Author Topic: Forum anti-bot protection (Read 5887 times)

Chris · « **on:** November 25, 2008, 04:15:44 AM »

The forum starts to be popular, soon we will be flooded by bots...

I find one type of protection very good, at the registration ask the user to "Type in the box the current year". Bots seem unable to pass through it on my forum so far. You would need to code it yourself, I haven't seen any module for this (maybe that's why bots do not know how to pass through it

)

As for all "human validation images" these are useless, and never stopped anything for me, some even say that recent computers are even better at reading these than average human.

Aliss · « **Reply #1 on:** November 25, 2008, 05:45:55 AM »

Good idea + have been very nice if will disable guest rights to create topic or post in topics.

mdshare · « **Reply #2 on:** December 17, 2008, 04:48:05 PM »

captcha gets passed so easy that it's pointless to use yet not if you place it different and not at the signup/register form

Have new users a captcha confirmation at their first (maybe 5) posts submits.

xrummer and other bots aren't so smart yet to check for captcha at the submit post.

raestlyn · « **Reply #3 on:** January 28, 2009, 03:45:08 AM »

CHECK this out. Now they can crack CAPTCHA even with JavaScript.

pavansss91 · « **Reply #4 on:** January 28, 2009, 06:07:24 AM »

whoa

die4me · « **Reply #5 on:** January 28, 2009, 01:11:22 PM »

This is not good. Here comes the bots lol

grimsage · « **Reply #6 on:** January 29, 2009, 03:50:02 PM »

captcha is kinda history, a good anti-bot script is needed

blindangel · « **Reply #7 on:** June 06, 2009, 06:09:24 AM »

I have recently spent many hours researching the whole captcha subject, and I have a great distaste for them to start with. Many bots can pass these images and yet someone like myself that uses an automated programme just to access the computer let alone the web is stopped by these images! its like What!... even these ones with audio accessibility features, I am not hearing impaired or using bad headphones or anything but they are for the most unintallegible ,

Soon the captcha or now the re-captcha will be a thing of the past as a couple of articles I have read stated that these annoying people using bots have gone one step futher and now hire Indian slave labourers to crack the captcha images for them and get paid $0.01 per image they crack, so even this idea of what year it is wont work for to long, once the idea gets out...

but for now it is the best we can do, although I think I will go with the mathmatical question so as it is more random and also accessible

well thats my rant on captcha's

travo · « **Reply #8 on:** June 08, 2009, 05:57:38 AM »

I actually had a go at cracking recaptchas last holidays.... Just to see if they are as good as they say. They use a session variable, which is deleted after 5 minutes or so, to grab the data from their database and display it in an image via gd or similar on their servers, so there is no way to crack them via codes, because they expire.

However, I then created another script which loaded up captchas like previously, but this time the image was anylsed by gd, and i saved the images of the 2 words onto the server. I then had to go through and chuck the word for each image into the database.

In the end I had 100 images and words in the database. I created yet another script, to pull up captchas and compare against my images. I let it run for 1 day. I camer back, my account had been terminated

Howver I had 3 emails saying I had encountered a matches of words. Im not sure what the accuracy was like, but the images were close enough for my script to get a word out of it.

My point to this is that even though they might be hard to ocr traditionally, if (and Ive read about it before too) these guys are getting paid to crack them, and Ive also heard people put them on (not gonna bring this site up with that word, fill in the blank) sites, 1 captcha per video, then recaptcha idsnt gonna be safe soon.

And whenever the world has its next big anti bot feature, the bots are gonna beat that eventually too.

Actually now that I think about it... where have I seen it before?

Found it http://news.cnet.com/8301-17938_105-10204300-1.html - 3D captchas!
Only problem is (sorry BlindAngel) that handicapped people will have a hard time doing it... Unless there was a sound for every image, but that would be way too hard IMO

Anyway, Im finally done

Qwerty · « **Reply #9 on:** July 06, 2009, 05:15:14 AM »

That AJAX example of breaking a CAPTCHA, the actual image wasn't very complex, the letters themselves were only sligtly tilted, and any overlay was white.

ckumarjha · « **Reply #10 on:** July 24, 2009, 11:04:35 AM »

I think the random simple maths is much better than the captcha system. And also he captcha is so much annoying

. On some sites the captcha are so scribbled and difficult to read that it takes me at least 2 attempts to get them right.

JGadrow · « **Reply #11 on:** July 24, 2009, 12:06:45 PM »

The problem with simple math is that it can still be read (and the result computed) by a bot program. I think the best solution is a question / answer system. However, even this system is defeated by cheap manual laborers.

In my opinion, the best defense against bots = moderators and spam filtering. Let the bots sign up for an account, but check postings for common spam tactics. Same as e-mail. Rather than building a system to be defeated by bots, build a system for defeating bots. Sure, spam filters aren't 100% effective but they can be pretty effective after enough has been caught and analyzed. However, with this method you don't create an accessiblity barrier for your site.

ckumarjha · « **Reply #12 on:** July 24, 2009, 12:39:15 PM »

I was thinking about this whole thing regarding blocking out bots and have just come up with a simple idea......
though i think it would cause a little bit of inconvenience to some people but i think this just might work.....

