Forum anti-bot protection

[ckumarjha]

yeah that would be a much better option...... and would not cause much inconvenience to the legit users either

[zykal]

yeah I had to play with it a bit before I got the right mix. everytime is way to much only once is not enough.

keeping people happy while keeping bots out is a hard formula to achieve.

[Harkins]

I am in crazy on the Birkin Bags! Kim Kardashian loves Hermes. She bought 7 Hermes Birkin Bags for 1 time. It shows how charming of the Hermes Bags of Birkin. Many stars always buy theHermes Handbags or collect the Hermes Birkin, this fashion which cause everybody loves it.

Heh, the bot spams the anti-bot thread.

It's worth noting that bots outnumber regular users on the Members page, it's just that most of them don't post and get noticed. But I'd guess that nearly every account with a url and 0 post count is a bot.

[Nox]

Yea, I would vote for some cleanup

[MystressNyx]

I do notice and I deleted a huge number of inactive accounts just a couple months ago. It's not something I do on a day to day basis as they really have no impact on the users, only on our database, which is not suffering. I will be performing another round of cleanup today or 'morrow.

On a related note, a few people have mentioned various anti-bot methods, which I have not been ignoring. However, we are limited in what can be applied to the forum based on the fact that we use SMF (NOT known for their cutting edge or speedy modding) and the version, the latest without using an RC. I've been waiting for the mod community to play catch-up so as to avoid installing an unstable mod that would end up being more disruptive than a handful of spammers.

I've just installed an avatar verification step in which a potential user must click a picture in an array that matches a randomly chosen one before being allowed to register. This should be very effective against the actual bots, but it must also be realized that it's becoming more and more common to hire actual people to go through the sign up phase and then let loose bots to do the spamming. So there will always be things that get through, but I like to think that we keep on top of it pretty well along with the help of the community members who report the posts, so please have patience overall.

[Chris]

I meant you should make Codestryke write one for you It's just a simple modification of 2 pages. Official mods are probably useless because they code bots to override them.

Anyway, the solution I gave in the first post is tested, proven and nearly perfect. I know, because I use it and my forum is more tastier target and I have almost no bots (below 4 yearly) As for hiring people they are hired to solve captchas, no one will waste time to analyse a single website, it is just too expensive.

[MystressNyx]

Codestryke has better ways to spend his coding time than futzing with forum software which already has multitudes of people working on it. Not to mention that that then requires alterations with each forum upgrade and mod installation (I have at least 3 that interact with registration). It actually ends up being more work than it's worth in an environment which changes fairly often, as this forum does (in the background). Otherwise, I would have looked into doing it myself as I am not completely without basic coding knowledge.

I believe you misunderstood me about the latter part. I don't mean hiring people to break captchas for the purpose of bot teaching. There are quite a growing number of "companies" (for lack of a more rude term) that are hiring in many "work at home" forums. They pay people to sign up and verify their accounts, then provide the information to the company. The pay is pennies, but times are tough and often the people on those types of forums are willing to do a lot of work for every cent their can get.

[Chris]

I know I'm boring, but I would like to remind that there is a simple and nearly perfect solution which require only a tiny amount of custom coding to fend of 99.99% of bots. This include both automated spambots and human paid captcha breakers. The solution was tested and proven to work for many years on my forums (less than 1 bot per year). This would reduce the time you have to spend on fighting these manually and would let you use the time on more productive tasks like bathing in the sun while drinking a cold lemonade

You can reverse-engieneer the solution by visiting the register page on any of my forums or you can PM me (in case you made a solution that was very similar at a first glance but have not worked).

[Freyr]

The thing with question/answer verification methods are that it need to be simple enough for an "average" human can answer it, and complex enough that a bot wouldn't be able to.
Most, if not all, mathematical questions can be answer by bots, and even better.
All other questions with subjects such as animals, literature, music, etc. can be answer by a marginally intelligent bot.

Images, are better than text, that's a given. Just because it's harder to read.
What you actually need, is the client needs to do something, that only a human can.

To broaden on that subject, here are a few simple examples:
The usage of a webcam or microphone to record a sound in a certain key. This could be as simple as singing "merry had a little lamb".
The next would be to draw something, something like a question "what happened on 9/11?" which they would have to draw two towers and an airplane.
The other would be sense/touch/feeling, but it can't be generated by the system. This could be as simple as uploading an image, and the system in turn asks what's a specific item in the image.

The list can go on an on, but this topic has had too much discussion around the web by millions of developers.
There is no more need to go deeper into this, because your best bet is moderation, like has already been said here before.

[Jesterhead]

On all my websites I use a simple PHP generated image with a equasion.

Code: [Select]

x + y = ?
x and Y both under 10



As most bots are unable to read images, this will do.
If you ask for the current year (like the OP) the answer is always the same.. making it easier for bots?

[Freyr]

Actually, most bots are able to read the contents of an image because it's a very simple procedure.
Even I could develop a method to digest the contents of that image in under an hour; it's too simple, and even a system font(cut that down to 10 minutes).

In addition, it doesn't matter even if you use algebra equations, bots are much smarter than a human and can easily figure it out.

On all my websites I use a simple PHP generated image with a equasion.

Code: [Select]

x + y = ?
x and Y both under 10



As most bots are unable to read images, this will do.
If you ask for the current year (like the OP) the answer is always the same.. making it easier for bots?

[Jesterhead]

Then why can't they figure out captcha's? Or can they?

[Freyr]

One of the oldest, and most popular: http://en.wikipedia.org/wiki/XRumer

[Chris]

Once again I will make a futile attempt to persuade you to copy my anti bot protection. It works. It's simple. It's trivial to code. I protects also against humans paid to register to forums. It does not matter if you say if it is not possible to work, it still works in reality.

Check here: http://forum.homeoftheunderdogs.net/ This is a PR3 forum (BBGZ is PR2, so tastier to bots). I visit that forum like once per year, I have not even one moderator there.

[hiigara]

Once again I will make a futile attempt to persuade you to copy my anti bot protection. It works. It's simple. It's trivial to code. I protects also against humans paid to register to forums. It does not matter if you say if it is not possible to work, it still works in reality.

Check here: http://forum.homeoftheunderdogs.net/ This is a PR3 forum (BBGZ is PR2, so tastier to bots). I visit that forum like once per year, I have not even one moderator there.

It asks for the current year when you try to register. Your protection code is asking random questions?
When I refresh the page the question did not change though.

[Chris]

I'm not posting on a public forum where the trick is, PM me if you are consumed by curiousity

[Mutant]

The general solution employed by most people is to make use of a Spam DB, that registers IPs, email addresses and user names. I've employed this (using SMF plugins) and it works very well. It's stopping hundreds of spammers a week at the moment (I think they decided my forum was a good target in the last few weeks). No one has got through the net yet. It helps to combine them with CAPTCHAs and email verification as well (i.e. it's a mutli-pronged defence).