Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What type of captcha will you recommend? I am looking mainly at usability, ease of use (development too), relatively secure

Usability

I find that those captcha with very curly words/numbers are sometimes too unreadable. What I start to see in many applications are simple calculations "Whats 5 + 15". seems simple, but that should be easily crackable by bots, i'd expect?

Security

I am not working on a very secure app, u know just general web apps like project management, forums etc type apps. So I don't require hard core security which I think will be overkill and just mess up the code. I prefer something minimalistic & easy to use

I read about honey pot method too. Where I have a input thats hidden by css. The theory is that bots will fill up all fields. How true is that? That is simple to implement least intrusive, user does not need to do anything. Does it mean that I can just have that without captcha?

share|improve this question
add comment

migrated from programmers.stackexchange.com Dec 22 '11 at 14:40

This question came from our site for professional programmers interested in conceptual questions about software development.

7 Answers

There is no 100% secure protection.

All captchas can be cracked. Did you know for instance that there are firms in India which specialize in offering manforce to crack captchas?

There are also tricks like embedding your captchas as frames into other pages which invite their users to solve it to get access to interesting pictures.

I suggest you relax and make it simple. Try the following options one by one.

  1. Integrate with Akismet service
  2. Change the POST Url for your pages to something different. Bots will usually post to the same page Url, and if you won't accept such sumbissions it will keep bots out.
  3. Add a honeypot solution
  4. If 1, 2, 3 fail, add a captcha
share|improve this answer
    
Do you have source for "... Did you know for instance that there are firms in India which specialize in offering manforce to crack captchas?.." I am very much interested in know the company names –  Tech Jerk Dec 23 '10 at 13:36
3  
Do you want to apply there? :) –  Developer Art Dec 23 '10 at 13:43
1  
Aside from the manpower solution, there's the fact that image recognition and OCR is very good nowadays, and it's hard to reliably get one that humans can answer and bots can't. –  David Thornley Dec 23 '10 at 19:01
    
Citation for "change the post URL"? That doesn't sound like an effective strategy at all. –  mehaase Jul 30 '13 at 13:58
add comment
up vote 5 down vote accepted

As you said, the honeypot captcha is a good option, it's invisible to users and works in a lot of cases.

Another very good option is reCaptcha which is almost always easy enough to read.

share|improve this answer
    
reCaptcha is not easy enough. I often refresh 5-6 times before I get something readable. –  Developer Art Dec 23 '10 at 13:15
    
@Developer Art, really? I think I've only refreshed a reCaptcha once or twice ...ever. –  GoodEnough Dec 23 '10 at 13:27
    
reCaptcha has two words, one which is unknown by the system and one which is already known. The unknown word can be anywhere in the range of quite understandable to complete garbage, while the known word is usually very easily readable. The system can only check if you got the known word right, of course. Therefore: just try and get the more readable word right. That should save you some refreshs. And don't worry about spacing or accents, whether é is typed é or è or e doesn't matter. –  Felix Dombek Dec 23 '10 at 13:31
    
+1, reCaptcha is probably the easiest and best solution. –  Josh K Dec 23 '10 at 16:08
    
I guess just honeypot will be good enough? I am curious tho as to why bots don't fill up select fields only, I guess for most forms theres validation, so if they fill them with rubbish, validation will keep them out without a need for anti-bot mechanisms? –  jiewmeng Dec 24 '10 at 2:55
show 1 more comment

Something like this:

Captcha humor

share|improve this answer
1  
Is this now used on math.stackexchange.com or what? "Prove that you're worthy!" :-) –  Felix Dombek Dec 23 '10 at 13:36
    
Aside from the obvious problem that most people will not be able to solve it, there's the less obvious problem that there's probably a fairly small number of these, and the answers can be precalculated and entered automatically. –  David Thornley Dec 23 '10 at 18:59
    
haha ... maybe that will be for entry to phd maths class? –  jiewmeng Dec 24 '10 at 2:43
    
Just for the sake of curiosity: ln(2). may i pass? –  keppla Jul 7 '11 at 10:25
add comment

I would recommend no captcha. You should care about spammers, not your users.

share|improve this answer
add comment

Consider trying Confident CAPTCHA -- a free, picture-based captcha. You can see a demo of it here: http://demo.confidenttechnologies.com/captcha/

All the user has to do is follow the instructions to click on specific pictures. They don't have to decipher hard-to-read words or solve math problems. Plus, it's very secure against bots because computer vision is not advanced enough for bots to understand the instructions and intelligently identify the subject matter of the photos.

Let us know what you think of it. We're interested in hearing your feedback.

Thanks.

share|improve this answer
    
I think the idea is good. Easy to use too, tho I didn't get the images to show, my internet is quite crappy these days. As long as the images are easy to decipher for humans it should be ok. I find that the design can be improved and I think it does not have to show that many images taking quite abit of screen space, I think 3 will be fine –  jiewmeng Dec 24 '10 at 2:49
add comment

I've had very good results simply asking a question on the registration form that visitors in your domain can all answer, but someone outside the domain cant. For example, 'whats the name of the head coach of last year's league champions?', or 'whats the last name of the author of [some popular book]?', or 'whats the nickname for the company's cafeteria?'. Bots cant break those, and non-English (or whatever language you are using) speakers generally cant translate them well enough or arent familiar enough with the context to be able to answer them.

This of course assumes there is some binding element (employer, hobby, interests) that all your visitors share.

Generally speaking, if these are home grown apps you wont likely get a lot of attention from spammers unless your site is really big as they'll go after the more common packages since there's more of them (and thus a better payoff to writing a script to automate logins).

share|improve this answer
add comment

A picture based CAPTCHA system, if one wants to use one, would be my preference. What I dislike about my CAPTCHA's out there is for someone like me that has a hard time seeing/reading things with little contrast between colors is I end up either refreshing until I get something I can read or taking a guess.. And no, my eyesight is fine vision wise, purely a thing with contrast. I even find some web pages almost impossible to read because they designer didn't know how to pick good background/foreground colors for readability and went with "cool looking" instead.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.