CAPTCHAs Anyone ?

[Fagin2021]

I'd welcome some views on putting a CAPTCHA on a contact form page. I'm not fond of them and had hoped to avoid them, but sadly it is not to be and my enquiry form is increasingly plagued by spam.

I use enquiry form submission as a 'conversion' in Google Ads/Google Analytics so spam messes up the stats and whilst not an insurmountable problem, it's something I can do without.

Really, the question is 'does a Captcha' put off a genuine enquirer ? Some implementations (traffic lights/fire hydrants/bicycles etc) seem to need two or three attempts and I wonder if the visitor might just say 'sod it' and leave.

 

[Clinton]

reCAPTCHA v3!

 

[Mr D]

Horrible things. Will avoid some sites that use them.
Have done the PayPal one up to 5 times to log in. Waste of time and frustrating.

 

[Lucan Unlordly]

I've been setting up a Forum over the last few months and have been plagued by new spam members. Captcha has stopped them although it's a simple yet industry specific question that 99% of wanted visitors should know the answer to, that thus far thus far 100% of not wanted members don't!

 

[zigojacko]

As @Clinton said above, just use reCaptcha v3 from Google. It's just a checkbox to state you're not a robot and you can also use invisible reCaptcha which doesn't rely on the user having to work out letters, numbers or pictures.

 

[Deleted member 59730]

Has anyone seen the video of a robot arm putting its finger on a "I am not a robot" button?

https://nakedsecurity.sophos.com/2017/01/31/im-not-a-robot-verification-test-beaten-by-a-robot/

 

[DefinitelyMaybeUK]

Another vote for reCaptcha here - have v2 on a couple of 'well known' robot links and has worked 100% so far - just waiting for the robot arm to be common place, a bit like the old telephone diallers from days gone by! There's a crude "security level" setting on the reCaptcha and we're on medium and don't see many fire hydrants or recognised a downturn in submissions either.

 

[Darren_Ssc]

A Honeypot field in the form which is hidden to humans via CSS has proved a very affective strategy for me.

The 'I am not a robot' option is great until Google start making people work for nothing by clicking pictures of fire hydrants, etc. And yes, this does happen in V3

 

[Fagin2021]

Thanks for your views/advice everyone.
I think I'll go the reCAPTCHA v3 route and see what happens.

 

[gpietersz]

Honeypot fields work well for me too.

What does recaptcha v3 do then? Does it use tracking? Does it favour users who stay logged in to Google?

 

[fisicx]

Use a honeypot and a script to check how fast the form is filled in. Add akismet and you will be spam free. No need to have google spyware installed.

 

[gpietersz]

The other weakness of recaptcha is that there are a lot of people an services with experience in getting round it and off the shelf solutions: its a common add on service for scraping proxies.

The less common your solution, the less likely it is that there is an off the shelf solution to beating it.

 

[Marbman]

I think your concern about will it put off someone completing the form really comes down to how bad they want what's on the other side. I can't ever remember myself giving up just because I counted the wrong amount of boxes with buses in.

 

[Darren_Ssc]

I can't ever remember myself giving up just because I counted the wrong amount of boxes with buses in.

I'm just sorry that we are well into the 21st Century and the problem of what a bus like has not yet been 100% solved. As a kid who grew up in the era of moon landings and Concorde I expected so much more than this.

 

[Mr D]

I think your concern about will it put off someone completing the form really comes down to how bad they want what's on the other side. I can't ever remember myself giving up just because I counted the wrong amount of boxes with buses in.

How long would you want to spend clicking to get past it? 1 minute? 2 minutes? Longer?

Try the boxes where none have what you want so then goes to another with none having what it asks for then another with 4 traffic lights then another with taxis and yet another ....
How long would you complete it before you move on?

 

[fisicx]

I think your concern about will it put off someone completing the form really comes down to how bad they want what's on the other side. I can't ever remember myself giving up just because I counted the wrong amount of boxes with buses in.

There are so many better ways to stay spam free than recapcha. You may be happy to persist with counting traffic lights but I prefer to find someone who puts my UX first.

