Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have read that captcha isn't a perfect solution to protect a website where for example the user can create an account, since there are many people in different countries that practicallty read captchas for a living, so I am considering using email confirmation instead on my site.

But is that a better solution, or are there some vulnerabilities with that method too? Are there maybe other solutions I haven't come across?

share|improve this question
1  
What do you want to protect the website against? What problem are you trying to solve? –  Gilles Aug 14 '12 at 20:13
    
@Gilles, from automated signups. –  DannyCruzeira Aug 14 '12 at 20:35
add comment

4 Answers

up vote 6 down vote accepted

Neither method is foolproof at blocking automated requests, but both have been effective for me in the past. Let me explain:

Automating a response to an email is fairly easy, and thus cannot be taken as assurance that the client is not a bot. Similarly, captcha is easily broken (not even using humans). For instance, the hacker group DC949 recently released stiltwalker, which can reliably bypass recaptcha and many other popular captcha services. As is often the rule in security, if someone is determined enough, they can break in.

However, email verification and recaptcha have had great impact for me in the past when fighting spam accounts/reviews. While it can be bypassed, many spammers don't know how and/or don't bother. So, while it is not "secure", it is still effective.

P.S. Another technique I have heard about is using javascript to gauge the amount of time the user spent on the webpage before submitting. Most bots will submit things almost instantly (if they even run the javascript at all), so checking that a second or 2 has elapsed since the page rendered can block a lot of spam as well.

share|improve this answer
    
Thank you for the detailed answer, and for sharing the link. I think I will do as you say and use both, but one thing I wonder is, is it unsafe to use your own captcha? recaptcha is of course well tested, but couldn't it be that since my captcha doesn't exist in the exact same form anywhere else, it will leave the spammers on square one? Or am I wrong? –  DannyCruzeira Aug 14 '12 at 20:31
3  
Rolling your own has its benefits - it prevents attackers that use very specific image recognition techniques. However, most spambots just attempt to classify the text with a generic CAPTCHA-breaking kit (essentially OCR with filters tuned for CAPTCHA text), and simple CAPTCHAs will fall to these. If they can't get a match percentage above a certain threshold, they either give up or place them in the "human solving" queue. As such, a well-known CAPTCHA such as reCAPTCHA might be a better choice. It constantly evolves, and is proven to be difficult to break. –  Polynomial Aug 14 '12 at 20:43
    
@DannyCruzeira It depends. Many CAPTCHA use texts very weakly made "harder", sometimes harder for ... humans, as they use lame color schemes. Many CAPTCHA designers have no idea how easy it is to break their stupid color schemes (yes, the computer can trivially tell that you inverted front and back colors; yes, using many different colors at once may be nice visually, but it does not make it harder for computer to read text...) sometimes, without peer review, people come up with crazy ideas. –  curiousguy Aug 15 '12 at 22:06
    
@curiousguy, do you know any things that are documented to be hard for computers to read in a CAPTCHA, I mean, like for example stretched text or something similar? On my current CAPTCHA I rotate the text randomly and place the text on different places on the image, I can guess that it's not that safe. –  DannyCruzeira Aug 15 '12 at 22:19
    
@DannyCruzeira I am not a CAPTCHA expert, or an OCR expert. But I have basic understanding of image analysis techniques, which is enough to laugh when confronted with the lamest schemes. I think that rotated text is not "safe", but more difficult to break than custom color schemes. Stretched text is difficult for OCR software (but doable now) and sometimes too difficult for humans. –  curiousguy Aug 16 '12 at 0:40
show 2 more comments

They both solve different problems.

  • CAPTCHA prevents automated signups.
  • Email verification proves that the email address is valid.

As such, you should use both. However, a determined spammer will simply outsource image based CAPTCHA solving to 3rd world countries, or get unsuspecting users to solve them via phishing attacks.

