Lack of interest [Suggestion] Efficient way to stop robots registering

[Floren]

I'm pretty sure you already saw this article, but I will post it anyways.
Using this technique, it will be virtually impossible for a robot to register or perform any other spam related tasks. Why? Because you can actually set yourself the increment value, for example. On top of that, you can generate easy a slider with jQuery.

I would really want this present into Xen. It will bring value to the product, since is something not implemented into any software out there.

 

[AndyB]

I may be wrong. I'm just speaking from personal experience when signing up for forums and seeing questions like "what is 4 + 1?" very often.

You would have to sign up for several thousand forums to get an idea of the variations. I have not done that myself, but based on the success over the past few years since Q&A has been out, I will assume that there is lots of variation.

 

[James]

There may be variation in the questions themselves but I assume that a lot of these questions revolve around the same topic. A lot of the questions I have come across are maths-related and I think to myself "heh, a computer can process maths much faster than the human brain" before proceeding to click the red X

 

[anotheralias]

Sure, but you're blaming the code for human error. If people use it to ask math questions or "what color is the sky?" that's their problem.

 

[Chromaniac]

recaptcha has done a good job on vBulletin. i notice most of the spam i get on my forum is most likely by humans only.

 

[Markos]

A custom question like the "Are you human?" (not questions like "2+2?"). This system is better than captcha.

 

[Chromaniac]

and how many custom questions can you seriously have?

the good thing with recaptcha is that with google managing it now, it is only going to get more powerful.

 

[valdet]

Several months ago, I read a very interesting blog post (can't find the link), from Google testing new anti spam features. They had a picture and you had to rotate it to a certain position as the question requested. Simlar use was to move the clock hands to a particular time etc..

These sound like brilliant ideas, but as few have said, it would be a problem with disabled users and probably with users w/o javascript.

 

[Markos]

and how many custom questions can you seriously have?

the good thing with recaptcha is that with google managing it now, it is only going to get more powerful.

The captcha can be breaked...a custom question on registering can't be understanded by a robot...

 

[Chromaniac]

who would provide the custom questions?
how many custom questions can you feed into the system?

if the database is included into the XF package, it would be available to everyone.
if the user feeds it, he would only have a finite range of questions.

from what i see recaptcha continues to do well. i am not sure if there has been a solid crack for it.

 

[Paul B]

I have a very simple way of stopping bots from registering on my forum.
I haven't changed it for almost 2 years now and in that time I haven't had a single bot.



If they ever do update their scripts to take it into account then I will simply change the value and/or add/remove a field.

 

[Markos]

who would provide the custom questions?
how many custom questions can you feed into the system?

if the database is included into the XF package, it would be available to everyone.
if the user feeds it, he would only have a finite range of questions.

from what i see recaptcha continues to do well. i am not sure if there has been a solid crack for it.

I intend a custom question created by the administrator of the forum...example: what is the color of background of this forum? What is the nick of admin? (it's only an example...)

another little trick to stop spammers is to not permit to new users (only for the first post) to post links

 

[Tigratrus]

Another trick is to SPELL out any numbers, don't put them in as digits ("two plus eleven" instead of "2 + 11" ). Personally though, I'd stay away from simple math like that though. The idea is to write directions that are easily comprehended by a human, but baffling to a bot. I'd particularly suggest using questions that are specific to your forum's topic if it has one.

 

[Dean]

I have a very simple way of stopping bots from registering on my forum.
I haven't changed it for almost 2 years now and in that time I haven't had a single bot.

View attachment 1556

If they ever do update their scripts to take it into account then I will simply change the value and/or add/remove a field.

I do a very similar thing. It works.

captcha, re-captcha, math problems do not work for us, although I still have them enabled for other reasons.

 

[anotheralias]

I've given up registering for a few things (that I was admittedly half-hearted about anyway) because I kept getting the Captcha wrong and I got tired of re-entering the other stuff. As an enduser I much prefer the anti-spam question.

 

[zappaDPJ]

It's always nice to see new ways of combating spam registrations but I don't think this one is viable. It's dependency on input from a mouse may well deter quite a few registrations. How many times have had to run a mouse on your leg because it just won't work on surface it's sitting on? There are a lot of computer users out there using abysmal peripherals for input/output and that slider system looks like it would require a degree of accuracy.

A CAPTCHA and a simple Q&A has kept all my forums 100% bot free for many years and to date I haven't seen anything else that beats that combination.

 

[Floren]

Sorry, but I'm not buying "I don't want to go into details." The reality is that if the needed value is sent to the browser (which it would need to be for the current behaivor), then a bot can find that value and use it to exploit the script.

Let see...

$sliderValue = sha1($userName . $ip . $sliderId . $sliderValue);

$sliderId is a value automatically generated when you install the forums, that you can also regenerate in admincp:

$sliderId = uniqid('', true);

Is there a way to "guess" the $("UserHuman").value? Thanks for your input.

 

[AndyB]

Captcha is only good at keeping humans from registering. (laughing)

 

[Erik]

Let see...

$sliderValue = sha1($userName . $ip . $sliderId . $sliderValue);

$sliderId is a value automatically generated when you install the forums, that you can also regenerate in admincp:

$sliderId = uniqid('', true);

Is there a way to "guess" the $("UserHuman").value? Thanks for your input.

I'm speaking in theoretical terms here. JavaScript is used to make the slider disappear and submit the form. Thus, the browser must know the value required for the slider (as it is written into the JavaScript by necessity). If the browser knows it, then bots can find it to, and easily exploit it to submit the form.

So yes, there is a way to find, not guess, the UserHuman value.

The only way you could do it so that the required value isn't sent to the browser is to put a form slider on top of an image with a line at a randomly generated position. You would slide the slider to the line, then you would click the submit button (no JavaScript used to determine when it's at the right position - it's all checked serverside based on the value submitted by the slider and the image generated). The problem with this is that it would be very, very easy for bots to just parse the image and use OCR-type technology to find the position of the line, then submit that value. You could try to confuse them by adding false lines, obscuring the position, etc, but then the slider would just get really complicated and confusing to use and it would be no easier than a standard text CAPTCHA, not to mention it's inaccessible for certain people.

Edit: w00t 1000th post!

 

[Floren]

JavaScript is used to make the slider disappear and submit the form... So yes, there is a way to find, not guess, the UserHuman value.

I agree, to a certain point. The slider is used for validation only, it will not actually submit the form. Even if the spammer will look at Xen code and see that an username and IP are used, he will never be able to determine the sliderId value, since all 3 keys are already sha1'ed. That does not change the fact blind people will not be able to use the slider, so your point is very solid.

Now, please open a new suggestion thread, to have implemented the xen activity graphic you have in your signature. A nice location would be under the online users box.

 

[Erik]

Now, please open a new suggestion thread, to have implemented the xen activity graphic you have in your signature. A nice location would be under the online users box.

http://xenforo.com/community/threads/activity-over-past-24-hours-graphic-and-sparklines.3261/