Captcha becoming Obsolete?

[MeganXsalta]

TL;DR: Image recognition software is becoming more prevalent with bots. Are there plans to integrate a more sophisticated Captcha-esque system, besides Reverse Captcha?

The Whole Story: Even with Captcha on my forms, I'm still getting spam. I was trying to see if updating to reCaptcha would give me more security when I came across these bits:

http://caca.zoy.org/wiki/PWNtcha

http://www.allspammedup.com/2011/01/...ptcha-cracked/

I understand that image verification still stops the less sophisticated bots, but as the Pwntcha creator above admits, their software is very out of date, and it still cut through the level of distortion we see in the regular Formmail Captcha. There's a dozen other anti-spam systems out there, of varying effectiveness, but I was wondering if any of them would receive the same kind of easy integration Captcha and reCaptcha currently have.

[russellr]

Hi,

Reverse Captcha is the opposite of Captcha - it tries to trick bots into revealing they are bots.

Whereas, Captcha tries to get humans to prove they are human.

Here's the easiest way to break Captcha:
http://www.technologyreview.com/blog/mimssbits/25594/

(pay humans to solve them).

Should we be bothering with Captcha anymore? I think Captcha is becoming obsolete.

However, FormMail has more direct anti-spam technology. For example, spammers want to send you URLs, so you can tell FormMail to block submissions with a certain number of URLs.

And Reverse Captcha appears to be effective provided you're not specifically targeted by a bot designer.

For example, "XYZ Inc" puts up a contact form. Random bots hit it but get blocked by Reverse Captcha. Provided "XYZ Inc" doesn't supply free email accounts or forums, or other things spammers want to utilize, no bot creator is going to bother analyzing the Reverse Captcha and breaking through it.

That's not to say Reverse Captcha is perfect....there are automated ways around that that might get a small percentage of spam through.

[virtualassistantph]

Spam is easy to detect - if there is more than one URL in a post/email flag it for moderation. 90% of the time it's spam. If there are three or more urls, it only gets more likely. (the only time this this doesn't work is stock spam)

[MeganXsalta]

Most often (on our sites at least), there isn't any urls. The spam I've seen almost always ends with a line similar to "Email me for more information." The Reverse Captcha is working very well, and it catches probably 90% of spam that comes in.

[teccet10]

While I definitely don't think it's obsolete (in my experience they are effective), I does look like more and more business websites are moving away from them for contact forms. Blogs and forums and such still use them but the main difference is the captchas are not a tool for the site user, they're a tool for the site owner/admin. As the captchas get more elaborate and more of a pain in the butt to solve, they also become more of an inconvenience to the user and inconveniences are something that many sites are trying to eliminate. It takes a fraction of a second to delete spam so how much are site owners willing to subject their users for to save mere seconds?

Also as more people use reverse-captchas (a.k.a. Honeypot captchas), the other kinds of puzzles that are not even visible, and as the spammers figure out how to solve the image puzzles, things like recaptcha will go the way of the zip drive.

[heo0101]

I don't know

[phuongtuanpy248]

today, many software can pass captcha easily so spammer get a change to spam.

[TonyTuan]

I'm using Recaptcha > It's good for my website

[buinamit]

i don't think that. My site using capcha, and very usefull to filter spammer.

[holan]

follow I need captcha upgrades up to limit spam, and follow me.
Spam is easy to detect - if there is vài URL in a post / email flag it for Moderation. 90% of the time it's spam.