11

As everyone knows, any website that allows users to submit content to be posted without moderation are subject to all kinds of spam.

One of the most popular methods of combatting this is using ReCaptcha. I don't know if I'm alone in this, but I've found that recaptcha's are often so difficult to read, I (a human...) have to refresh a few times until I get one I can read.

Surely that is poor UX right from the off (the sign-up page)? What are the best ways of spam preventation?

Given that there are so MANY bots or services to solve these captcha-style puzzles now, I think a basic "Whats 1 + 1?" is a better solution. Email validation isn't great when you just want to allow a user to sign-up and submit something instantly (making it as easy as possible for the user) and I'm sure email validation can also quite easily be automated.

What are your best anti-spam, UX-friendly anti-spam measures?

Thanks.

Improve this question
1
  • Maybe you can rephrase your question title a bit? As right now your actual question ("What are your best anti-spam, UX-friendly anti-spam measures?") and its answers are quite different from the title.
    – Lode
    Dec 13, 2011 at 19:05

6 Answers 6

Reset to default
15

CAPTCHAs are implimented for security not UX reasons (though a site with much spam is a site with poor UX), and they are extremely effective at stopping scripts, and other measures to stop scripts are usually worse "play this video and tell me what word you saw!" or not accessible (add the numbers in the picture!).

CAPTCHAs win out in security for numerous reasons and are one of the only solutions that remain effective despite widespread adoption; the only effective way to get around a CAPTCHA is to conscript real humans to solve them. Since they're the go-to for security in my opinion the only valid UX solution is to improve CAPTCHAs, not replace them.

Most any anti-robot feature results in poor accessability, but CAPTCHA has many good accessibility guidelines, also some on the offical CAPTCHA site.

The problem is most commonly not with CAPTCHAs but how they are used. Many sites integrate them into their sign up forms which frustrates all users at least once, and adds an additional reason to never sign up.

Good implimentations if CAPTCHA only present the CAPTCHA to users believed to be bots. Don't assume all your users are robots. That line of thinking leads to way more problems than CAPTCHAs ever will. Treat users as humans until you have a damn good reason not to. Youtube and Stack Overflow have specific detection set ups which onlyp resent CAPTCHAs to users that post a large amount of content in quick succession; something bots always do but humans rarely do. By targeting CAPTCHAs you frustrate a tiny percent of users while blocking a massive amount of spam.

You can also make CAPTCHAs a teeny bit more pleasant and fun by adding some humor. For those of us that know, using ReCAPTCHA is also for a good cause so it's a little less painful.

Improve this answer
4
  • If I never type CAPTCHA again it will be too soon
    – Ben Brocka
    Dec 9, 2011 at 16:15
  • 1
    I agree with a lot of what you said, but to address your first sentence - I accept that Captchas are implemented for security reasons (implementing it for UX would be pointless (forcing the user to perform a task... pointlessly)), what I'm addressing here is the negative impact implementing CAPTCHAs as a security feature has on user experience.
    – Anonymous
    Dec 9, 2011 at 16:24
  • 1
    I simply meant to give my reasoning for why CAPTCHAs are the preferred method of prevention, hence why my advice is to improve CAPTCHAs/their use, not an alternatuve
    – Ben Brocka
    Dec 9, 2011 at 16:34
  • 1
    Loud and clear. :)
    – Anonymous
    Dec 9, 2011 at 16:36
5

The problem is that what's easy for a human to solve is a lot easier to solve for a bot, than a tougher test (which is harder for a human, but a lot harder for a bot). This is because the more skewed the letters are, the more the human mind has to interpret patterns to form the letters. Computers can't do that in the same manner.

I agree with you that captchas are pretty tough to solve sometimes, but they could be better developed - for example, make the "generate new" button more visual so the user can generate some until one that is easily read for him appears.

I am also curious to see if someone can show some better options...

