Tag Info

Hot answers tagged

79

With regards to your question of whether a bot can actually go and submit a form automatically, this is what I found on an answer on Stack Overflow. It is comparatively harder to automate data submission within native apps. This is due to the fact that you cannot just write an automated script to discover elements within the source code and then ...


35

CAPTCHA is an example of forcing a customer to deal with a business/technical problem - an exchange of great effort for little return on their behalf. "Are you human?" often accompanies these all too common patterns. You can do better than CAPTCHA by not questioning your customers' humanity, and instead build honey-pots to catch the bots. Honey-pots are ...


22

Snapchat recently added image recognition: (http://venturebeat.com/2014/01/22/snapchat-find-the-ghost/) Note: As most captchas, this is also breakable. But until your app becomes a popular target, this is a pretty nice alternative ;-)


19

The symbol you mention is actually the international symbol of access. It's been around since the late sixties, and it is used to indicate that access has been improved, particularly for wheelchair users, but also for other disability users. Take a gander here: http://en.wikipedia.org/wiki/International_Symbol_of_Access If you start using different signs ...


17

I'm wondering if we can exploit some of the physical properties that differ between real people using browsers and spambots. The two properties that come to mind for me are sequence and pace. Sequence: A real person will download a page before submitting a comment; some spambots jump straight to sending a form submission. Can we detect whether we've ...


15

NO. When speaking of either registration forms or comment forms, they are merely common attempts at foiling false registrations, and SPAM. I find Captchas annoying and frustrating. There are many other options: Email verification Multiple choice questions Random addition (comments on WebDesignerDepot) Code Via Text Message (Craigslist) Pictures of ...


14

I have found that most web literate users are familiar with the concept of a CAPTCHA, but most are not familiar with the term "CAPTCHA". Even my parents (who are not web savvy) understand the idea of "enter these characters to prove you're a human" -- however, they wouldn't understand the headline. I would recommend something more straightforward: "Please ...


14

Rather than asking the user to answer a question or choose a correct picture or enter something, another option is to simply delete something from a regular text field. From an implementation perspective at least, it could not be easier!


11

CAPTCHA and email verification serve different purposes, so one does not replace the other. CAPTCHA is a way of trying to make sure that it is a person that is submitting a form and not just a script. There are many alternatives for how you can do this, but that is another question. Email verification is a way of making sure that the email address that ...


10

We implemented a solution that measured the amount of time it took to submit. On arrival to the page with the form set a session variable with the time in On hitting the code that actually processes the form, check that the time it took to fill in and submit was not stupidly fast Works really well and is completely accessible. Here's a demo: ...


9

I had never heard of that one, interesting method. However personally, I find it more user-friendly not to require a captcha (or assira) at all unless there are high enough indications that it might be spam, that way most users are not punished for wanting to interact with the website. For more ideas, you could check out Can we do better than CAPTCHA? or ...


9

Here's the goal of a CAPTCHA from Wikipedia: These tests are designed to be easy for a computer to generate but difficult for a computer to solve, but again easy for a human. The CAPTCHA you are referencing is easy for us to understand and far easier than the path that static CAPTCHAs have been going down: Imagine the difficulty a person with poor ...


9

Is bot traffic from an iPhone (or Android device) actually a problem? The problem is not so much 'from an iPhone', but rather that the API you are talking too needs to be protected. At the underlying IP level there is not much you can do to prove what a remote device is, for HTTP it is really just the headers or form data, which a Bot can generate ...


8

The CAPTCHA used on the UX.SE(and most likely other SE sites) is brilliant. It is light hearted and gives a chuckle instead of annoying you. This might not appease everyone, but it sure attempts to make light of an annoying situation. Also while being funny, it gives context to why you are being asked to enter the CAPTCHA text, to prove "I'm a Human Being". ...


8

Yes, Captchas are still annoying. Even Stack Exchange, which has relatively few captchas compared to many other sites, gets a large number of complaints about their captchas. It's becoming more common than when it was introduced (and at the same time maybe less common than it used to be, now that OpenID is becoming more popular) but it's still a significant ...


