[WebAppSec] The idea of negative CAPTCHAs

Spam and automatic submitters really are a problem. One idea to defend this are CAPTCHAs. CAPTCHAs are noisy images and the user (usually) has to recognize the text in the image and enter it in a field. Although some weak algorithms are already broken, this is a good way to keep junk content away. But as automatic recognition gets better, the CAPTCHAs get more sophisticated, and thus harder to read for humans. CAPTCHAs are annoying.

 

Negative CAPTCHAs

The idea of negative CAPTCHAs is not to ask a user to proof that he's human, but reveal that a spam/login robot is a robot (bot). Most bots are really dumb, they crawl the web and enter their junk in every form's field they can find. Negative CAPTCHAs take advantage of that and include a "honeypot" field in the form which will be hidden from the human user by CSS or JavaScript. Ned Batchelder has several ideas how to do that in his original post.

 

On the server side, you will check the value of the field: If it contains any text, it must be a bot. Then, you can either ignore the post or return a positive result, but not saving the post to the database. This way the bot will be satisfied and moves on. You can do this with annoying users, as well.

 

Next step 

This is the basic idea of negative CAPTCHAs, you can make them more sophisticated with Ned's help.

Comments

[Eric Anderson]

I really like this idea. Although I do find it slightly funny I have to fill out a Captcha to post this message. :)

[James H.]

Interesting. I wonder how long this technique will remain effective?

[AkitaOnRails]

I posted about exactly that at my website.

http://www.akitaonrails.com/2007/7/18/brigando-contra-spambots

Even with akismet I was getting a big amount of spams. So I decided to go the honeypot approach.

In my case, I don't know if the bots actually decide if a field is worth filling. So I used a field which I assumed most of them would like to fill, which is the 'email'.

Publishing the email of a user in ones website only allows for spams to capture it and use to spam even more, so I think 'email fields could be considered bad'.

I left the field with a CSS class to hide it and whenever someone fills it in, I silently ignore it. Even then a few spams still go through, I don't know how.

I do hate image captchas, they are annoying.

[Negative CAPTCHA « Iqag]

[...] and brought to my attention by Heiko Webers’ RoR Security Project.) Posted by iqag Filed in Development, Interweb, Security and [...]

[George]

I just added a user visible field called URL with the text "if you are a spammer enter your website here, your message will then get deleted"
All bots fill it out :-)
Idiot users also fill it out, which is a good thing too.