<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0">
	<channel>
		<title><![CDATA[FluxBB.org Forums - [BETA-RELEASE] Anti SPAM bot CAPTCHA v2]]></title>
		<link>http://fluxbb.org/forums/topic/3051/betarelease-anti-spam-bot-captcha-v2/</link>
		<description><![CDATA[The most recent posts in [BETA-RELEASE] Anti SPAM bot CAPTCHA v2.]]></description>
		<lastBuildDate>Sat, 20 Feb 2010 14:37:06 +0000</lastBuildDate>
		<generator>FluxBB</generator>
		<item>
			<title><![CDATA[Re: [BETA-RELEASE] Anti SPAM bot CAPTCHA v2]]></title>
			<link>http://fluxbb.org/forums/post/29011/#p29011</link>
			<description><![CDATA[[quote=twohawks]Interesting, JAcky.

Would the same problem be true for implementing a php page redirection (-method)  with a delay?[/quote]

I just had an idea while reading a book. it is so simple .... duhhhh

1) record the timestamp when the user clicks on Submit
2) Implement delay clientside via html meta or javascript
3) Compare timestamp to delay value on the landing page.
4a) timestamp + dely matches, user is ok
4b) does not match, user cheated

This can be handled in a couple of lines of code so it will not add any major load to the server.

I have a few things on my plate ATM but I will try to test this soon.

A 1sec delay should not bother most users and if it is implemennted in javascript might weed a lot of bots right there.

sry for not using spellcheck, I don,t think that my N900 has that feature yet :)]]></description>
			<author><![CDATA[dummy@example.com (JAcky)]]></author>
			<pubDate>Sat, 20 Feb 2010 14:37:06 +0000</pubDate>
			<guid>http://fluxbb.org/forums/post/29011/#p29011</guid>
		</item>
		<item>
			<title><![CDATA[Re: [BETA-RELEASE] Anti SPAM bot CAPTCHA v2]]></title>
			<link>http://fluxbb.org/forums/post/27867/#p27867</link>
			<description><![CDATA[[quote=twohawks]Interesting, JAcky.
* Would the same problem be true for implementing a php page redirection (-method)  with a delay?
.....
* Hmmm... and, what about using a flash thingy...[/quote]

If you handle the redirect like this:
1) User enters via index.php and is prompted for a CAPTCHA
2) index.php will send the CAPTCHA answer to delay.php
3) delay.php will pause execution for 2 seconds before passing the provided info to validate.php AND sends a token to validate.php, so it can verify that it was not called directly.

The problem with this approach is that someone can easily take down the webserver by calling [url]http://localhost.local/delay.php[/url] a few thousand times a second. Since each run of delay.php will stay in memory for over 2 seconds it can be used to consume all available memory until the server goes boom. This will be really quick if executed from multiple computers and multiple Internet connections .... think WinNuke :)

Flash is nice for playing videos but even there it is lacking. IMHO, using flash in webdesign is like writing a website so it will only work with IE.]]></description>
			<author><![CDATA[dummy@example.com (JAcky)]]></author>
			<pubDate>Tue, 19 Jan 2010 13:24:32 +0000</pubDate>
			<guid>http://fluxbb.org/forums/post/27867/#p27867</guid>
		</item>
		<item>
			<title><![CDATA[Re: [BETA-RELEASE] Anti SPAM bot CAPTCHA v2]]></title>
			<link>http://fluxbb.org/forums/post/27105/#p27105</link>
			<description><![CDATA[Interesting, JAcky.

Would the same problem be true for implementing a php page redirection (-method)  with a delay?

Hmmm... and, what about using a flash thingy...
 - make it so the visitor must click on it to "make it go",
 - then it has to play out before you get to the prompting material (for filling out) -- whether directly or via a 'buried' page redirection.
 - it would also thus require the user enables flash, which I abhore in most cases, but maybe there is a benefit with this (for handling bots?)

