reCaptcha

What do you folks think about this? (http://recaptcha.net/learnmore.html)

Personally, I hate reCaptcha. I think it’s too difficult to read, but I could probably make it an option for the Captcha package -- selectable from a system setting.

I also question the security value since you only have to get the easier of the two words correct. I suspect that pattern recognition software used in bots could be successful in a very small number of tries. In one of the samples at their site, I just had to recognize the word "At" and aT was judged as correct.

Also, you need to register and get a key. I’m not sure, but I think the keys are site-specific so each user might have to register and set his or her key as a System Setting.

It’s not worth the trouble, IMHO, but if enough people think it’s worthwhile, I can try to find time to put it in the package.

Captcha’s in any flavor are not really worth the effort to me. There’s most likely more effective anti-spam measures that can’t be so easily decoded by determined spammers. From my undestanding, recaptcha has already been cracked.

Here’s an interesting one for Wordpress I recently ran across it and thought it contained some interesting ideas:
http://www.hybrid6.com/webgeek/plugins/wp-spamfree

Quote from: rthrash at Nov 17, 2008, 09:06 PM

Here’s an interesting one for Wordpress I recently ran across it and thought it contained some interesting ideas:
http://www.hybrid6.com/webgeek/plugins/wp-spamfree

Thanks for the link. I hadn’t seen that one. It throws everything but the kitchen sink at the spammers, including some downright silly stuff (like filtering on the word "viagra") and some stuff that I find questionable (e.g. complex content filtering algorithms).

SPForm has most of the stuff in there that actually makes sense (plus a number of spam-blocking features that it’s missing). The exception is gethostbyaddr() which is a really powerful tool for stopping spambots. I’ve hesitated to use it because it can really slow down your site (especially on IIS servers) and makes you vulnerable to a kind of DNS attack where vengeful spambots keep hitting your form with an IP that makes gethostbyaddr() time out. As implemented in wp-spamfree, gethostbyaddr() would be a real problem since the author is using the standard PHP function and hasn’t built in any timeout that I can see, so it might actually hang the site.

I’d love to see it tested against SPForm, but with all the options on, I think both would be so spam-free that you wouldn’t learn much. The Revolution version of SPForm will be a lot easier to install and configure. Both are really only good as contact forms although a lot of their features would probably fit well in eForm (which already has some spam-blocking capabilities).

There’s definitely some fun stuff in there, though, like giving spammers a message saying that the form has been shut down due to spam.

I only briefly looked at the code and most of it is the word filters as you mentioned. And by "most" I mean almost 4000 lines if memory serves me right! lol

Didn’t catch the message to probable spammers; that’s funny.