Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

There are a variety of different forms of CAPTCHA and other strategies in order to prevent spam. To briefly list a few:

  • Simple math or word questions.
  • Obfuscated text.
  • JavaScript-based CAPTCHAs.
  • Image CAPTCHAs.
  • Honeypots.
  • Audio CAPTCHAs.
  • Rule-based filtering like Akismet.
  • Gradual increase in privileges based on trust.
  • Community moderation like StackExchange.
  • Spam disincentives like nofollow attributes to links.
  • Incentives for posting good content.
  • Admin moderation.
  • IP whitelists and blacklists.
  • Public shaming and disgrace.

Each one of these approaches has obstacles to overcome due to accessibility issues, technical limitations, time restrictions, conversion problems, or size of community. The systems that I've seen working best are a combination of several of the above techniques. However, I can't help but feel as if we're missing something important when it comes to combating spam.

I know that it may be too much to wish for a single one-size-fits-all solution, but perhaps spam prevention could be approached from a different angle. I suspect that there may be more to explore in terms of the way the user interface influences human behavior.

I find that having constraints often triggers creativity, so given the following constraints, can we come up with any new tools to add to our arsenal against spam from a user interface perspective?

  1. It must be accessible.
  2. It must be non-disruptive and transparent to the end user.
  3. It cannot detract or distract from the primary purpose of the page.
  4. It must be automated or require very little moderation on a large scale.
  5. It cannot be a 3rd-party service.
share|improve this question
    
You might find that the only thing satisfying all those requirements is no CAPTCHA at all. But I eagerly await answers from more creative people :) –  DisgruntledGoat Nov 17 '10 at 2:00
1  
Not within your constraints but for login situations just use open id. This takes care of a lot of spam problems. I usually no longer even register for sites without open-id. –  George Mauer Nov 18 '10 at 21:48
    
"Community censorship" sounds really ugly. No one is actually censored on SE/SO. Very few posts actually get deleted or have their content edited out. Spam filtering is just that--it's filtering. You wouldn't call Gmail's spam filters "spam censorship". Likewise, SO/SE simply uses collaborative filtering to emphasize high quality posts and de-emphasize low quality posts. It's similar to the PR system that Google uses where the "votes" are backlinks. –  Lèse majesté Nov 18 '10 at 22:43
    
Perhaps community moderation would have been better. I'll change it. –  Virtuosi Media Nov 18 '10 at 22:48
    
@VirtuosiMedia Spam is more a result of submitting your information to an organization that sells it or content scraping (which only requires a person create a single account to access that site). –  Tucker Nov 19 '10 at 18:01

6 Answers 6

I just read a very interesting article on the matter a few days ago. It has creative alternatives, you should check it out

http://webdesignledger.com/tips/why-you-should-stop-using-captchas

share|improve this answer
2  
Thanks, Pam. I've been thinking about this for a while, but my frustration with that article was one of the things that sparked this question. Unfortunately, he doesn't really add anything new. The title says stop using CAPTCHAs, but ironically, 5/7 things suggested are a form of CAPTCHA. The other 2 things are to use Akismet or just put up with the spam. –  Virtuosi Media Nov 17 '10 at 4:03
    
Photo CAPTCHAs are a good alternative if you have a large enough database of images to implement it through, as you cannot simply generate such images. However, the arithmetic CAPTCHA described by that author seems really easy to break. You're essentially telling the browser to verify the answer, violating one of the elementary security principles in web development: never trust the client. That solution only works so long as your website is obscure and the script is not widely used. –  Lèse majesté Nov 18 '10 at 22:34

I'm wondering if we can exploit some of the physical properties that differ between real people using browsers and spambots.

The two properties that come to mind for me are sequence and pace.

Sequence: A real person will download a page before submitting a comment; some spambots jump straight to sending a form submission.

Can we detect whether we've previously served the form to that user and reject submissions where they've not downloaded the form?

Pace: A real person will typically take a few seconds to a few minutes to enter their comment before hitting submit; a spambot might download the page and immediately submit the spam comment.

Is it reasonable to reject submissions that occur too quickly (say, < 2 seconds) or too slowly (say, > 24 hours)?

share|improve this answer
    
+1 - This is more the type of answer I was hoping for. –  Virtuosi Media Nov 18 '10 at 22:55
1  
For one form I worked on we kept track of the time (and other factors like repeated use of the same IP etc). Anything under 30 seconds was flagged as possible spam. If required you could then manually check the flagged as spam entries for possible humans. –  Leah Nov 19 '10 at 2:20
4  
I think the form sequence verification is a pretty common default in the web frameworks of today, and is also easily circumvented by the bots by simply following the sequence. –  Oskar Duveborn Nov 21 '10 at 16:42
    
Interesting albeit short article here 90percentofeverything.com/2011/03/25/fk-captcha which I think is win. –  iambeano Apr 9 '11 at 0:54
1  
As someone who's written bots (not spambots...), I can tell you that: a) some websites do do this, b) it doesn't work because the bot writer can work out that the website's doing it and program the bot to act realistically, and c) it hurts real users because it tends to slow things down and / or produce annoying false positives. –  Duncan Matheson Mar 5 '13 at 4:17

