Can we do better than CAPTCHA?

Question

There are a variety of different forms of CAPTCHA and other strategies in order to prevent spam. To briefly list a few:

• Simple math or word questions.
• Obfuscated text.
• JavaScript-based CAPTCHAs.
• Image CAPTCHAs.
• Honeypots.
• Audio CAPTCHAs.
• Rule-based filtering like Akismet.
• Gradual increase in privileges based on trust.
• Community moderation like StackExchange.
• Spam disincentives like nofollow attributes to links.
• Incentives for posting good content.
• Admin moderation.
• IP whitelists and blacklists.
• Public shaming and disgrace.

Each one of these approaches has obstacles to overcome due to accessibility issues, technical limitations, time restrictions, conversion problems, or size of community. The systems that I've seen working best are a combination of several of the above techniques. However, I can't help but feel as if we're missing something important when it comes to combating spam.

I know that it may be too much to wish for a single one-size-fits-all solution, but perhaps spam prevention could be approached from a different angle. I suspect that there may be more to explore in terms of the way the user interface influences human behavior.

I find that having constraints often triggers creativity, so given the following constraints, can we come up with any new tools to add to our arsenal against spam from a user interface perspective?

1. It must be accessible.
2. It must be non-disruptive and transparent to the end user.
3. It cannot detract or distract from the primary purpose of the page.
4. It must be automated or require very little moderation on a large scale.
5. It cannot be a 3rd-party service.

Answer 1

I'm wondering if we can exploit some of the physical properties that differ between real people using browsers and spambots.

The two properties that come to mind for me are sequence and pace.

Sequence: A real person will download a page before submitting a comment; some spambots jump straight to sending a form submission.

Can we detect whether we've previously served the form to that user and reject submissions where they've not downloaded the form?

Pace: A real person will typically take a few seconds to a few minutes to enter their comment before hitting submit; a spambot might download the page and immediately submit the spam comment.

Is it reasonable to reject submissions that occur too quickly (say, < 2 seconds) or too slowly (say, > 24 hours)?

Answer 2

While this seems like a flippant answer, XKCD actually had a conceptual solution to this problem, found here: http://xkcd.com/810/. In short, the alternate is to read an unrelated user comment and then indicate if the comment is constructive or not constructive. This has the bonus feature of preventing people from posting comments like "this sucks" and the like. That may or may not be desirable based on your intended use case, but I know I would like to see fewer of those.

This solution does have a few issues, such as how do you create a baseline set of constructive/not constructive comments that can be used as the testing set. Either someone must manually review these comments first, which fails to satisfy your 4th requirement, or you must create some sort of system to display "pending" comments to verified users (say 50 times or so) to get a consensus on the "correct" answer. Obviously, this assumes that the thing you are trying to use CAPTCHA alternatives to protect is a commenting system, and that you have enough users generating comments (or access to an unrelated set of comments) to have some actual baseline.

Edit: While my brain was engaging (I haven't had my tea yet), depending on the length of the comments, you could display more than 1 comment to be indicated as constructive or not, which allows you to seamlessly present the "pending" comments to users to reach your consensus on that comment without anyone feeling like they had to do extra work.

Answer 3

To have money is human

The most effective solution I've ever encountered for differentiating between robots and people is to be aware of whether or not they have spent money on the internet.

To use an email as a common account identifier for this example. If you know that email has ever purchased any item online, whether it be from you, a competitor, amazon or any digital marketplace, you can be 100% certain they are a human, and not a spam bot.

This works today, and will never stop working because the cost of purchasing an item will always exceed the value of the spam that can be posted afterwards, making spam no longer economically feasible.

This is not very doable for many people who don't operate in e-commerce or related industries, but in situations where you do have that data, you have a flawless way to identify if a person is human. No more prompting them with tricky questions.

Answer 4

I am interested in exploring/revisiting this thread, and would like to know if this could work or not given the current technology:

1. Users are presented with an image of the world map, where the image can be randomly shifted horizontal across the screen each time so that you can just remember the geographical position as a co-ordinate position on the image.

2. Users are asked a question "e.g. where are you in the world at the moment" related to a geographical position that can be verified (e.g. through an IP address or machine address).

3. User input is matched to the image and if the answers match then the captcha is complete.

I think it is fast, can probably be made accessible, but probably still requires javascript processing. But it only relies on processing from the user and very quick and simple response that can't be reliably simulated by the bots (or can it?). I am also exploring some ideas with gesture based captchas, but I don't know if there are specific problems with this as well.

Answer 5

What if a small game was used as a test? A simple puzzle that keeps users entertained so they don't really notice it's for spam prevention... like a simplified version of Crayon Physics.

Answer 6

Analysis of social activity may be helpful.

For example, if someone logged in to your site using Facebook connect, and you see that they've been registered for 3 years, have 50 friends and a photo of their cat in the gallery, you can ask that user for CAPTCHA only occasionally.

On the contrary, if a user was registered on Facebook yesterday and has exactly 256 friends (just kidding), you may want to ask him to enter CAPTCHAs the first 10 days or so.

Of course, this approach relies on the ability of Facebook/Google/etc. to remove hijacked accounts rather quickly.