The only difference is that computers cannot think like humans can so devise such a method.....
for example a possible solution might be to ask simple questions (not maths or such which can be calculated). some thing like general knowledge stuff or something which can be easily searched on the web on sites like wiki. But obviously questions should be of such kind which would have only one word answers this would be easier to check on the server side... or in a different approach you could have a separate page where you could put up the questions and answers from where people could find it simple not much of a hassle i believe.... the second approach would be far less a inconvenience to the users i think
I am not sure whether this type of thing has already been tried though.... i will try this out to see what people think about it

Qwerty · « **Reply #13 on:** July 24, 2009, 06:55:32 PM »

Well why are there bots in the first place?

If you remove the reason they would want to go to your forum, chances are they won't come.

Scion · « **Reply #14 on:** July 25, 2009, 03:58:33 AM »

Quote from: Qwerty on July 24, 2009, 06:55:32 PM

Well why are there bots in the first place?

If you remove the reason they would want to go to your forum, chances are they won't come.

Sorry Qwerty i cant help myself.....there are bots in the first place because you (might) have people using your forum...so you could remove the reason....but a forum without any people.....i dunno

Unfortunately You and I and a good percentage of the internet population know these bots, spammers, and scammers for what they are....but the thing is there is allways a small percentage of people that are just venturing onto the net and some who were just born gullible that dont...actually im rather frightented about just how high that last group is, my dad allways told me "Theres no shortage of fools in this world", just another thing he was right about.

jannesiera · « **Reply #15 on:** July 25, 2009, 05:13:39 AM »

Quote from: Scion on July 25, 2009, 03:58:33 AM

Quote from: Qwerty on July 24, 2009, 06:55:32 PM
Well why are there bots in the first place?

If you remove the reason they would want to go to your forum, chances are they won't come.

Sorry Qwerty i cant help myself.....there are bots in the first place because you (might) have people using your forum...so you could remove the reason....but a forum without any people.....i dunno

Unfortunately You and I and a good percentage of the internet population know these bots, spammers, and scammers for what they are....but the thing is there is allways a small percentage of people that are just venturing onto the net and some who were just born gullible that dont...actually im rather frightented about just how high that last group is, my dad allways told me "Theres no shortage of fools in this world", just another thing he was right about.

My dad says exactly the same xD (but in Dutch then... )

Crazy-T · « **Reply #16 on:** July 25, 2009, 09:18:42 AM »

Why not like a captcha on register then one on posting on the forum. when you it say 20 posts the captcha turns off on your account?. Will slow the spam bot down i think ?

travo · « **Reply #17 on:** July 25, 2009, 07:43:51 PM »

I still think those 3D captchas are a good idea... Might take a bit of work to get going, but if you do it correctly.... As far as I know, theyre uncrackable by computer, and if you do it right, you can mabe make a 30 seconds wait time if they get it wrong, and after 4 attempts, ban for the day.

Crazy-T · « **Reply #18 on:** July 25, 2009, 08:02:54 PM »

This one looks alright.
http://www.thepcspy.com/kittenauth

Then here is what it looks like on the contact form.

http://www.thepcspy.com/contact

Sagefire135 · « **Reply #19 on:** July 25, 2009, 08:07:44 PM »

what about literally, a 3D captcha? instead of a image of a word, you get a video that rotates a 3D rendering of a word. the hard to read colors and letter positions that 2D captchas use plus the movement should make it harder for a computer to decode it.

If the rotation were such that half of the word could never be read all at once (have part of it be viable at one time, and the other part viable a little later) then a computer wouldnt be able to "see" the whole thing. i dont know how easy a computer could figure out to look for 2 halves and put them together though.

travo · « **Reply #20 on:** July 26, 2009, 07:30:26 AM »

Would probably take up too many resources though, because the video will need to be created every time the page is loaded....

I just found this http://pear.php.net/package/Image_3D I think that might be the way to make the images.... Import, rotate, scale, export... havent tested it, but seems like an alright idea to me lol.

zykal · « **Reply #21 on:** July 28, 2009, 03:29:52 PM »

I had forum bots whipe me out one time, overfilled my database and crashed everything.

a simple way to get around them is to make your own verification process.

the bots tend to look for programs others create for you to use so they can enter in the codes.

much harder if its self created by you. not widespread and no reason for them to try to personally crack your 1 website used method.

Sagefire135 · « **Reply #22 on:** July 28, 2009, 06:35:48 PM »

Ohh, thats not a bad idea at all...you mean something like: "what id your ID number ___", "what is your level ____", or "how much gold do you have? ____?" someone trying to join and spam their referral link would have to go through way more effort to have a bot get in. probably less effort to find a different site and spam there instead.

ckumarjha · « **Reply #23 on:** July 29, 2009, 11:28:31 AM »

that is a really good idea but again the same thing regarding inconvenience comes into play......... cause as a legit user i would not like to enter so many details again and again

zykal · « **Reply #24 on:** July 29, 2009, 04:49:38 PM »

but I'm sure you'd hate to sift thru 400 spam posts more

but yes you have a point there needs to be a balance.

I would just make it on registration and then for the first few posts, then ever so many after that.

News:

Author Topic: Forum anti-bot protection (Read 5887 times)