33

I'm working on setting up a CAPTCHA on a project, and just thought about the user experience of it. I personally find them tedious, especially if they're too difficult.

enter image description here

Even these are pretty easy compared to most you see now a days, but look at the mess!

I stumbled upon a question from 2010, and it had an interesting answer regarding human verification methods.

The most effective solution I've ever encountered for differentiating between robots and people is to be aware of whether or not they have spent money on the internet.

To use an email as a common account identifier for this example. If you know that email has ever purchased any item online, whether it be from you, a competitor, amazon or any digital marketplace, you can be 100% certain they are a human, and not a spam bot.

This works today, and will never stop working because the cost of purchasing an item will always exceed the value of the spam that can be posted afterwards, making spam no longer economically feasible.

This is not very doable for many people who don't operate in e-commerce or related industries, but in situations where you do have that data, you have a flawless way to identify if a person is human. No more prompting them with tricky questions.

Quoted from Can we do better than CAPTCHA?

Now, obviously this would be difficult to do without the other sites having a list of way to cross check e-mails and see if they've ever purchased anything. Then you also have the dilemma of what happens if they didn't purchase anything but they are really a human.

Is cross checking e-mails against sites that list spam bots effective? If you're not on there, no CAPTCHA, and if you are, then you get a very difficult CAPTCHA that you need to pass. This again though leads to problems where new spam bots come in and can go on your site since they're not yet blacklisted.

The short (tl;dr) version of my question: Is there a more user friendly way to check if a user is human?

Improve this question
14
  • 1
    I remember I saw a captcha a while ago where you would drag parts to make a cheeseburger. It's a good idea because it requires common sense (boot does not go on cheeseburger, bread does, etc). I'll try to find it. There's also this
    – Jon
    Jan 12, 2014 at 23:45
  • Putting the (tl;dr) version of the question at the end seems likely not to be effective. Those who didn't read to the end won't see it. But good question.
    – Ross Millikan
    Jan 13, 2014 at 4:26
  • 1
    @chipperyman573 that cheeseburger example is not really a more user-friendly version. If I am a keyboard user, or am partially sighted then I can't use that version at all. At least Captcha is keyboard accessible.
    – JonW ♦
    Jan 13, 2014 at 13:28
  • 1
    @Mike then maybe consider non-CAPTCHA solutions such as email confirmation perhaps.
    – DA01
    Jan 13, 2014 at 23:55
  • 1
    I'm protecting this question as it's attracted a few spam posts we've had to delete.
    – JonW ♦
    Jan 15, 2014 at 15:27

10 Answers 10

Reset to default
40

CAPTCHA is an example of forcing a customer to deal with a business/technical problem - an exchange of great effort for little return on their behalf. "Are you human?" often accompanies these all too common patterns.

You can do better than CAPTCHA by not questioning your customers' humanity, and instead build honey-pots to catch the bots. Honey-pots are hidden fields buried within the form that bots will 'read'. For example, a hidden check-box or input which when selected or filled-out rejects the form submission.

There is a few other technicalities to consider - i.e. method of hiding fields, randomising field names, dealing with your captive bots etc. - but reading a few good articles on the design of the honey-pot can help, for example https://www.smartfile.com/blog/captchas-dont-work-how-to-trick-spam-bots-with-a-smarter-honey-pot/

Improve this answer
10
  • 6
    More and more "bots" nowadays are regular web browsers (just without a window). Honeypots do nothing to stop them because they are indistinguishable from a regular user in terms browsing behavior.
    – Blender
    Feb 15, 2014 at 11:07
  • 3
    Not only that, but what about specific targeted attacks. The above suggestion may work for bots sweeping the internet and trying to find vulnerabile forms. But if your site is specifically being targeted for eg mass-registration. Honey-pots do nothing to stop the attacker just scripting around it.
    – Josh Mc
    May 30, 2014 at 2:10
  • I would note that if the user fails the honey pot , make your user go through a disability friendly Captcha like reCaptcha since screen readers are most likely to fill in honeypots. This can stop you from being liable for not being disability friendly.
    – GiantCowFilms
    Oct 18, 2014 at 22:20
  • @JoshMc - Having never experienced such an attack, this is probably a naieve question, but in the case of a targeted attack, wouldn't you be better off finding and blocking the source? If they are willing to analyze and customize an attack just for you, I don't see any code trickery being able to thwart the attacker for long.
    – T.E.D.
    Jun 1, 2015 at 14:17
  • @T.E.D. What about captchas ;-) They are exactly the kind of thing that prevent automation of a process. Blocking the source is the naive and impossible thing to do, captchas are exactly the solution to a huge problem which this answer totally doesn't solve whatsoever.
    – David Mulder
    Jan 28, 2016 at 14:42
12

You can add a hidden field -- that is hidden to the UI, but not the code. The Spam-bots will fill out that field, while real people will not.

It solves the spam problem without annoying real people.