8

These "security" devices hurt user experience. Some of the hacking/security "industry" guides suggest manually completing one of these CAPTCHA mechanisms as a person before allowing your interactive program to interface with the target site or application. This means that once you're authenticated as a person most sites assume you will still behave as a ...


8

You can add a hidden field -- that is hidden to the UI, but not the code. The Spam-bots will fill out that field, while real people will not. It solves the spam problem without annoying real people. See Spamicide for example https://drupal.org/project/spamicide


7

CAPTCHA is Completely Automated Public Turing test to tell Computers and Humans Apart. So, indeed, Asirra is (a type of) CAPTCHA... If you mean the warped text type of it, I think Asirra is not useful because: it requires use of mouse it requires more time than warped text it requires specific interest while trying to fit in a design I think best ...


7

I just read a very interesting article on the matter a few days ago. It has creative alternatives, you should check it out http://webdesignledger.com/tips/why-you-should-stop-using-captchas


7

The CAPTCHA is a good idea where any bot online can and would sign up and/or post to your site. Wikipedia says CAPTCHAs are used in attempts to prevent automated software from performing actions which degrade the quality of service of a given system, whether due to abuse or resource expenditure. [...] CAPTCHAs are also used to minimize automated posting to ...


7

Unfortunately, audio CAPTCHAs are not a good way to provide accessibility. For example, the current version of the audio alternative in reCAPTCHA is causing lots of problems for blind users. You can see some discussion in the reCAPTCHA Google group. Some researchers at Towson University were working on an accessible CAPTCHA alternative that paired ...


7

I absolutely hate 'text' orientated/based captcha's, they are inconvenient, often too difficult, annoying, time consuming etc etc. There are hundreds of alternatives though that don't make the user have to attempt at getting every letter of a ridiculously difficult captcha correct before being able to complete the what should have been a 2 second task. ...


7

Honeypot Since you mentioned HTML5, I'm a big fan of the honeypot approach. Most of your users won't even know it's there. Use all four of the following input fields which you must validate server-side on submit: Required, hidden by CSS Must be null, hidden by CSS Required, hidden by JavaScript Must be null, hidden by JavaScript The required fields ...


7

Please DO NOT use most of the examples in the upvoted answer, they completely exclude people with a wide range of impairments (image recognition is useless if you're blind, metaphorical association is useless if you're autistic, maths questions are useless if you're discalculaic etc etc), and they also do nothing at all to remove the problem of humans ...


6

The typical honeypot CAPTCHA field has a proper label: "If you are a human, do not fill in this field." or some other clear label telling the user what it is. And, as such, a screen reader should read it just fine. If you're looking for true usability and accessibility, however, then realize any sort of CAPTCHA is a detriment. It's putting the burden on ...


5

What kinds of web sites should absolutely have CAPTCHAs? None, unless you can have a solid proof that the website will be victim of bots, and you can't possibly deal with this issue by other means which do not decrease the user experience as CAPTCHA does. Other means Consider your bank account. One way to prevent hacking is to add a CAPTCHA to the logon ...


5

While this seems like a flippant answer, XKCD actually had a conceptual solution to this problem, found here: http://xkcd.com/810/. In short, the alternate is to read an unrelated user comment and then indicate if the comment is constructive or not constructive. This has the bonus feature of preventing people from posting comments like "this sucks" and the ...


5

"should the business not carry the weight of the troubles which occur without captcha instead of the user?" YES! CAPTCHAS are usually a back end problem passed to the user instead. I think an ideal process for registration: email (no repeat) create username (inline ajax checking to find a unique one) join/sign up At this point I should be logged in ...


5

You could use honey pot fields. They provide a field within the form that is hidden from the user but designed to be noticed and filled in by any given bot. They can be as simple as a field called 'phone_number' hidden with css. The bot doesn't process the css and sees the field, but the user doesn't. This would work on both desktop and mobile and has ...



Only top voted, non community-wiki answers of a minimum length are eligible