I am not th expert in these things, so I have no under-the-hood clue how these ideas may weigh in.]]></description>
			<author><![CDATA[dummy@example.com (twohawks)]]></author>
			<pubDate>Thu, 17 Dec 2009 21:21:09 +0000</pubDate>
			<guid>http://fluxbb.org/forums/post/27105/#p27105</guid>
		</item>
		<item>
			<title><![CDATA[Re: [BETA-RELEASE] Anti SPAM bot CAPTCHA v2]]></title>
			<link>http://fluxbb.org/forums/post/27091/#p27091</link>
			<description><![CDATA[[quote=twohawks]Question: what's your opinon on potential effectiveness of using time delay in combination with some of these methods?
I.e., say you set up a delay for the captcha/question/etc  before it will appear to the user.
And maybe once you pass one, you wait on the next page until the next one prompts you... kind of thing.
You explain to the human being to wait, and why, etc.[/quote]

AFAIK the problem with a time delay is that it is either implemented on the server, in the php script, or on the client side by using javascript. If you know of another way, let me know and I'll consider it.

Delaying the execution in the php script opens the door for a DOS attack since the php script will pause, consuming resources while sitting idle. 
Imagine 10000 connections attempting to open the CAPTCHA script. Without a delay the script would execute in a fraction of a second. 
With a 2 second delay you could have thousands of scripts stuck in an idle loop, each one consuming server resources until the server runs out of resources and goes boom.

IMHO, implementing this in javascript is as pointless as any other javascript protection method, like disabling submit buttons, since javascript can be easily turned off.

CAPTCHAv2 can delay a bot attempting to brute force the captcha by writing the IP to the .htaccess file which will prevent the bot from breaking into the forum.]]></description>
			<author><![CDATA[dummy@example.com (JAcky)]]></author>
			<pubDate>Thu, 17 Dec 2009 10:03:05 +0000</pubDate>
			<guid>http://fluxbb.org/forums/post/27091/#p27091</guid>
		</item>
		<item>
			<title><![CDATA[Re: [BETA-RELEASE] Anti SPAM bot CAPTCHA v2]]></title>
			<link>http://fluxbb.org/forums/post/27055/#p27055</link>
			<description><![CDATA[Question: what's your opinon on potential effectiveness of using time delay in combination with some of these methods?
I.e., say you set up a delay for the captcha/question/etc  before it will appear to the user.
And maybe once you pass one, you wait on the next page until the next one prompts you... kind of thing.
You explain to the human being to wait, and why, etc.

It occurred to me because after, say, defeating a bot, the site potentially gets forwarded off to a human being.   It seems they get paid per item, and isn't there a time figured in to how it is worth their while?  I.e.....  if it takes longer than, say, X.Xmins ..wouldn't they dump it and move on?

