Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to beat comment spam

dendory.net

Post reply on HN
Print view View original

101–107 of 107 posts

Re: How to beat comment spam

#101

Post by pbhjpbhj »

mikeash wrote: post #93

It's important to note that it's extremely easy to "beat" comment spam if you have a relatively low-traffic site and some programming time to spend on a custom solution. The per-message payoff for spam is horrendously low. Spammers only do it because they can post a huge number of messages. The big threats are necessarily automated, and that automation isn't going to bother with special cases for any site that isn't…

I use a dummy field on one site - called something like "Last Name" - the contents of which are hidden and must not be changed. The field contents are clear they must not be changed - "Do not alter this field!" - so that it still works for a wanted user if CSS has been tampered with.

No spam yet. But it's quite a small site, probably this is over only about 6Million hits.

For all I know it's just because it's a hand-coded site. Trying this on a WP site is on my todo list.

Re: How to beat comment spam

#103

Post by necro »

hashtree wrote: post #89

One thing that really helps: Server-side, encrypt a token which, including representing the unique form instance, contains a tick count and set a hidden input's value to it. Now, ensure that each form instance cannot be submitted more than once AND that the delta between the current tick count and the form's tick count is greater than or equal to the amount of time that would be need for a human to fill out the form.…

I added something similar to our framework where we do the encryption server side when a form is generated. In our token we encrypt a form generation time and captcha question and answer variables. This allows us to easily render on the form a textual or graphical captcha and pass the answer encrypted. The form processing simply decrypts the data and decides one, if a form is too fast or stale based on the difference of the form generation and submit time and two, it compares the captcha answer to that which was passed in the encrypted token.

Re: How to beat comment spam

#104

Post by kanzure »

JimWestergren wrote: post #62

With 5 lines of PHP I was able to block 94,94% of the spam on a WordPress blog. I simply checked how long time it took for reading my article, writing and submitting a comment. Less than 10 seconds = block with a friendly message. Code and more details here: http://www.jimwestergren.com/a-new-approach-to-block-web-spa...

> I simply checked how long time it took for reading my article, writing and submitting a comment. Less than 10 seconds = block with a friendly message

Some of the bots simulate mouse movements, some of them even inject letters/words into textarea elements as if someone is typing. It's not that hard to make it look like someone is correcting typos.

Re: How to beat comment spam

#105

Post by kalleboo »

I just thought of this method: randomize the input names on each form load, and include they key to the hash in a hidden field. This way the bot would have to be smart enough to go off field order instead of name (you could even randomize field order using some clever CSS). Or are they already smart enough to deal with that?

Re: How to beat comment spam

#106

Post by mikeash »

jentulman wrote: post #97
mikeash wrote: post #93

It's important to note that it's extremely easy to "beat" comment spam if you have a relatively low-traffic site and some programming time to spend on a custom solution. The per-message payoff for spam is horrendously low. Spammers only do it because they can post a huge number of messages. The big threats are necessarily automated, and that automation isn't going to bother with special cases for any site that isn't…

Regardless of spam protection, I like the idea of a 'deep breath and count to ten' being forced on a commenter before they can submit and I'd love to know what an impact that might have on comment quality somewhere like youtube.

I didn't think of that when I first wrote the thing. Only after I activated it did I have a reader point out that it would cause people with short comments to have to wait to reply, talking about it as a bad thing. My immediate reaction was, this is great!

Re: How to beat comment spam

#107

Post by vinc »

pbhjpbhj wrote: post #101
mikeash wrote: post #93

It's important to note that it's extremely easy to "beat" comment spam if you have a relatively low-traffic site and some programming time to spend on a custom solution. The per-message payoff for spam is horrendously low. Spammers only do it because they can post a huge number of messages. The big threats are necessarily automated, and that automation isn't going to bother with special cases for any site that isn't…

I use a dummy field on one site - called something like "Last Name" - the contents of which are hidden and must not be changed. The field contents are clear they must not be changed - "Do not alter this field!" - so that it still works for a wanted user if CSS has been tampered with. No spam yet. But it's quite a small site, probably this is over only about 6Million hits. For all I know it's just because it's a hand-…

I used this solution on a network of WP blogs with moderate traffic (maybe somewhere around 100 to 500k+ visits per month at best) but after a while some spammers took the time to script their way into the comments.
Post reply on HN