See Spamicide for example https://drupal.org/project/spamicide

Improve this answer
12
  • 13
    Dude, anyone can tell a robot to skip that field. They do make programs to attack specific sites. Also, a robot too can tell if a field is hidden from UI.
    – kBisla
    Jan 13, 2014 at 14:55
  • 1
    In pseudo code: if input type == hidden then skip
    – Code Maverick
    Jan 13, 2014 at 16:38
  • 1
    @BlueFlame anyone can create a robot to circumvent nearly any CAPTCHA if they want. It's all a game of pragmatic balance.
    – DA01
    Jan 13, 2014 at 17:08
  • 2
    @DA01 That is not true even in the slightest. That's like saying anyone can pick any lock if they want. It's true only from the perspective of a novice who only buys bad locks. With a little bit of research you can find locks that have never been picked, or settle with one that is prohibitively expensive to pick. Same goes with Captchas.
    – VoronoiPotato
    Jan 13, 2014 at 22:18
  • 6
    @VoronoiPotato anyone CAN pick any lock if they want to. If there's a reason to circumvent a CAPTCHA, people will do it. If not via bot, via stupendously cheap human outsourcing.
    – DA01
    Jan 13, 2014 at 23:54
10

I absolutely hate 'text' orientated/based captcha's, they are inconvenient, often too difficult, annoying, time consuming etc etc.

There are hundreds of alternatives though that don't make the user have to attempt at getting every letter of a ridiculously difficult captcha correct before being able to complete the what should have been a 2 second task.

Even if you show 4 pictures of a dog and 1 picture of a cat and use the question 'please click on the cat' below.

Here are some alternatives to captcha and this method uses javascript to recognise human activity on screen events.

Improve this answer
1
  • 2
    These are brilliant and take advantage of things humans are very good at and computers are very bad at.
    – VoronoiPotato
    Jan 13, 2014 at 22:23
7

What about using some kind of proof-of-work concept?

In the case of a web-site, you implement some proof-of-work generator in javascript, performing what will amount to e.g. 100ms of work on an average workstation and submitting that to the webserver. Not too long to wait to submit a form, and a lot less work than entering a captcha anyway.

Improve this answer
5
  • Very interesting, would slow any single source spam engine but largely ineffective with botnets.
    – VoronoiPotato
    Jan 13, 2014 at 22:24
  • +1: I was just thinking the same. You could make it 500 ms even without much trouble, making it for even more spam bots a lot harder.
    – Daniel A.A. Pelsmaeker
    Jan 14, 2014 at 2:55
  • Really interesting idea. It changes the question from "is the user human" to "is the agent a real browser". I wonder if it's viable long-term though - supercomputers /botnets have a lot of power.
    – Steve Bennett
    Jan 14, 2014 at 23:49
  • 3
    One potential drawback. For mobile users, you're asking their processor to do a lot of work, and cpu cycles are a battery killer, so this should at least be used sparingly.
    – user3550
    Feb 4, 2014 at 3:53
  • Another drawback: a legit user's mobile CPU is likely far slower than the i7 on a spammer's desk.
    – Damian Yerrick
    Jan 9, 2016 at 18:10
4

As far as I know, there is no "ideal" solution to replace captchas. Whether math questions, or simple tasks as drag&drop or sliding a cursor, etc. do not stand much to hackers.

There exist other alternatives, of course, like :

  • Asking simple questions but time required to read and comprehend these questions may vary because these are unusual and unknown to users + they are still breakable + Need for thousands of questions in database to be safe + need for translation of all questions in user’s language

  • Using 3rd party authentication such as social logins (Facebook & the like) but not all people DO use social networks

  • Solve media: company using ad hybrid captcha requiring the user to answer simple question about the company’s ad (eg. "Please write down the text that is written below the company logo")

  • User time expenditure (Timestamp analysis): identifying users or bots by measuring time taken to submit form. (eg.: if less than 5 secs = bot for instance)

As a conclusion, the best alternative I'm aware of up to now is:

  • Either a MIX of several methods as honeypot AND user time expenditure (still not fullproof)

  • OR Re-captcha (Google's Re-captcha): because it is the easiest/safest of all captchas up to now (still issues for disabled as blind people for instance as audio alternative not user-friendly at all)

I'd recommend you to use Re-captcha.

Improve this answer
3

The best alternative to Captcha I've ever seen are custom interactive controls.

A control that tells you something like : 

Please drag the the ball to the end of the line 

--0-------------------------------

And then you have to take the little ball and drag it till the end of the line. It is fun, surprising for users, very very quick and also bot proof.

Improve this answer
3
  • 7
    But can I use that with a keyboard? The trouble with all these 'fun' alternatives is that they're worse for accessibility, so you're actually locking a significant number of people out of accessing that functionalty.
    – JonW ♦
    Jan 13, 2014 at 23:11
  • That's a good point, JonW--for most sites. If you don't care about people who don't use mice, though, this solution is great. I know many devs would say "but websites must support ALL users", and again, for many sites that's true. But sometimes not--e.g., I have a web app where users can pan/zoom/scale a world map and place markers on it. The entire point of app is being able to interact with the map; it's very visual. So in my case, I don't care about users who don't use mice. They're not my target audience, and I think that's fine. Not every site has to accommodate absolutely everyone.
    – user428517
    Jan 16, 2014 at 22:22
  • @sogroves - not every site has to accommodate everyone. True. But every site should NOT exclude anyone either. If we follow that path, we will have a lot of exclusions - and that's the main issue I believe. :)
    – MEM
    Apr 19, 2014 at 12:31
2

You could use the http://areyouahuman.com/ service.

