Using Photos to Prevent Spam

This is a really neat visual confirmation created by Josh Yelon:
http://www.panda3d.org …mode=register&a​greed=true

It scrambles the image tags in the HTML code (PHP server output) so you can't tell the filenames or what directory they were placed in. It also uses the GD library to randomly crop, stretch, and tweak gamma.

I installed it on a hiking message board:
http://www.mtsanjacint​o.info

The neat thing is that it's easy to upload your own photos and create your own question. I'm going to use mountain climbing photos and household appliances. A spambot can't tell the difference between Mt. Everest and a white refrigerator next to a blue curtain. If this becomes popular, then spammers won't be able to crack thousands of unique questions and photo libraries, especially if they don't have access to the original photos.

No interest??? Not sure if anybody realizes the significance of this captcha. It could put an end to all spam. Seriously. Combined with an email service you might never see a piece of junk mail in your inbox ever again. Any time a new person emails you, they have to pass the visual confirmation the first time, otherwise it silently goes into the bulk folder. Imagine if *you* could upload your own photos and create your own question....

Sounds great to me!

I see it working... Well.

However, I never get spam through my webforms. (Maybe they havent been up long enough) but this could work if someone wanted my e-mail address off my website.

I would narrow it down to something like two or four photos though. The panda3d example is just annoying with the number of things you must click. Dont want to scare away clients.

Thanks for the link. may incorporate this, but as I said, on a smaller scale.

Yeah, convenience is very important for business clients. I wouldn't want clients to have to go through that unless they were already used to it and it were a popular method that everybody knew about. For now, it works for message boards where you register only once. 4 photos has a 1 in 16 chance of randomly getting it right. 20 photos is one in a million. After 5 attempts you have to wait awhile on phpbb boards.

For publicly displaying a business email, it may be better to use Javascript and entity replacement:
http://www.palm-springs-photography.com/contac​t.html
See how customers can conveniently click.

general code:
------
<SCRIPT LANGUAGE="JavaScript">
A = "MY_USERNAME";
B = "EMAIL_PROVIDER_NAME.c​om";
document.write('<a href=\"mailto:' + A + '@' + B + '\">');
document.write(A + '@' + B + '</a>');
</SCRIPT>
--------------
where your email is MY_USERNAME@EMAIL_PROV​IDER_NAME.com (INVALID EMAIL)

if it's .net or .org, just replace the .com seen in the code.

It's not perfect, but does cut down on spam without creating an inconvenience that would otherwise affect business.

Actually, this message board automatically converted my entity replacements, but they can be seen by looking at the source code on my web page.

Actually, there is a way around this captcha. Someone who wants to spam a message board with such a thing sets up a web page. This web page offers the latest Britney Spears home sex tape, if you pass through a captcha. And where did this captcha come from? It was the one on the message board. By copying it and making someone solve it, a web script can then turn around and use those answers to register on the message board and spam away.

This is the problem with spam. We build better measures to stop them and the internet builds better spammers.

Good idea, I was currently "shopping" for a device like this. I run a small PHPBB forum (less than 30 members, and less than a dozen active) for ex-classmates and general discussion/help about our field of work.

I now have new "members" applications almost everyday, but only a few actually reply to the confirmation email and log in to spam.

I never had this problem for 2 years until my forum was defaced a few months ago... I think my site's on a list now.

But as funnypicmaker said, the captcha scrambles the links and distorts the pictures... But does it place them in random way? Do you upload just the 16 pictures, or you can upload more and the captcha chooses a few from the list? This way, Man of 1000 Ages' point is less valid I guess.

Cool idea.

I have gone through a huge pain with spam at my family website. I originally had a Guestbook that was repeatedly spammed. Nothing like porn site links in between the grandparents commenting on the latest pictures.

I eventually gave up and went to a "Send us feedback" form system that sends me an email when someone fills out the online form, instead of automatically posting the message. That helped for a few months, but I've recently been getting an increasing number of spam messages through that as well.

I've now switched to a pure email setup - with the contact email address being listed in an image, rather than plain text that the bots can read. We'll see if that helps.

Man of 1000 Ages wrote in post #2233996
Actually, there is a way around this captcha....

Thank you for pointing that out. I had not thought of that. There are Javascripts that can prevent use of frames (most people have frames enabled), and servers can prevent hotlinking too.

The default is 20 in each folder (40 total), but I think you can put as many as you want. I have not customized mine yet.

There's a discussion of this at the SANS site today (http://isc.sans.org). Image "captchas" can be defeated with scripting, so they've been trying some alternatives. For those of you interested in the topic, check out their bit on increasing the attacker's work function.

For those of you interested in computer security, you should check them out, too.