CAPTCHAs - A necessary evil?

It depends on the complexity of the code, ie. yours is really easy and it's just a simple matter of typing out an extra word. Usually if I get the code wrong I'll persist because I already took the time to type out my comment, but will give it a second thought the next time around. Compare yours to MyBroadband's forums, where they require a sometimes really difficult CAPTCHA to be entered just to search! And then there's this one which is on a whole new level of crapness. FYI I found this small text area that I'm typing this in, more hindering then your CAPTCHA. ;)

Posted by coda on 2006/12/06

Coda I agree with you on the this text box. I'm not sure why its so small, but it does suck. Isn't usability a funny thing, something wrong can be sitting right under you nose but it still needs to be pointed out, inevitably through feedback from the nice users :). Shot.

Posted by Rob on 2006/12/06

coda, Rob Hope you find the slightly enlarged comment fields a bit less frustrating. (Note: you might have to refresh the page to reload the cached stylesheet)

Posted by Jean on 2006/12/07

There is an alternative method to CAPTCHAs, but one that has not been tested thoroughly in the industry yet, which was discussed at Internet Storm Center. It involves having a field in the form that you hide with some CSS from the user. A spambot will see the hidden field and fill it in. Then in your code you check to see if the hidden field was filled in and if so then the chances are very good that it was a spambot. We have implemented this method on the SearchStatus comment form and on that same day still we were able to eliminate a big number of spam submissions. Just for the month of December so far (7 days) we were able to block 65 spam submissions with this method.

Posted by Jean on 2006/12/07

Thanks for enlarging the box Jean, you're speedy :). Its really exciting that this hidden field method is working on the SearchStatus form, hopefully it continues to work so we can roll it out to more forms.

Posted by Rob on 2006/12/07

I think it's simple really, if it's easy (like coda said) and doesn't break the flow, it doesn't detract from the experience (and thus doesn't deter me). Yours is fine, mine isn't (but will be fixed soon). Jean, I like the hidden-field trick, might just implement it myself!

Posted by Martin on 2006/12/07

Martin - one thing that I did come across with the hidden field method is that when you try to add this method to an existing form that has been spammed before, you need to change the form's action to something else. This is because spambots tend to cache your form, but if you change the action then they have to re-cache it and with that the hidden field will be cached as well. Also try and name the hidden field to something obvious like "subject" or "comment" so that the bot will think it is something that has to be filled in.

Posted by Jean on 2006/12/07

Seth Godin had a great idea for capthcha Images...

Posted by rafiq on 2006/12/07

Just a quick update regarding this post: You will see that we have removed the CAPTCHA validation on gottaQuirk and there is a post on the method we now use.

Posted by Jean on 2006/12/07