It's randomly chooses a game from a list of a few really basic games like a net and capturing the butterfly.

It requires human thinking to disguish items from one another and has medium success rates because the game might occasionally bug out but other than that a good captcha like service.

Improve this answer
4
  • 4
    What is this? How does it work? Why is this good? Is it accessible? Does it have high success rates? Just adding a link with no explanation or reasoning isn't really a helpful answer, it's just a link.
    – JonW ♦
    Jan 14, 2014 at 9:16
  • Edited, can you remove downvote please?
    – BigBrother
    Jan 14, 2014 at 10:08
  • 1
    It's not my downvote to remove. But anyway I'm still not convinced that it's an easier and more user friendly alternative, it's just an alternative. I don't see why this is better than CAPTCHA.
    – JonW ♦
    Jan 14, 2014 at 10:46
  • 1
    This basically is a CAPTCHA. It still also makes the user do work which is what I'm trying to avoid.
    – Mike
    Jan 14, 2014 at 13:40
1

Require some base intelligence beyond symbol recognition.

  1. Ask the user to add two single digit numbers, possibly from a mix of letters and numbers.
    Example: "hp5mcer6pnt"
    Answer: "11"

  2. Ask the user to enter the numbers ignoring the letters.
    Example: "hp5mcer6pnt"
    Answer: "56"

  3. Ask the user to enter the third and fifth characters. Different random positions each time.
    Example: "MEOGSYFPNE"
    Answer: "OS"

Here is an example I ran across today, really nice to use:

Improve this answer
5
  • 5
    Yeah, but that goes against usability principal #1: Don't Make Me Think.
    – JonW ♦
    Jan 13, 2014 at 23:10
  • To be clear, all security makes things harder for the user. Also, trying to figure out a graphic CAPTCHA makes me have to think so hard my head hurts. Some are so hard I have to try several to get one I can read.
    – zaph
    Jan 13, 2014 at 23:48
  • In addition to 'Don't make me think' this introduces accessibility challenges for those with cognitive disabilities. Granted, that's perhaps true with a CAPTCHA as well.
    – DA01
    Jan 13, 2014 at 23:56
  • 2
    These all fail because the actual task is much easier for a computer than a human. The only part of a task that's easier for the human is understanding the question and submitting the answer, so you might as well make the question trivial: "Please enter 'hello' in this box:" or maybe "What's the opposite of black?"
    – Steve Bennett
    Jan 14, 2014 at 23:51
  • What sort of task is easier for a human than a computer, and likely to remain that way over time? Actually, I don't think that there are any. If humans are eventually superannuated, we will just have to let computers use our... computer systems. Um.
    – user67695
    Mar 9, 2018 at 17:26
0

There are web server solutions to part of the problem. If you're trying to prevent DOS attacks, for example, IIS, as an example, has a plug-in called "Dynamic IP Restrictions". This plug in allows you to tell IIS to Deny IP addresses based on a configurable number of concurrent requests and/or a configurable number of requests over a specified time period. I'm sure other web servers have similar mechanisms.

This won't stop one-time spam requests but, combined with a honey-pot, you can eliminate the need for a CAPTCHA altogether.

Improve this answer
0

If a user fills a form you can capture all keystrokes that the user makes and also capture mouse movements. You would have to forbid regular users from using software that automatically fills forms but that might be a price you are willing to pay.

You could run that data through pattern recognition algorithms and catch a good portion of spammers.

Improve this answer
5
  • 1
    Ideally I wouldn't have to block out any users.
    – Mike
    Jan 17, 2014 at 16:09
  • 2
    @Mike: Telling a user who normally uses automatic form filling software to fill the form manually isn't blocking them out. It's just increasing their workload.
    – Christian
    Jan 17, 2014 at 16:25
  • 3
    That's not really much different to CAPTCHA though. It's basically saying to users "We have a problem with spammers, but we can't deal with it so we're just going to make it more inconvenient for genuine users to fill in these forms instead".
    – JonW ♦
    Jan 17, 2014 at 16:27
  • @JonW: There no way to allow genuine users to automatically fill forms and not allow nongenuine users to automatically fill forms.
    – Christian
    Jan 17, 2014 at 16:34
  • @Christian: Very true, but you're still penalizing genuine users with your method because - for whatever reason - you can't / don't want to cope with some spam / undesired users. The end user doesn't care that you get spammed, they just care if they can complete their transaction. If they can't complete their transaction then you have failed. No, there isn't a perfect system, but even no CAPTCHA allows anyone who is genuine to complete their transaction.
    – JonW ♦
    Jan 17, 2014 at 16:43

Not the answer you're looking for? Browse other questions tagged or ask your own question.