Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

When is it useful to use a captcha? When is it an unnecessary hindrance? Is a captcha just a quick fix for the lazy/unexperienced programmer, or are they really the best way to prevent spam and bots?

share|improve this question
    
You should ask this on Webmasters.stackexchange.com instead. –  Jonas Oct 12 '10 at 21:26
    
Rather than Webmasters.SE, this question would fit well on User Experience.SE. However, I'm not going to migrate it because that site's still in beta and the question is old and answered. –  Anna Lear Apr 4 '11 at 23:45

8 Answers 8

up vote 7 down vote accepted

ReCAPTCHA seems to be pretty secure, and will probably outlast any other OCR based CAPTCHA solution. CAPTCHAs are useful when you aren't sure if it's a bot or a human - ie, after the second or third login attempt, or if you allow anonymous commenting. Once a user has authenticated, dump the CAPTCHA.

An alternative that hasn't come up yet is the "SAPTCHA".

share|improve this answer
2  
Complaining that a captcha is unethical because it isn't available to blind people is moot because (a) you can speak it and (b) less then 0.5% of people are blind. –  Josh K Oct 12 '10 at 21:43
5  
@ Josh K: (b) doesn't make it ethical. (a) does if you actually implement it. –  Nemanja Trifunovic Apr 4 '11 at 16:15
3  
@Nemanja: What do you do about blind and deaf people? What do chefs do for people who can't taste? You can't say something is 'unethical' just because it doesn't work for every single person. What about sites that aren't compatible with IE? Are they 'unethical'? Oh, and reCAPTCHA has speaking built-in. –  Josh K Apr 4 '11 at 19:40
1  
@Josh: it's not only blind people, color-blind or partially sighted people are affected too (though in a lesser measure). Also, I can read English pretty well, but those spoken captchas are mostly out of my grasp. I would not call it unethical though, but it is an accessibility issue. –  Matthieu M. Apr 4 '11 at 19:55
1  
@Josh K.: I don't know what chefs do, but what we can do as programmers is make our work accessible. That's not just a matter of ethics but in some cases also a legal requirement. –  Nemanja Trifunovic Apr 4 '11 at 20:06

Using honeypot fields is/was a method to reduce spam at no real usability cost.

Here's an article describing how it works with some CSS magic, and while they noted that its effectiveness diminished, it'll still catch some bots. There are probably also more advanced techniques besides CSS (read: JS) that can boost the effectiveness of honeypots.

share|improve this answer
    
+1, just because I love their new Captcha system. (No votes left, I'll be back!) –  Josh K Oct 12 '10 at 20:19
    
Django uses a honeypot field on it's default Comment form, but I still get spam. I don't know how many attempts it blocks though. –  jonescb Apr 5 '11 at 19:32
    
+1 I use these on my blog. It catches a lot. But then again my blog isn't popular so maybe no one cares to try and spam it. –  Tony Apr 5 '11 at 19:45

I just love how people just readily accept the "conventional wisdom" about CATPCHAs. As a professional Web developer with ten years of experience and with some expertise in accessibility, it's my opinion that under no circumstance should you implement CAPTCHAs. I'm referring to the kinds that have lines, cursive fonts, 3d effects, etc. First of all, they prevent large numbers of users from accessing content, including a lot of older people, or people with every day vision impairments (such as color blindness), or people for which English is not their first language. Secondly, citing "security" is not a good enough reason. This is because for 99.5% of the spam out there, having someone re-type a five-letter word is sufficient "security." These mythical "robots" that people often refer to are not really that sophisticated. And even then, for those that are sophisticated (again, which is a very small number), a typical CAPTCHAs is not going to be sufficient anyway. So, given that all the negative far outweighs any real benefit, which is mostly imagined anyway, there's no good reason to use them. If you want to prevent SPAM, all you need is to have people re-type a word like "blog" (and it's OK if they can copy-and-paste). This is totally accessible and, trust me, is sufficient enough "security." You'll be surprised to find that all your spam is eliminated and you didn't even have to cut off large segments of users.

copied from other answer by same user

I agreed with this post up to a certain point: "In my experience, even if you have the best captcha in the world, there are a lot of spammers who are nowadays employing real humans for very low wages to simple visit the site, signup (or whatever) and post their spam 'manually'.

So any system that requires you to differentiate between "human" and "bot" is not going to work when faced with an actual human. Whatever system you come up with is not going to be fool-proof and you're going to need to manually verify anonymous (or "near anonymous" - that is, new signup) content."

