Preventing spam comments on blogs

bsgrules

You know the way more and more sites are you using that method that forces the user to type a random block of text to prevent bots from spamming. (ex. comments on blogs) Ok, can someone explain to me how they go about validating something like that. Lets say they have a typical random image generation script that has text in the image. How would they setup the script to validate what the user posted?

The only way I can think is if they add a hidden field in the form thats like an md5 sum of the actual text and compare that to the value they posted, but the sites I've looked at don't do that. They must use some other method I'm unaware of.

Examples of sites that use anti-bot spamming techniques.

Scroll Down to comments.
http://aidan.dotgeek.org/lib/?file=function.dirsize.php
http://www.phpguru.org/article.php?ne_id=58
http://forums.somethingawful.com/member.php?action=loginform#form

justsomeone

Passing the image and the md5 of the text on it round in the form would be easily circumvented. A scriptkiddy could just store a known working pair and use those when submitting.

One option is to store in a session variable the text value of the most recently sent image. That way, it has something to check the user input against, although the user will never see it.

Another option is to have a session database which stores all the variables you need associated with each session. The image text would be one of these.

bsgrules

justsomeone wrote:
One option is to store in a session variable the text value of the most recently sent image. That way, it has something to check the user input against, although the user will never see it.

Another option is to have a session database which stores all the variables you need associated with each session. The image text would be one of these.

Thanks, I can't believe I totally forgot about sessions, that must be what they're using right?

chrislive

take a look at this maybe this will help you understand the concept:

http://www.devshed.com/c/a/PHP/Security-Images-in-PHP/

LoganK

I use session variables for those CAPTCHAS. I generate the image, and assign the plaintext to a session variable. However, justsomeone's second option is even more secure - have a DB which associates a session ID number with a particular CAPTCHA.

bsgrules

ok, check out my version of captcha....haha its frkn gay. http://section31.us/temp/comments/test.php

leatherback

Hey BSGrules,

Hm.. You are using pics.. But you assume everybody know who they are? I certainly had no clue!

justsomeone

It may only be a proof of concept, but using photos of people's faces does lead to some problems. I only had to reload your page 5 or 6 times before the images started repeating.

A bad person could do the following:

Write a program to request the page 1,000 times. Each time, it could grab the image, compare it against images already saved and if it's not already stored locally take a copy. Assuming you have no more than couple of hundred images, this should create a local copy of most, if not all, of your images.

The bad person could then associate a name with each of the images.

Now, they just need to request your submit form, fill it with their spam, search for the image in their local database, answer your challenge correctly, and they're done. The spam is now on your system

Even if you have thousands of images, this method could work fine.

And remember, "real people" will have a problem with your firm if they don't know the individuals. I certainly didn't know most of them. Even if I did, I might spell the name incorrectly.

That's why the major players go with images which are created on the fly:
- generate a random string of characters, eg "ryU42$x"
- select random foreground and background colours (sufficiently far apart to be usable)
- select random font
- generate an image of the text based on the above
- select a random transform and apply to the image
- add additional random "noise" to the image
- store the random text in a session variable, display the new image

This makes it all nice and neat, and generates a pretty much infinite number of images to choose from, stacking the odds in your favour rather than the hacker's.

LoganK

Whoah, nice pics to look at 😉

But I agree with leatherback - horrible captcha.

LoganK

justsomeone wrote:
That's why the major players go with images which are created on the fly:
- generate a random string of characters, eg "ryU42$x"
- select random foreground and background colours (sufficiently far apart to be usable)
- select random font
- generate an image of the text based on the above
- select a random transform and apply to the image
- add additional random "noise" to the image
- store the random text in a session variable, display the new image

I can steps 1, 2, 4 and 7, but, how do I select a random font, apply a random transform, and add more noise?

Edit: sorry, off-topic. Justsomeone, can you PM with an example?

leatherback

This does it all, I think:
http://pear.php.net/package/Text_CAPTCHA