What if a small game was used as a test? A simple puzzle that keeps users entertained so they don't really notice it's for spam prevention... like a simplified version of Crayon Physics.

share|improve this answer
3  
I don't see how that could be used as a CAPTCHA. Sure, it'd be nice if the CAPTCHA were fun. But there aren't any that are, except for maybe photo CAPTCHAs. Also, you don't want the CAPTCHA to take as long to complete as writing a comment or whatever the user is actually trying to do. There aren't too many fun games that you can play in under 10 seconds, which is about how long a reCAPTCHA takes to solve (usually far less; more around 3-4 seconds). –  Lèse majesté Nov 19 '10 at 17:19
    
It doesn't have to be fun, just mildly entertaining. Simple things like "move this object here" or "draw this shape mirrored" would be pretty quick and easy. –  user2588 Nov 19 '10 at 17:43
1  
Fair enough, but how would those tasks identify a user as human/computer? Mouse movement and typing pattern can be used to identify specific users, but I'm thinking that it would be very easy to replicate a random user's typing/mouse patterns by machine. –  Lèse majesté Nov 19 '10 at 19:09
4  
Another roadblock is that it would probably have to be implemented in JavaScript, Flash, or Silverlight; all of which can be turned off and could present accessibility issues. –  Virtuosi Media Nov 19 '10 at 19:23
1  
I'd say accessibility is gonna be one of the main obstacles there — a partially-sighted user is going to be unable to do any of those things. Even relatively-young, accomplished users wouldn't always be able to complete them — I'm 36 and have been using the Web since 1993, but have a tremor in my hands, so wouldn't have the acuity to "draw this shape mirrored", for example. –  Owen Blacker Mar 6 '12 at 18:11

While this seems like a flippant answer, XKCD actually had a conceptual solution to this problem, found here: http://xkcd.com/810/. In short, the alternate is to read an unrelated user comment and then indicate if the comment is constructive or not constructive. This has the bonus feature of preventing people from posting comments like "this sucks" and the like. That may or may not be desirable based on your intended use case, but I know I would like to see fewer of those.

This solution does have a few issues, such as how do you create a baseline set of constructive/not constructive comments that can be used as the testing set. Either someone must manually review these comments first, which fails to satisfy your 4th requirement, or you must create some sort of system to display "pending" comments to verified users (say 50 times or so) to get a consensus on the "correct" answer. Obviously, this assumes that the thing you are trying to use CAPTCHA alternatives to protect is a commenting system, and that you have enough users generating comments (or access to an unrelated set of comments) to have some actual baseline.

Edit: While my brain was engaging (I haven't had my tea yet), depending on the length of the comments, you could display more than 1 comment to be indicated as constructive or not, which allows you to seamlessly present the "pending" comments to users to reach your consensus on that comment without anyone feeling like they had to do extra work.

share|improve this answer
    
+1 - I don't think that this satisfies points 2 and 3, but it's an interesting twist on Recaptcha. If you have to make them answer something, why not make it useful to you? Do you or anyone else have other ideas that might not be so subjective that could actually benefit a site? Recaptcha is great, but I don't know how much of us actually benefit from it. I've started to hear things about captchas with advertisements as well. –  Virtuosi Media Nov 21 '10 at 18:03

I am interested in exploring/revisiting this thread, and would like to know if this could work or not given the current technology:

  1. Users are presented with an image of the world map, where the image can be randomly shifted horizontal across the screen each time so that you can just remember the geographical position as a co-ordinate position on the image.

  2. Users are asked a question "e.g. where are you in the world at the moment" related to a geographical position that can be verified (e.g. through an IP address or machine address).

  3. User input is matched to the image and if the answers match then the captcha is complete.

I think it is fast, can probably be made accessible, but probably still requires javascript processing. But it only relies on processing from the user and very quick and simple response that can't be reliably simulated by the bots (or can it?). I am also exploring some ideas with gesture based captchas, but I don't know if there are specific problems with this as well.

share|improve this answer

To have money is human

The most effective solution I've ever encountered for differentiating between robots and people is to be aware of whether or not they have spent money on the internet.

To use an email as a common account identifier for this example. If you know that email has ever purchased any item online, whether it be from you, a competitor, amazon or any digital marketplace, you can be 100% certain they are a human, and not a spam bot.

This works today, and will never stop working because the cost of purchasing an item will always exceed the value of the spam that can be posted afterwards, making spam no longer economically feasible.

This is not very doable for many people who don't operate in e-commerce or related industries, but in situations where you do have that data, you have a flawless way to identify if a person is human. No more prompting them with tricky questions.

share|improve this answer
1  
Is there anybody besides Amazon that has data on whether a given Email purchased on Amazon? –  Christian Jan 17 at 14:37
    
I don't believe so. I named Amazon only to demonstrate the possible scale of such a solution. If you did have that data, you'd probably prompt less than half of the humans you ever encounter, if not better. –  anthonyryan1 Jan 17 at 22:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.