More user friendly approach to captcha? Discussion

[nhaack]

Hi there,

I am thinking of a way to reduce the amounts of captcha codes to solve for visitors. More specifically: I want to build a site which allows for extended user interaction (comments, tags, ratings). Now to prevent spammers from taking advantage of these features and to prevent them from automatically publish bullsh*t on my site, I need some sort of captcha-thingy.

Let's assume I have a captcha in every form. For a lot of interactive inputs the visitors have to enter the codes. I do not want to go for registered users. There I could put all interactive forms in a sort of custom-content and voilá.

So I thought doing the captcha once and storing a flag like "is_human=true" in the session could do the trick. Now, whenever I show a form, I could include a captcha if the user hasn't completed any captcha so far. Depending on the session status, I either show a form with captcha or without.

What do you think about this approach?

The question now: how to integrate this smooth into CMSMS in terms of end-usability and compatibility with existing modules such as comments, guestbook or others? As for comments, I think it either runs with or without captcha - but not both.

Another way could be to AJAX everything and always go through a page where the captcha status is checked before post-data is forwarded to the corresponding module. However, it would still allow to uncover the actual post locations of the modules to undermine the mechanism. So after all, the actual modules would have to check for the session status... or am I wrong? Because any wrapping could be uncovered once you turn on e.g. "live http headers" in FF.

What are your thinkings about captchas and usability?

Best
Nils

[Dr.CSS]

Comments now has the session save cookie thing in it, you might want to check how it does it to integrate it into the others...

[nhaack]

Cool, didn't know that... thanks for the hint. I will look right ito it this weekend.

Thanks & Best
Nils

[nhaack]

Hi Mark,

I checked out the newest version (I think it was 1.9.1) as the "current public release" 1.8.2 (I think) didn't show any options in this way. Right after installing, the browser refuses to display any frontend pages due to an encoding problem of unknown compression (CMSMS 1.5.1, PHP 5.2.6 and mySQL 5.0.6). However, compression is disabled in the config.php

So before I poke around the system, I'll make a fresh install next weekend, probably there is some interference with other modules or some own rewrite rule (my feeling says it's the second)? From the changelog, what has been done recently looks impressive. I already wanted to try out the trackback feature a while ago but couldn't find the time...

Apart from the problem I have, how stable is 1.9.1? Does anyone know when the next release is planned?

Best
Nils