The best type of CAPTCHA is one the user never sees. As such, a honeypot CAPTCHA is one of the most effective and user-friendly options.

share|improve this answer
    
Thank you for the answer, I think I will use both a captcha and email verification, as you suggested. Thanks also for sharing the link, I will check out what honeypotCAPTCHA is. –  DannyCruzeira Aug 14 '12 at 20:32
    
+1: The first time a potential employer directed me to a site made to massively decode CAPTCHAs as work per hour, I thought it was hillarious, until I remembered I had one in my site's comments area. –  Ioannis Karadimas Aug 15 '12 at 6:58
add comment

I would try a CAPTCHA plus email verification, as others suggest, and see if it is good enough for your site. If it is, good, problem solved!

If that does not prove adequate, there are some other options you can consider:

  • Mobile phone verification. You ask the user to enter their mobile phone number, you send them a SMS (text message) with a code, and ask them to enter the code into the website. Or, you place an automated phone call to their landline. Think how Google Voice does it.

    However, many users may be reluctant to give you their phone number, for a variety of reasons, especially if you are not a very well-known brand (like Google or Apple).

  • Outsource the problem. For instance, you could require users to log in with Facebook.

    However, some users may be reluctant to log in with a Facebook account, e.g., for privacy reasons. Also, Facebook's defenses aren't perfect, either.

Be careful with these options. Don't be evil. These options can easily annoy users or drive users away, so be very reluctant to use them unless you have data to indicate they are needed (and maybe not even then). Demanding a user's phone number or Facebook account is very close to a "dark pattern".

share|improve this answer
    
I definitely agree with you about the potential annoyance with too many security measures, and I'm not sure where to put a limit. I guess I just have to make a decision and see how it works out. You also have a good point about suspicion if I require their phone numbers. I think I'll go with CAPTCHA, email verification, and possibly honeypot CAPTCHA. –  DannyCruzeira Aug 15 '12 at 11:18
add comment

Email confirmation and CAPTCHA solves different problems. The first one should be implemented when you want users to use their real e-mail address in the registration process. Email confirmation also protects us from identity theft. I cannot register by typed the whitehouse.gov emails address and pretend that I am the President ('cos I'm not able to click on the confirmation link sent to whitehouse.gov, because I'm not the owner of this address). So email confirmation allows to link each user to each email address.

However email confirmation doesn't protect us from the bots (as the CAPTCHA does). Honestly, almost every spam-bot I've seen had email confirmation implemented. It's really easy stuff and it's just a few lines of code to force our program to check emails and click on every activation links). The interesting detail is that some of that spam-bots used 123456 as the password to their webmails accounts.

So, let's talk about the CAPTCHA. It was created to distinguish human from the robot. Reading the text from the image, solve maths formulas, etc. The main problem is that online robots are still evolving. Their modules are upgrading, they haven't got problems with solving formulas, their OCR modules are better (so they are able to extract text from the image). All of these means that CAPTCHA is not the 100% protection against non-humans, but it's the first defense-line and it's very recommended.

The best CAPTCHA is the CAPTCHA which was implemented by you. Trust me, a lot of people try their luck with breaking popular CAPTCHA. Why? The answer is very easy here. Popular CAPTCHAS are used by a lot of website. If we can break that CAPTCHA, then we could put a lot of spam content on that websites. So if your website is not very popular and has own CAPTCHA implementation, I am pretty sure, that noone will lose their time and money to break your CAPTCHA. However if you are not sure how to implement it in the proper way, you could try non-obvious CAPTCHAs. Like image-base CAPTCHA (here is the example) or 3D CAPTCHA (another example).

share|improve this answer
    
Thank you for the detailed answer and for sharing the links ;D I also think that making your own CAPTCHA is better than using a really popular one, however making your own has its downsides too, for example since famous CAPTCHAS like reCAPTCHA are well tested, but I can definitely understand your point. Right now I have my own CAPTCHA on the site, but I think I will need to make it more non-obvious. –  DannyCruzeira Aug 15 '12 at 18:32
    
Now I'm curious, how does the bots create so many accounts? I mean, I'm sure that most popular sites like Gmail and Hotmail and Yahoo must have some sort of CAPTCHA or similar to prevent bots from creating account after account. –  DannyCruzeira Aug 15 '12 at 18:35
    
@Danny - you could ask that as a question if you like. –  Rory Alsop Aug 17 '12 at 12:00
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.