Captcha code sometimes not working

Hi,
I’m using Captcha with eform and WebPElogin. It seems to work fine most of the time however, I’ve had reports of customers getting an error message that they have entered the antispam code incorrectly even though they didn’t. Is it a known behaviour? I’m using the lastest code available. Is there a work-around?
Thanks for sharing...

I can commiserate... but I don’t have any solutions. I have one server that serves up only the BACKGROUND of the CAPTCHA image the first time you go to the manager login page... you have to fail once, then the letters appear. I know it’s a server issue, but I have no idea what is causing it.

If there any other alternative to captcha?

Thanks....

There is an improved CAPTCHA plugin you can install for MODx... not really a fundamental improvement, but it’s something:
http://modxcms.com/extras.html?view=package/view&package=43
See the wiki article: http://wiki.modxcms.com/index.php/CAPTCHA

I read at one point a way to make a form only accept registration via a mouse click and not via a standard submit... the logic being that bots can send a submit, but only a human can click a mouse. I haven’t been able to find that code again, though. Seems like a lot of people out there are developing solutions to the spambot problem.

Personally, I’d love to see some sort of black-ice type intrusion techniques that would blow up the computer of any spammer or bot... but so far I haven’t been able to find any...

I have thought of a solution to the CAPTCHA issue, although I have never tried to put it into practice. Basically, from what I have heard, a spambot will fill in all the form fields with what it thinks is correct, so you make one form field with an easy to fill name (i.e. middle name or something) and then use CSS to hide it from browsers. Upon validation, check if that field is filled out; if it is, then it must be a bot, if it is blank, then it must be human, as humans would never see the field. Don’t know that it would work, although if someone gives it a shot and it works, I’d like to hear about it.

Couldn’t a bot detect if a form was visible? Google can tell if you’ve hidden text from the visitor using CSS or Javascript and they can dock your SEO rankings accordingly, so I would think bots these days are smart enough to know how a page will render.

But your tactic hold promise... if you mixed up some form instructions with graphics or something to instruct the user whether or not to fill out a field, I would think at some point you’d be able to filter out most bots.

If you want to see some alternatives to Captcha, take a look at the code for SPForm. It has an option to create the hidden form you are discussing (which is not really hidden, but rather rendered invisible in a more subtle way). Other options in SPForm include a timer (settable min and max times to fill out the form), requiring the use of the mouse, and/or keyboard, and (what seems to work the best) a math equation for the Captcha challenge.

Quote from: Everett at Apr 21, 2009, 04:23 PM

Couldn’t a bot detect if a form was visible? Google can tell if you’ve hidden text from the visitor using CSS or Javascript and they can dock your SEO rankings accordingly, so I would think bots these days are smart enough to know how a page will render.

You are right, but the googlebot is surely far more sophisticated than most spambots out there. When I put email addresses into sites, I write them in html encoding (done for free here: http://www.wbwip.com/wbw/emailencoder.html) and it seems to foil most spambots. Of course, there may be some that will realize what it actually is.

I guess it really all depends on whether the bot scans the page or renders it and then scans it.

By the way, about what you said about Google - I’m not positive that they can tell that yet. They tell you they will dock you if they catch you doing it (I do NOT use sketchy SEO practices) but I’ve seen sites with hidden text ranked up at the top before. That was a while ago, so maybe the algorithm is better now.

I hope the algorithm is smart though, because sometimes I put text in tags that needs to be hidden - it is text for the mobile/print stylesheet, while the page in the browser uses background images....

Heheh... yeah, Google does THREATEN that, but I have no idea if they can make good on their threats.

I use the Hiveware Enkoder to encrypt email addresses using Javascript. I’ve had very good success with it; no address I’ve enkoded has been harvested yet:
http://hivelogic.com/enkoder

today i had the same problem.
I have JOT and using captcha. When you first go to the page and submit a comment, everything is fine.
But when you want to sent a new message, while the "comment has been posted" is showing, you can’t submit a new one. Because it will say that the captcha is wrong, even when you correctly fill it in.
The only option is the hard-refresh the page, so the "Comment has been posted" message is gone.

very weird.