Then the posted started suggesting some complicated Javascript. Again, as I stated above, just prompting the user to re-type something (I should add randomly selected text is ideal) is just as effective as showing an obscure image of something that you need to decipher. The deciphering aspect is an unnecessary layer, in my opinion. Again, that's just my opinion, but this has been completely effective for me.

I should also add the CAPTCHAs cannot be used on government websites because they violate Section 508 rules.

share|improve this answer
    
That's pretty much what I do, actually. As I said in my answer, I just have a little bit of javascript that basically does the cut'n'paste for you. –  Dean Harding Apr 4 '11 at 21:25

Also I would accept that reducing the amount of spam you receive is necessary, before going and implementing whatever counter-measure, let's think would you ?

  1. Is it necessary to automate detection ? For a low-traffic website, manual moderation can be sufficient. You will want to prevent people from adding racists/insulting comments anyway, won't you ?
  2. Is it necessary to pass a Turing test for any comment ? Spammers usually try to pass in urls, so only activating counter-measures when a url is detected seems viable (though slightly more complicated).
  3. Is it necessary to pass a Turing test every time ? Anonymous users could have to be filtered (though you could remember IPs), but authenticated users could be filtered only when they become "spammy", for example each 5th comment in less than an hour (or a day), and only until they have proven themselves (white-list based system fed either manually or automatically)

Those 3 ideas should greatly reduce the number of people exposed to those counter-measure, and the number of times they are subjected to them too.

On top of that, they are other counter-measures than captchas, like asking for an e-mail address, sending a message, and waiting for a response with a particular text as subject (randomly generated) before actually posting (with a one hour timeout before trashing the comment, say).

share|improve this answer

In my experience, even if you have the best captcha in the world, there are a lot of spammers who are nowadays employing real humans for very low wages to simple visit the site, signup (or whatever) and post their spam 'manually'.

So any system that requires you to differentiate between "human" and "bot" is not going to work when faced with an actual human. Whatever system you come up with is not going to be fool-proof and you're going to need to manually verify anonymous (or "near anonymous" - that is, new signup) content.

I've actually found that a pretty good system is one that requires javascript. That is, have some javascript on the page that copies a randomly-generated value into a special field in the form. On the server, verify that the value has been copied. In my experience, that's stopped a great many spammers. It's not 100%, and perhaps not as good as ReCAPTCHA, but it works well enough for the sites I've worked on, and you don't have to worry about accessibility (there are clients that don't have javascript, but they are fewer and further between these days).

share|improve this answer
    
It seems it is a good deal for spammers to pay $2 for bypassing 1000 CAPTCHAs on sites like decaptcher.com. It's horrible - many sites I visit that use reCAPTCHA are now being hit by huge amounts of spam. –  Allon Guralnek Oct 13 '10 at 11:45

I use reCaptcha because it cuts 90% of the spam out with 5% effort.

I haven't had people complain that the captcha is hard, makes things more difficult, or has any decreased usability either.

Spammers and bots are abundant. It's very easy to scrape a form and start submitting bad requests en masse. It is a simple, secure, proven way to significantly reduce spam and bots. It's not a quick fix for the lazy or inexperienced, rather experience has led to this solution and it is now easy to implement.

Do I like captchas? Hell no. Squiggly lines, what does it mean, opps I entered it wrong. It is effective though.

share|improve this answer
1  
@josh is there a visible and easily available way to "complain"? I personally hate them but reCaptcha is easy to deploy (as you mention) and also –  Chris Oct 12 '10 at 19:51
    
@Chris: Sure there is, you can either drop me an email, bitch somewhere else, or complete the captcha once and tell me in a comment. –  Josh K Oct 12 '10 at 19:53
    
I believe reCaptcha you can also listen to the code, I know I've had to use it once or twice just because I was using a garbage monitor –  WalterJ89 Oct 12 '10 at 20:09
    
@Walter: It's so incredibly simple to implement reCaptcha, which is why I use it. You can change the picture or listen to it being spoken, with almost no work on your part. –  Josh K Oct 12 '10 at 20:19
1  
You also get crap like this: meta.stackexchange.com/questions/48840/… –  TheLQ Oct 12 '10 at 21:11

There are other way to prevent spam and bots, but captcha's work the best. Sometimes asking a simple question on a form like "2+10=" or "Are you human?" works fine as a captcha, for a while at least.

share|improve this answer

In my experience captchas are the best way to prevent spam, no matter how well the form is programmed there will always be a spam bot better than your app.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.