New verification questions
- Thread starter andwhyisit
- Start date
Jan 31, 2014 at 3:07 PM
Join Date: Jul 15, 2007
Location: Australia
Posts: 6210
Age: 38
Yeah, just killed a bot recently and that reminded me.Noxid said:
Feb 1, 2014 at 1:50 AM
Join Date: Jul 15, 2007
Location: Australia
Posts: 6210
Age: 38
Blacklists are prone to occasional false positives. Especially in the world of dynamic IP addresses.
I'm thinking a custom honeypot field may be the way to go. I've added in the field, I just need to figure out how to verify it and stop the registration process on verification failure. Failing that I could always verify and auto ban after registration but then the member list will just explode with auto banned members.
I'm thinking a custom honeypot field may be the way to go. I've added in the field, I just need to figure out how to verify it and stop the registration process on verification failure. Failing that I could always verify and auto ban after registration but then the member list will just explode with auto banned members.
Feb 13, 2014 at 9:24 AM
Join Date: Jan 18, 2013
Location: Somewhere quiet with many birds
Posts: 1118
Age: 25
I'm not sure the verification questions have had much of an effect...I'm seeing a new spam thread every day now. D:
(There's one right outside at this moment, which prompted me to post here.)
After researching what a honeypot field is, I have a feeling it will be a lot more useful in keeping the bots away. ^^
(There's one right outside at this moment, which prompted me to post here.)
After researching what a honeypot field is, I have a feeling it will be a lot more useful in keeping the bots away. ^^
Feb 16, 2014 at 5:08 AM
Join Date: Jul 15, 2007
Location: Australia
Posts: 6210
Age: 38
The daily registrations are down from double digits to single digits, so the new questions are having an effect, if not enough of one.
The bots that are getting through are clever. They specifically ignore any field that is not marked as required to avoid parsing requirements where necessary. This behaviour doesn't work on custom forms, but most of these spambots are clearly built specifically for IPB, so they can get away with it because they understand the rules. So the best course of action is to break the rules. To do this I have just fooled IPB into marking the invisible honeypot field as required while continuing to parse it as optional. If this encourages spambots to fill in the field during rego then I can proceed further and block rego for these spambots entirely or auto ban them (only if I can't block them, since this option is less ideal), depending on the level of control hooks allow.
The bots that are getting through are clever. They specifically ignore any field that is not marked as required to avoid parsing requirements where necessary. This behaviour doesn't work on custom forms, but most of these spambots are clearly built specifically for IPB, so they can get away with it because they understand the rules. So the best course of action is to break the rules. To do this I have just fooled IPB into marking the invisible honeypot field as required while continuing to parse it as optional. If this encourages spambots to fill in the field during rego then I can proceed further and block rego for these spambots entirely or auto ban them (only if I can't block them, since this option is less ideal), depending on the level of control hooks allow.
Feb 16, 2014 at 5:45 AM
Join Date: Feb 15, 2014
Location:
Posts: 10
What if we added a field that said something backwards? For example, ".ko epyt neht sdrawkcab siht daeR" <ok>
Feb 28, 2014 at 9:42 PM
Join Date: Nov 21, 2013
Location: farther
Posts: 922
Age: 27
I can't read esperanto
Feb 28, 2014 at 10:11 PM
Join Date: Jun 27, 2013
Location: Phoenix
Posts: 2764
Age: 29