 

[JEREMY HAWKE]

I think its a horrendous idea . I dont have the patients for it . I wont even bother with a site that ask me to play match the pictures

Dont do that

 

[JEREMY HAWKE]

I'm just sorry that we are well into the 21st Century and the problem of what a bus like has not yet been 100% solved. As a kid who grew up in the era of moon landings and Concorde I expected so much more than this.

No they made it too the moon then and they are not doing it now
You could get to New York quicker then than you can now

Just because I can send you a picture straight away with my Persol sunglasses on from the other side of the world it does not mean we have advanced all that much

 

[Kerwin]

The less common your solution, the less likely it is that there is an off the shelf solution to beating it.

That is called security through obscurity and has been debunked for years now.

Go with a well tested and thought out solution that has been tested by (hopefully) thousands of other websites.

 

[gpietersz]

That is called security through obscurity and has been debunked for years now.

Its not that simple.

Relying on obscurity is bad practice and does not work against a targetted attack.

Obscurity does defend against broad attacks.

For example, if you are using recaptcha as an anti-spam measure for a contact form on a website (the OP's case) the problem is almost always bots that crawl large numbers of sites looking for contact forms to fill in. They may be able to pass recaptcha but they will not add code to their crawler just for one site.

There are multiple commercial services for by-passing recaptcha and other popular solutions. It does increase the cost, but usually its a lot cheaper than developing a custom solution for each site which is what rolling your own forces..

 

[DontAsk]

Try the boxes where none have what you want so then goes to another with none having what it asks

You click the "none" on every captcha I have ever seen like that. It always works for me.

 

[Mr D]

You click the "none" on every captcha I have ever seen like that. It always works for me.

I can sometimes go through 3 or 4. Sometimes I simply move on then unable to access - few sites are such I must spend time going through such idiotic blocks.

 

[Alan]

I know some one that has developed a Captcha free anti spam solution for most WordPress forms. And it really works.

|
|
V

 

[gpietersz]

@Mr D it helps a lot if you stay logged into Google. Very likely by design - they can track you a lot better that way - a lot of sites use recaptcha, most load something from Google.

@Alan I have developed captcha free anti-spam for multiple sites (not Wordpress ones though) and its worked pretty well, the same on a number of sites I maintain. All much less of a burden for users.

 

[fisicx]

...it helps a lot if you stay logged into Google.

Logged into Google? Why would anyone want to do that?

 

[gpietersz]

Logged into Google? Why would anyone want to do that?

I do not, but I tend to have a harder time with recaptcha than people who do.

So one answer to your question is to make getting past recaptcha easier. The more you let Google track you the less hassle you have.

 

[fisicx]

I do not, but I tend to have a harder time with recaptcha than people who do.

So one answer to your question is to make getting past recaptcha easier. The more you let Google track you the less hassle you have.

I just don’t bother with sites that want me to count busses. There is almost always somewhere else you can get what you need.

 

[Fagin2021]

Thank you all for your replies and suggestions. I've reached the conclusion that there's no single satisfactory answer...

1. reCAPTCHA v3 appears to involve putting tracking-like code on your site pages (not just the submit page). Google then evaluates visitor behaviour and decides whether to present the visitor with fire hydrants. I've got enough tracking code on my pages without adding more!

2. Honeypot fields are easy enough to implement but don't solve the problem. They can tell you if the visitor is a bot, but don't stop it submitting the form.

3. Some people (above) will leave a site as soon as they see a CAPTCHA.

I think I'll just put enquiry-form spammers on my execution list - right after manufacturers of wood-screws with soft metal heads.

 

[fisicx]

2. Honeypot fields are easy enough to implement but don't solve the problem. They can tell you if the visitor is a bot, but don't stop it submitting the form.

They do if the form is set up correctly.

A maths capture is easy to implement and catches out many bots.

I also have a small script that checks how quickly the form is filled out. Bots take seconds so the scripts junks the submission.

I've been spam free for years.

 

[gpietersz]

@fisicx is right and a honeypot field can stop spam - you check the form and do not process it further if the honeypot field is filled in. So the form is submitted but you never see any result of that.

That and maths captcha have worked well for multiple clients, and homepot fields some of my own sites.

I've got enough tracking code on my pages without adding more!

Good attitude and shows respect for your customers. recaptcha is even worse than most because they cannot block it and still use your site.