I could imagine that, as an honest registering person, I would be fairly unconcerned with having to wait a bit as I jump thru some hoops.]]></description>
			<author><![CDATA[dummy@example.com (twohawks)]]></author>
			<pubDate>Wed, 16 Dec 2009 00:47:43 +0000</pubDate>
			<guid>http://fluxbb.org/forums/post/27055/#p27055</guid>
		</item>
		<item>
			<title><![CDATA[Re: [BETA-RELEASE] Anti SPAM bot CAPTCHA v2]]></title>
			<link>http://fluxbb.org/forums/post/26963/#p26963</link>
			<description><![CDATA[Thank you, somehow I missed that :D]]></description>
			<author><![CDATA[dummy@example.com (sagar)]]></author>
			<pubDate>Mon, 14 Dec 2009 14:52:02 +0000</pubDate>
			<guid>http://fluxbb.org/forums/post/26963/#p26963</guid>
		</item>
		<item>
			<title><![CDATA[Re: [BETA-RELEASE] Anti SPAM bot CAPTCHA v2]]></title>
			<link>http://fluxbb.org/forums/post/26961/#p26961</link>
			<description><![CDATA[[quote=JAcky]Requirements:
- FluxBB version 1.4 BETA or 1.2.21
[/quote]]]></description>
			<author><![CDATA[dummy@example.com (Franz)]]></author>
			<pubDate>Mon, 14 Dec 2009 14:39:54 +0000</pubDate>
			<guid>http://fluxbb.org/forums/post/26961/#p26961</guid>
		</item>
		<item>
			<title><![CDATA[Re: [BETA-RELEASE] Anti SPAM bot CAPTCHA v2]]></title>
			<link>http://fluxbb.org/forums/post/26960/#p26960</link>
			<description><![CDATA[Will this work with 1.4beta?]]></description>
			<author><![CDATA[dummy@example.com (sagar)]]></author>
			<pubDate>Mon, 14 Dec 2009 14:27:19 +0000</pubDate>
			<guid>http://fluxbb.org/forums/post/26960/#p26960</guid>
		</item>
		<item>
			<title><![CDATA[Re: [BETA-RELEASE] Anti SPAM bot CAPTCHA v2]]></title>
			<link>http://fluxbb.org/forums/post/24476/#p24476</link>
			<description><![CDATA[Smartys is correct, using one system everywhere is never a good idea. It get more and more reports from users that Re-CAPTCHA has become useless.
The more people use any given system the more incentive a SPAM bot writer has to write a bot to break the CAPTCHA. And even when the 100% SPAM bot protection CAPTCHA is created it will simply be circumvented by cheap labor. 
There was an article on Slashdot a few months ago about companies in 3rd World Countries offering "a guaranteed CAPTCHA breaking service". They have humans sitting at the computer doing nothing but answering CAPTCHA challenges so your bot can keep on working.
It works something like this: Bot hits your page, detects captcha => send CAPTCHA to company ABC, employee answers CAPTCHA => answer is send back to the bot who can now subscribe/submit/SPAM
Prices for breaking CAPTCHAs is about $0.008 to $0.005 per image in packs of 1000 to 100000 images. As you can see, there is no perfect system.

As far as questions goes, yes the question "What does 1+1 equal to?" is useless but the question 
"Please remove the letters X and Y from the following word: cXaYXpiXXtalYisXm" is pretty good right now. The advantage of CAPTCHAv2 is that you create the questions and answers, so unlike the randomly generated implementations which always expect a 6 to 8 letter input. CAPTCHAv2's answer can vary from a single word to a full sentence.

I have created a few pages explaining CAPTCHAv2 in greater detail and how to use it as a bot trap. You can find the guides here:
[url]http://www.network-technologies.org/tiny.php?id=1[/url]]]></description>
			<author><![CDATA[dummy@example.com (JAcky)]]></author>
			<pubDate>Sun, 19 Jul 2009 20:19:21 +0000</pubDate>
			<guid>http://fluxbb.org/forums/post/24476/#p24476</guid>
		</item>
		<item>
			<title><![CDATA[Re: [BETA-RELEASE] Anti SPAM bot CAPTCHA v2]]></title>
			<link>http://fluxbb.org/forums/post/24424/#p24424</link>
			<description><![CDATA[True enough - I guess spam should indeed be taken on a case by case basis.]]></description>
			<author><![CDATA[dummy@example.com (xSDMx)]]></author>
			<pubDate>Sat, 18 Jul 2009 00:50:15 +0000</pubDate>
			<guid>http://fluxbb.org/forums/post/24424/#p24424</guid>
		</item>
		<item>
			<title><![CDATA[Re: [BETA-RELEASE] Anti SPAM bot CAPTCHA v2]]></title>
			<link>http://fluxbb.org/forums/post/24423/#p24423</link>
			<description><![CDATA[[quote=xSDMx]Couldn't a bot be easily made to read the text off of the page, and run it in a calculator?[/quote]
Yes, if all of the questions were math problems phrased in a similar format (ie: solve for X) you might be able to write something to do it.

[quote=xSDMx]Or, couldn't someone crack the entire user generated list manually and feed it to their bot?[/quote]
Yes, if the list is small enough.

That's not what this mod is for, however.

