11–20 of 24 posts
Hi Prefinem, Include a small piece of Javascript that sets a hidden field in your form to some password when the page loads. Then, when the form is posted, verify on the server that that field has been set to the password. This should get rid of most of your spam. The reason it works is that you are being hit with spam from a program called "Xrumer", which doesn't emulate the Javascript of the pages it interacts with…
If so, I know it wasn't a human that submitted the post - they could not see it - whilst automated spam tools seemingly cannot resist entering something in that field. I emailed suspect postings to myself with IP address info to add them to an IP block-list later, but showed them a fake "success" page or a "your post has been selected for moderation" page. The latter turned out to be more effective as it resulted in fewer repeated attempts.
I removed the annoying reCaptcha code altogether as a test, and never had to reinstate it. Real users hated the reCaptcha thing anyhow.
I've had a lot of success by including a field called email in my form, hiding it with css so humans cannot see it, and whenever a submission/login request/post is received, I merely check to see if the email field has been set. If so, I know it wasn't a human that submitted the post - they could not see it - whilst automated spam tools seemingly cannot resist entering something in that field. I emailed suspect posti…
Earlier quoted context omitted.
Perhaps as an experiment try "enter the first character of your post/comment". That would kill any remote human captcha solvers (since they don't actually know the post content), and likely require some rewriting of the spamming software, assuming that is automated. Of course, this is not a long term perfect solution against motivated adversaries, but it's a way to see how the current spammers work. Another: Add a ke…
That is a great idea... much simpler than I had imagined. I will implement this tomorrow to base off results from today
1) The form was recently submitted (i.e. you cannot submit forms from two hours ago). Done well with another approach I take, this also catches bots that try to resubmit already cracked form instances. This is a bigger issue than you might give it credit for. Often they will crack a form instance by hand and then submit variations of fields they care to spam in programatically. Crack once by hand, submit spam 10000 times automatically therafter.
2) That the delta between receiving the form submission and when it was generated is greater than how long the fastest human would take.
It has a throttling effect to spamming (if nothing else), in addition to preventing most programatic spam. It is also nice that it does not depend on client-side javascript that can be tampered with. Used in combination with some other approaches, I have several sites that serve millions of users a year that all but remove the need for captchas (contact me if you are interested).
Earlier quoted context omitted.
I am not sure how to tell if it targeting the site. I will look into creating another captcha to see if that will help
Perhaps as an experiment try "enter the first character of your post/comment". That would kill any remote human captcha solvers (since they don't actually know the post content), and likely require some rewriting of the spamming software, assuming that is automated. Of course, this is not a long term perfect solution against motivated adversaries, but it's a way to see how the current spammers work. Another: Add a ke…
One time tested approach for me is to very precisely measure how long the fastest human could fill out a specific form in ms (must be done per form, and must consider browser autofilling). Then, include an encrypted timestamp value as a hidden field value on said form and check that: 1) The form was recently submitted (i.e. you cannot submit forms from two hours ago). Done well with another approach I take, this also…
I've had a lot of success by including a field called email in my form, hiding it with css so humans cannot see it, and whenever a submission/login request/post is received, I merely check to see if the email field has been set. If so, I know it wasn't a human that submitted the post - they could not see it - whilst automated spam tools seemingly cannot resist entering something in that field. I emailed suspect posti…
Earlier quoted context omitted.
Perhaps as an experiment try "enter the first character of your post/comment". That would kill any remote human captcha solvers (since they don't actually know the post content), and likely require some rewriting of the spamming software, assuming that is automated. Of course, this is not a long term perfect solution against motivated adversaries, but it's a way to see how the current spammers work. Another: Add a ke…
They're both good ideas, but bear in mind that the keydown detection may trigger under other conditions (eg I use a plugin to let me edit text fields in external vim. People pasting quotes/urls could also be odd keystroke numbers)