[BETA-RELEASE] Anti SPAM bot CAPTCHA v2

First I would like to thank the testers and their kind emails, I am glad the new mod/plugin/protection works well for you all.

But now I need to apologize because I did not update the installation page, sorry..... I have been working on adding IP management to the Administrative interface so I hope you will forgive me

I will update the manual tomorrow, promised.

Here is a screenshot, it is now possible to add/delete IPs, export and import IP. So it will be possible to create and share an IP database of good bots to speedup lookups. This will be released as v0.7 tomorrow.

Hosted on Fotki

I am very looking forward for this ^_^

OK CAPTCHAv2 0.7 is out, the plugin now comes with a setup script which generates the config.php file for you.
It also fixes a missing " in register.php for FluxBB 1.2.21

This looks pretty good now so I will continue to write documentation.

CAPTCHAv2 FluxBB mod/plugin
http://www.network-technologies.org/Pro … _bot_trap/

Other CAPTCHAv2 guides will be added here
http://www.network-technologies.org/Pro … /CAPTCHAv2

Yes, if all of the questions were math problems phrased in a similar format (ie: solve for X) you might be able to write something to do it.

Yes, if the list is small enough.

That's not what this mod is for, however.

This modification stops general spam attacks aimed at FluxBB forums or at forms in general. It requires the person registering to answer a question that a computer, stumbling upon the page, could not answer. A bot that targets a specific site (and thus can afford to have a full list of answers) or a user registering manually could bypass this protection. That doesn't take away from the fact that it does cut down on a specific type of spam.

Spam is a complex issue and there is no panacea for it. This modification solves the issue of mass-spamming but does not protect against a targeted attack; a CAPTCHA would protect (somewhat) against mass-spamming and targeted attacks, with the downside that as a specific system becomes more used, it will be more likely to be attacked; restrictions on links in signatures, posts, etc would discourage targeted attacks (since there's no reason to target your site if the link won't go through) but do nothing to stop mass-spamming (since mass-spammers care about the quantity of their efforts, not the quality).

Smartys is correct, using one system everywhere is never a good idea. It get more and more reports from users that Re-CAPTCHA has become useless.
The more people use any given system the more incentive a SPAM bot writer has to write a bot to break the CAPTCHA. And even when the 100% SPAM bot protection CAPTCHA is created it will simply be circumvented by cheap labor.
There was an article on Slashdot a few months ago about companies in 3rd World Countries offering "a guaranteed CAPTCHA breaking service". They have humans sitting at the computer doing nothing but answering CAPTCHA challenges so your bot can keep on working.
It works something like this: Bot hits your page, detects captcha => send CAPTCHA to company ABC, employee answers CAPTCHA => answer is send back to the bot who can now subscribe/submit/SPAM
Prices for breaking CAPTCHAs is about $0.008 to $0.005 per image in packs of 1000 to 100000 images. As you can see, there is no perfect system.

As far as questions goes, yes the question "What does 1+1 equal to?" is useless but the question
"Please remove the letters X and Y from the following word: cXaYXpiXXtalYisXm" is pretty good right now. The advantage of CAPTCHAv2 is that you create the questions and answers, so unlike the randomly generated implementations which always expect a 6 to 8 letter input. CAPTCHAv2's answer can vary from a single word to a full sentence.

I have created a few pages explaining CAPTCHAv2 in greater detail and how to use it as a bot trap. You can find the guides here:
http://www.network-technologies.org/tiny.php?id=1

Question: what's your opinon on potential effectiveness of using time delay in combination with some of these methods?
I.e., say you set up a delay for the captcha/question/etc  before it will appear to the user.
And maybe once you pass one, you wait on the next page until the next one prompts you... kind of thing.
You explain to the human being to wait, and why, etc.

It occurred to me because after, say, defeating a bot, the site potentially gets forwarded off to a human being.   It seems they get paid per item, and isn't there a time figured in to how it is worth their while?  I.e.....  if it takes longer than, say, X.Xmins ..wouldn't they dump it and move on?

I could imagine that, as an honest registering person, I would be fairly unconcerned with having to wait a bit as I jump thru some hoops.

Interesting, JAcky.

Would the same problem be true for implementing a php page redirection (-method)  with a delay?

Hmmm... and, what about using a flash thingy...
- make it so the visitor must click on it to "make it go",
- then it has to play out before you get to the prompting material (for filling out) -- whether directly or via a 'buried' page redirection.
- it would also thus require the user enables flash, which I abhore in most cases, but maybe there is a benefit with this (for handling bots?)

I am not th expert in these things, so I have no under-the-hood clue how these ideas may weigh in.