This modification stops general spam attacks aimed at FluxBB forums or at forms in general. It requires the person registering to answer a question that a computer, stumbling upon the page, could not answer. A bot that targets a specific site (and thus can afford to have a full list of answers) or a user registering manually could bypass this protection. That doesn't take away from the fact that it does cut down on a specific type of spam.

Spam is a complex issue and there is no panacea for it. This modification solves the issue of mass-spamming but does not protect against a targeted attack; a CAPTCHA would protect (somewhat) against mass-spamming and targeted attacks, with the downside that as a specific system becomes more used, it will be more likely to be attacked; restrictions on links in signatures, posts, etc would discourage targeted attacks (since there's no reason to target your site if the link won't go through) but do nothing to stop mass-spamming (since mass-spammers care about the quantity of their efforts, not the quality).]]></description>
			<author><![CDATA[dummy@example.com (Smartys)]]></author>
			<pubDate>Sat, 18 Jul 2009 00:42:09 +0000</pubDate>
			<guid>http://fluxbb.org/forums/post/24423/#p24423</guid>
		</item>
		<item>
			<title><![CDATA[Re: [BETA-RELEASE] Anti SPAM bot CAPTCHA v2]]></title>
			<link>http://fluxbb.org/forums/post/24422/#p24422</link>
			<description><![CDATA[Couldn't a bot be easily made to read the text off of the page, and run it in a calculator? Or, couldn't someone crack the entire user generated list manually and feed it to their bot?]]></description>
			<author><![CDATA[dummy@example.com (xSDMx)]]></author>
			<pubDate>Sat, 18 Jul 2009 00:26:25 +0000</pubDate>
			<guid>http://fluxbb.org/forums/post/24422/#p24422</guid>
		</item>
		<item>
			<title><![CDATA[Re: [BETA-RELEASE] Anti SPAM bot CAPTCHA v2]]></title>
			<link>http://fluxbb.org/forums/post/24107/#p24107</link>
			<description><![CDATA[OK CAPTCHAv2 0.7 is out, the plugin now comes with a setup script which generates the config.php file for you.
It also fixes a missing " in register.php for FluxBB 1.2.21

This looks pretty good now so I will continue to write documentation.

CAPTCHAv2 FluxBB mod/plugin
[url]http://www.network-technologies.org/Projects/Virtual_Brain_Online.php/article/fluxbb_auto_blocking_captcha_bot_trap/[/url]

Other CAPTCHAv2 guides will be added here
[url]http://www.network-technologies.org/Projects/Virtual_Brain_Online.php/category/CAPTCHAv2[/url]]]></description>
			<author><![CDATA[dummy@example.com (JAcky)]]></author>
			<pubDate>Fri, 03 Jul 2009 14:25:36 +0000</pubDate>
			<guid>http://fluxbb.org/forums/post/24107/#p24107</guid>
		</item>
		<item>
			<title><![CDATA[Re: [BETA-RELEASE] Anti SPAM bot CAPTCHA v2]]></title>
			<link>http://fluxbb.org/forums/post/24082/#p24082</link>
			<description><![CDATA[I have been writing a lot of documentation but have not updated the guide because I decided to write a installer script which will create the separate config file this CAPTCHA implementation requires. So a little longer and it will be easy to use AND easy to install....]]></description>
			<author><![CDATA[dummy@example.com (JAcky)]]></author>
			<pubDate>Thu, 02 Jul 2009 07:05:05 +0000</pubDate>
			<guid>http://fluxbb.org/forums/post/24082/#p24082</guid>
		</item>
		<item>
			<title><![CDATA[Re: [BETA-RELEASE] Anti SPAM bot CAPTCHA v2]]></title>
			<link>http://fluxbb.org/forums/post/24081/#p24081</link>
			<description><![CDATA[I am very looking forward for this ^_^]]></description>
			<author><![CDATA[dummy@example.com (barlos)]]></author>
			<pubDate>Thu, 02 Jul 2009 06:56:16 +0000</pubDate>
			<guid>http://fluxbb.org/forums/post/24081/#p24081</guid>
		</item>
	</channel>
</rss>
