Spam Bots?

[Archaic Sage]

To be fair it may not be a bot but a person employed to copypasta stuff.

Our captcha isn't actually a real captcha but a randomised security question, so it cycles through 3 or 4 questions like what's 1 + 3. This means that if captcha is comrpimised (which it has been) we're usually safer as it's not a standardised system we use.

If it is a human, then there's nothing we can do about it.

I'll take a review of our security measures on Saturday.

[noodles]

I was gonna say, I don't see a point to captcha posts when you can put a captcha on account creation

[Archaic Sage]

I've reviewed and I think that it's fine. I've added some more questions so hopefully that'll help keep people at bay.

I'm not going to introduce a captcha for people under 10 posts or anything like that as if the captcha is comprimised it won't help and if it's a human, well that won't help either.

[Hong]

Apparently I can't report spam in the announcement section. So I will just report this post and if you want you can delete it after it is cleaned. They spread quite a bit.

viewtopic.php?p=133168#p133168

[CD-Man2021]

So uh, I think we've got a bit of an infestation.

[zamisk]

This forum is better than any I've been on for spambots. This kind of thing happens no matter what.

Would you rather skim over a few spam posts or enter a captcha code every time you post?

[Hong]

[Shousa]

[Archaic Sage]

1) Captcha has been broken - http://www.hackaday.com/captcha-bot-bea ... ythru-game
2) Captcha won't prevent human registrations
3) I've not upset anyone - don't know if Max has
4) The spammers are all originating from China and Russia - where "human" spam is big business
5) There's nothing anyone can do about human spam except delete it
6) Captcha on the first X numbers of posts won't stop spam for human spammers as they're being paid to do it
7) I am working on blocking by known spammer IP address upon registration but as we all know, IP addresses can be spoofed, hidden behind proxy and can be dynamic.

[Archaic Sage]

Our security measures are fine in terms of captcha and stopping "normal" spam; however, we're never effectively going to be able to stop human spam. Even if we added a captcha or a security question to every single post. We have to be realistic, if someone wants to spam - they will. It's no different from hackers wanting to hack, if you can DDOS PayPal and Amazon, you can pretty much do anything if you've got enough resources and will.

However, what I have now introduced is a system upon where you register, the forums will automatically check your IP address against a known spam database. This will stop users who are using known spam IP addresses from registering.

As I've said, this won't stop users from spoofing or using fake IP addresses, so we're never not going to be able to stop this.

The only downside to this is that we may stop people who are security concious and using proxies to do their browsing.

[Shousa]

Oh, sry, I was wrong. Other forums I'm frequenting don't use captcha. The first few posts (5) of new users need moderators to unlock them to get displayed.

Though, they switched from phpBB to vBulletin back in 2011 so I don't know if this approach works for this forum or not.

[PLA]

Ah, Man. The most dangerous bot of all.

[CD-Man2021]

[PLA]

^ We could hire a team of tibetan cyber-monks to punch them.

Edit: This is post 5555. :3

[PLA]

^ Paper totally works in paperstores.