OpenUru.org

Yeah, unfortunately CAPTCHAs aren't really that good a defence against forum spammers.

The older CAPTCHA's (such as came with phpBB 2) have long since been readable by Bots. While the newer CAPTCHAs are presently proving reasonably effective against SpamBots, it's only going to be a short matter of time before the Bot OCR technology catches up. And you also have to look at how some spammers operate (Warning! long monologue begins)...

I had a forum that was being heavily hit by spam registrations (back in phpBB 2) days, mainly from China or Russia, despite having a CAPTCHA active on the registration page (BTW, in case anyone doesn't know: CAPTCHA = Completely Automated Public Turing Test To Tell Computers and Humans Apart). I assumed at the time, that the CAPTCHA image was being OCR'ed by the spambot software, and this was probably true, but more on that later. I found some phpBB patches on offer at the time that claimed to block SpamBot registrations but I think these had themselves aleady been largely circumvented by the Bots as they turned out to be quite limited in effect, and only reduced the number of registrations rather than stopping them altogether.

In searching for a truly effective solution, I discovered some disturbing facts: I had made an assumption that only bots would be doing this as the number of posts which actually generate revenue for the spammer's clients had to be such a tiny fraction of the total number of spam posts, that human involvement seemed inconceivable. This was obviously a "Western View" and I hadn't considered that in some Asian areas labour is so cheap that it is economical to employ gangs of people to solve CAPTCHAs - They do just that: They don't fill in the whole registration form (the bot does that), they just get the CAPTCHA image relayed onto their screen, for them to type in the answer, so one person can literally get through hundreds per hour.

Worse [#1], consider that once an image has been "solved" by a human operator, it can now be stored in a database. If that same image appears again on some other form, it can be answered directly by the bot. Otherwise back to the human operator.

Worse [#2]: How does the spammer reduce his costs further and get the human effort for free? Easy, as it turns out. Let's say the spammer also operates some legitimate websites, say a social networking site, a web-chat service, etc. - anything that generates lots of traffic and that uses web forms (i.e. the kinds of places where you might want to use a CAPTCHA). So what Mr Spammer does is to take the CAPTCHA images picked up by the bots and present them to the users of his "legitimate" site, so his users unwittingly solve his puzzles for him and he pays no-one. In fact his users probably pay him !

Of course, this kind of technique can be put to good use too. Anyone seen a reCAPTCHA? That's where you get two CAPTCHAs side by side and you have to supply two responses. This is part of Carnegie Mellon University's work in digitizing books: One of the images you see is a "real" CAPTCHA test the other is "work" - The first validates that you're capable of supplying a good answer, the second is a word that the OCR of a book failed to recognise with the image modified to look like a CAPTCHA. If you answer the test correctly then the response you give for the "work" is added as a probable solution for the problem word. Once they get a number of convergent replies for that word, then it is taken as a solution, and the image is removed from the reCAPTCHA database.

Anyway, where I ended up (and I know others have come to the same conclusion) is that the only reasonably reliable solution is not to use anyone else's - If something looks like a good solution, and lots of people start using it, then that fix itself becomes a target for the SpamBot, and it will, in time, be compromised. You have to make your site unique, so that the effort of coding a workround isn't worth it. So, adding a question to the registration form is good, even a very simple one, provided that the form field name is something unusual (so that a bot won't recognise it for what it is), and that the answer isn't a simple Yes/No (50% chance of guessing right). I'd also recommend against numerical questions like "What is 6 x 7?" as these aren't really that difficult for a bot to read. And you also have to be sure that a legitimate user can't give the wrong answer by mistake: "What is the capital of Australia?" will get lots of "Sydney" instead of "Canberra" answers

End of monologue. Sorry, you can probably tell it's something I've spent some time on