Improve this answer
5
  • I agree, and the comment about the button is very good, not to mention that a space needed between the words isn't obvious to everyone.
    – jackJoe
    Dec 9, 2011 at 10:10
  • Glad I'm not the only one. My main problem with solving captchas is telling letters apart - two n's are often made to look like an 'm'. I understand they have to be difficult to make it hard for OCR bots, but given the amount of services that are human-powered to solve captcha's, it's become a bit more... useless, than it was. The best way to go in the long run must be for each website to adopt it's own custom anti-spam measures so there can't be a "one key fits all" spam bot. Because so many websites use recaptcha, once a work-around has been made for it, a lot of websites become vulnerable.
    – Anonymous
    Dec 9, 2011 at 11:39
  • So the real question is, what is the most UX friendly method I guess that is as easy as possible for a human to solve, but as hard as possible for a computer. I suppose if a plugin piece of software were to be created for webmasters to install on their registration forms, it would rotate randomly through a series of puzzles that differ in logic, rather than "type the letters". You'd have "Add the numbers", "type the 3rd, 5th and 8th letters from the sequence", "what colour is the triangle (out of a series of different shapes)", and so on.
    – Anonymous
    Dec 9, 2011 at 11:41
  • The problem with non-CAPTCHA solutions is that they're often easy to write a script to attack. If everyone used the "add these numbers" scripts it's trivial to write a program that recognizes the undistorted numbers and performs the basic math problem. Then you have to distort the numbers, and now we have impossible to read math problems instead of hard to read letters.
    – Ben Brocka
    Dec 9, 2011 at 16:06
  • Creator of captcha making jokes about it : youtube.com/watch?v=-Ht4qiDRZE8
    – Benjamin Crouzier
    Dec 10, 2011 at 2:50
3

Depending on what your product or service is, one user friendly method might be to make a custom captcha using your product/service. For example, for a Library website I've designed a captcha that uses a pool of book covers with irregular fonts as the captcha and asks for the title of the book. One of the most difficult ones is the Jonathan Safran Foer book pictured below. This captcha could probably be beaten by a bot, but even OCR would run into the issue of differentiating between title and author. I'd imagine you could also write a script that grabbed the book cover, image searched it on amazon.com or similar and pulled the title or author... so it's certainly not as secure as some other methods... on the other hand, that is a lot of effort to spam a single site (since this captcha is unique) and it probably would not be cost effective enough for the spammers to bother.

If your users are all "informed" about your product or service you could have a pool of questions that uninterested people wouldn't know the answer to. For baseball site you might ask questions like "A game has nine whats?"; "What is it called when the batter lets the ball hit the bat without swinging"; etc.

Even though a solution like this could be countered by a bot, if your site isn't huge and profitable to expend the time to break the script it could well be sufficient without being too egregious a violation of good UX.

enter image description here

Improve this answer
1
  • You've touched on what I've thought (and voiced in a comment on Henrik's answer). Unique CAPTCHAs must be the way forward. As you say, a ruthless spammer is unlikely to take the time to develop something to overcome your sites specific anti-spam measures when he could be littering thousands of other sites with easier protection to overcome.
    – Anonymous
    Dec 9, 2011 at 16:29
2

From a UX perspective, CAPTCHAs are bad, bad, bad. Bad! Really bad. DO NOT USE THEM. So bad.

But if one needs to assume they are needed at times, the question is if there are better types to be used. Some options:

  • email verification
  • use single sign on options (such as leveraging one's Google or Facebook login)
  • human moderation
  • logic captchas (instead of scrambled letters, something akin to simple questions)
Improve this answer
3
  • 1
    These all have implimentation problems; scripts can read emails and click links. Bots can access a site via single-sign on, and then post spam unfettered. Humans often can't possibly read the volume of contents on popular sites (Youtube has 24 hours of video uploaded every minute) and logic captchas are super easy for computers if they use ORC to read the problem and have a database of questions. Logic captchas are okay for small sites but if used often fall prey to complex and effective attacks.
    – Ben Brocka
    Dec 9, 2011 at 16:11
  • yep. and Captchas have implementation problems too. You can outsource Captcha for pennies. Probably the best option for heavily used sites are community tools to self-police such as the StackExchange sites.
    – DA01
    Dec 9, 2011 at 18:50
  • Any automated defense is of course going to be able to be outsourced to humans for pennies; they're humans, after all.
    – Ben Brocka
    Dec 9, 2011 at 19:32
2

Captcha place responsibility for anti-spam security on the wrong side. We shouldn't charge users with something that should be done by the application.

There are at least couple of anti-spam methodes invisible for users e.g. hidden form field (won't be seen by users, will be filled in by bots, which let you block spam), filtering content for specific words (and density of words), disabling html in content provided by users...

Captcha is a lazy method. If you hear about it always protest.

Recently I removed captcha from 'add review' form. Guess what? We didn't get more spam. We did get a lot of good content from our users.

Improve this answer
0

"What is the color of the sky? Enter the word backwards:" will stop every spam script. Give everyone who can delete posts the right to change the question. If you see a spambot, think of a new question and delete the spam.

You could also let your admin(s) upload a picture challenge, which may be faster to solve by a human. The key is that the challenge is unique and easily replaced.

It is very rare that a spammer bothers to solve the challenge. In my experience he will give up after the 2nd change. Even 15 seconds of human attention is too expensive to spam only one place. Of course the spambot will have a list of typical answers; make sure your answer is not in there.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.