Over the past couple of weeks we have been struggling with a rather intelligent spam bot (or person?) that has been hammering one of our clients forms. Currently we are using a non-image based representation of a set of digits you have to type in to successfully post the form. On top of that we have implemented a minimum time limit as well as a dummy form field that is positioned off screen so a user will not see or fill it out. If it is filled, we know it is a bot because in the markup, it is directly below the real input field… It worked for a couple days bit has now been broken =( We have a couple more tricks up our sleeves that we are working on and will report back on our findings. Now the question that comes to mind is, should I post the details of the new captcha if it is successful? Or would that just give the spammers the means to break it?
Here is a really cool CAPTCHA implementation from www.captcha.net and is based around the concept of tracing around a specific image from a set. It is called squigle-pix: http://server251.theory.cs.cmu.edu/cgi-bin/sq-pix . I would like to see a bot break that!! Only problem is, I can’t find an easy to implement version of this; it seems like it just exists as a proof of concept.
