Are captchas worth the decreased usability?

Question

When is it useful to use a captcha? When is it an unnecessary hindrance? Is a captcha just a quick fix for the lazy/unexperienced programmer, or are they really the best way to prevent spam and bots?

Answer 1

ReCAPTCHA seems to be pretty secure, and will probably outlast any other OCR based CAPTCHA solution. CAPTCHAs are useful when you aren't sure if it's a bot or a human - ie, after the second or third login attempt, or if you allow anonymous commenting. Once a user has authenticated, dump the CAPTCHA.

An alternative that hasn't come up yet is the "SAPTCHA".

Answer 2

I just love how people just readily accept the "conventional wisdom" about CATPCHAs. As a professional Web developer with ten years of experience and with some expertise in accessibility, it's my opinion that under no circumstance should you implement CAPTCHAs. I'm referring to the kinds that have lines, cursive fonts, 3d effects, etc. First of all, they prevent large numbers of users from accessing content, including a lot of older people, or people with every day vision impairments (such as color blindness), or people for which English is not their first language. Secondly, citing "security" is not a good enough reason. This is because for 99.5% of the spam out there, having someone re-type a five-letter word is sufficient "security." These mythical "robots" that people often refer to are not really that sophisticated. And even then, for those that are sophisticated (again, which is a very small number), a typical CAPTCHAs is not going to be sufficient anyway. So, given that all the negative far outweighs any real benefit, which is mostly imagined anyway, there's no good reason to use them. If you want to prevent SPAM, all you need is to have people re-type a word like "blog" (and it's OK if they can copy-and-paste). This is totally accessible and, trust me, is sufficient enough "security." You'll be surprised to find that all your spam is eliminated and you didn't even have to cut off large segments of users.

copied from other answer by same user

I agreed with this post up to a certain point: "In my experience, even if you have the best captcha in the world, there are a lot of spammers who are nowadays employing real humans for very low wages to simple visit the site, signup (or whatever) and post their spam 'manually'.

So any system that requires you to differentiate between "human" and "bot" is not going to work when faced with an actual human. Whatever system you come up with is not going to be fool-proof and you're going to need to manually verify anonymous (or "near anonymous" - that is, new signup) content."

Then the posted started suggesting some complicated Javascript. Again, as I stated above, just prompting the user to re-type something (I should add randomly selected text is ideal) is just as effective as showing an obscure image of something that you need to decipher. The deciphering aspect is an unnecessary layer, in my opinion. Again, that's just my opinion, but this has been completely effective for me.

I should also add the CAPTCHAs cannot be used on government websites because they violate Section 508 rules.

Answer 3

In my experience, even if you have the best captcha in the world, there are a lot of spammers who are nowadays employing real humans for very low wages to simple visit the site, signup (or whatever) and post their spam 'manually'.

So any system that requires you to differentiate between "human" and "bot" is not going to work when faced with an actual human. Whatever system you come up with is not going to be fool-proof and you're going to need to manually verify anonymous (or "near anonymous" - that is, new signup) content.

I've actually found that a pretty good system is one that requires javascript. That is, have some javascript on the page that copies a randomly-generated value into a special field in the form. On the server, verify that the value has been copied. In my experience, that's stopped a great many spammers. It's not 100%, and perhaps not as good as ReCAPTCHA, but it works well enough for the sites I've worked on, and you don't have to worry about accessibility (there are clients that don't have javascript, but they are fewer and further between these days).

Answer 4

Using honeypot fields is/was a method to reduce spam at no real usability cost.

Here's an article describing how it works with some CSS magic, and while they noted that its effectiveness diminished, it'll still catch some bots. There are probably also more advanced techniques besides CSS (read: JS) that can boost the effectiveness of honeypots.

Answer 5

There are other way to prevent spam and bots, but captcha's work the best. Sometimes asking a simple question on a form like "2+10=" or "Are you human?" works fine as a captcha, for a while at least.

Answer 6

I use reCaptcha because it cuts 90% of the spam out with 5% effort.

I haven't had people complain that the captcha is hard, makes things more difficult, or has any decreased usability either.

Spammers and bots are abundant. It's very easy to scrape a form and start submitting bad requests en masse. It is a simple, secure, proven way to significantly reduce spam and bots. It's not a quick fix for the lazy or inexperienced, rather experience has led to this solution and it is now easy to implement.

Do I like captchas? Hell no. Squiggly lines, what does it mean, opps I entered it wrong. It is effective though.

Answer 7

Also I would accept that reducing the amount of spam you receive is necessary, before going and implementing whatever counter-measure, let's think would you ?

1. Is it necessary to automate detection ? For a low-traffic website, manual moderation can be sufficient. You will want to prevent people from adding racists/insulting comments anyway, won't you ?
2. Is it necessary to pass a Turing test for any comment ? Spammers usually try to pass in urls, so only activating counter-measures when a url is detected seems viable (though slightly more complicated).
3. Is it necessary to pass a Turing test every time ? Anonymous users could have to be filtered (though you could remember IPs), but authenticated users could be filtered only when they become "spammy", for example each 5th comment in less than an hour (or a day), and only until they have proven themselves (white-list based system fed either manually or automatically)

Those 3 ideas should greatly reduce the number of people exposed to those counter-measure, and the number of times they are subjected to them too.

On top of that, they are other counter-measures than captchas, like asking for an e-mail address, sending a message, and waiting for a response with a particular text as subject (randomly generated) before actually posting (with a one hour timeout before trashing the comment, say).

Answer 8

In my experience captchas are the best way to prevent spam, no matter how well the form is programmed there will always be a spam bot better than your app.