CAPTCHA or email confirmation?

Question

I have read that captcha isn't a perfect solution to protect a website where for example the user can create an account, since there are many people in different countries that practicallty read captchas for a living, so I am considering using email confirmation instead on my site.

But is that a better solution, or are there some vulnerabilities with that method too? Are there maybe other solutions I haven't come across?

Answer 1

Neither method is foolproof at blocking automated requests, but both have been effective for me in the past. Let me explain:

Automating a response to an email is fairly easy, and thus cannot be taken as assurance that the client is not a bot. Similarly, captcha is easily broken (not even using humans). For instance, the hacker group DC949 recently released stiltwalker, which can reliably bypass recaptcha and many other popular captcha services. As is often the rule in security, if someone is determined enough, they can break in.

However, email verification and recaptcha have had great impact for me in the past when fighting spam accounts/reviews. While it can be bypassed, many spammers don't know how and/or don't bother. So, while it is not "secure", it is still effective.

P.S. Another technique I have heard about is using javascript to gauge the amount of time the user spent on the webpage before submitting. Most bots will submit things almost instantly (if they even run the javascript at all), so checking that a second or 2 has elapsed since the page rendered can block a lot of spam as well.

Answer 2

They both solve different problems.

• CAPTCHA prevents automated signups.
• Email verification proves that the email address is valid.

As such, you should use both. However, a determined spammer will simply outsource image based CAPTCHA solving to 3rd world countries, or get unsuspecting users to solve them via phishing attacks.

The best type of CAPTCHA is one the user never sees. As such, a honeypot CAPTCHA is one of the most effective and user-friendly options.

Answer 3

Email confirmation and CAPTCHA solves different problems. The first one should be implemented when you want users to use their real e-mail address in the registration process. Email confirmation also protects us from identity theft. I cannot register by typed the whitehouse.gov emails address and pretend that I am the President ('cos I'm not able to click on the confirmation link sent to whitehouse.gov, because I'm not the owner of this address). So email confirmation allows to link each user to each email address.

However email confirmation doesn't protect us from the bots (as the CAPTCHA does). Honestly, almost every spam-bot I've seen had email confirmation implemented. It's really easy stuff and it's just a few lines of code to force our program to check emails and click on every activation links). The interesting detail is that some of that spam-bots used 123456 as the password to their webmails accounts.

So, let's talk about the CAPTCHA. It was created to distinguish human from the robot. Reading the text from the image, solve maths formulas, etc. The main problem is that online robots are still evolving. Their modules are upgrading, they haven't got problems with solving formulas, their OCR modules are better (so they are able to extract text from the image). All of these means that CAPTCHA is not the 100% protection against non-humans, but it's the first defense-line and it's very recommended.

The best CAPTCHA is the CAPTCHA which was implemented by you. Trust me, a lot of people try their luck with breaking popular CAPTCHA. Why? The answer is very easy here. Popular CAPTCHAS are used by a lot of website. If we can break that CAPTCHA, then we could put a lot of spam content on that websites. So if your website is not very popular and has own CAPTCHA implementation, I am pretty sure, that noone will lose their time and money to break your CAPTCHA. However if you are not sure how to implement it in the proper way, you could try non-obvious CAPTCHAs. Like image-base CAPTCHA (here is the example) or 3D CAPTCHA (another example).

Answer 4

I would try a CAPTCHA plus email verification, as others suggest, and see if it is good enough for your site. If it is, good, problem solved!

If that does not prove adequate, there are some other options you can consider:

• Mobile phone verification. You ask the user to enter their mobile phone number, you send them a SMS (text message) with a code, and ask them to enter the code into the website. Or, you place an automated phone call to their landline. Think how Google Voice does it.

  However, many users may be reluctant to give you their phone number, for a variety of reasons, especially if you are not a very well-known brand (like Google or Apple).

• Outsource the problem. For instance, you could require users to log in with Facebook.

  However, some users may be reluctant to log in with a Facebook account, e.g., for privacy reasons. Also, Facebook's defenses aren't perfect, either.

Be careful with these options. Don't be evil. These options can easily annoy users or drive users away, so be very reluctant to use them unless you have data to indicate they are needed (and maybe not even then). Demanding a user's phone number or Facebook account is very close to a "dark pattern".