up+revenue+slump

Try and copy the text of that article.

User #165653   3175 posts
Whirlpool Forums Addict
https://whrl.pl/RbXIzK
herring | anchor | mark
posted 2009-Aug-1, 12:16 pm
https://whrl.pl/RbXIzK
posted 2009-Aug-1, 12:16 pm
<span class="security">d<span class="hidden">.</span>a<span class="hidden">.</span>y<span class="hidden">.</span></span><input name="security_word" type="Text" class="BodyTextNoMargin" size="6" maxlength="50" value=""/>

Not too hard to bypass if coded correctly.

Tell the program to remove any string between <span class="security"> and </span><input name="security_word" type="Text" class="BodyTextNoMargin" size="6" maxlength="50" value=""/> that matches <span class="hidden">.</span>

Then you have: day

Thats a very crappy CAPTCHA implementation.

User #62582   5008 posts
Whirlpool Forums Addict
https://whrl.pl/RbXJcl
herring | anchor | mark
posted 2009-Aug-1, 4:24 pm
https://whrl.pl/RbXJcl
posted 2009-Aug-1, 4:24 pm

The Amazin' Azn writes...

Not too hard to bypass if coded correctly.

there is no reason it couldn't be changed to have a random class name.

if enough parts of it are made random i think it could work very well.

User #44690   24996 posts
Whirlpool Forums Addict
https://whrl.pl/RbXJjD
herring | anchor | mark
posted 2009-Aug-1, 5:12 pm
edited moments later
https://whrl.pl/RbXJjD
posted 2009-Aug-1, 5:12 pm (edited)

SirPengu writes...

if enough parts of it are made random i think it could work very well.

The thing is, it doesn't have to work "very well". It just has to be better than the others. And since the huge majority of feedback forms have no protection at all, spammers will just target those instead.

User #72134   379 posts
Forum Regular
https://whrl.pl/RbXJmE
herring | anchor | mark
posted 2009-Aug-1, 5:29 pm
edited moments later
https://whrl.pl/RbXJmE
posted 2009-Aug-1, 5:29 pm (edited)

MisterEd writes...

Yep, a news site called MIS does the same.

http://www.misaustralia.com/viewer.aspx?EDP://1248995767008§ion=news&xmlSource=/news/feed.xml&title=Motorola+dials+up+revenue+slump

Try and copy the text of that article.

That's all good and well, but... have you viewed that page in IE8?

Edit.. second time it worked. First time IE8 only gave me mumbo jumbo.