StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p>I looked at the example linked from the article you posted. At first glance, it seems like this can be easily bypassed.</p> <p>The checkbox captcha works on the basis that spam-bots don't parse or use JavaScript code embedded in webpages. Because of this, they will not find the captcha checkbox element within the form it is searching, and therefore will not send a post value for the checkbox along with the form, and on the server side, you would reject the form if the checkbox value wasn't sent.</p> <p>The problem with this is: </p> <ul> <li>The checkbox name is always the same (<code>gasp_checkbox</code>)</li> <li>A bot could easily be "trained" to detect this javascript on your page and act accordingly</li> <li>Even if you output a random name and value that must be used for the checkbox, it could still be detected</li> </ul> <p>The outcome of those 3 problems means that this is much easier to break than image captchas or other methods. All a bot has to do when they submit your form is add: <code>gasp_checkbox=on</code> to their HTTP request.</p> <p>That said, if you implement this for yourself on your own site, it is unlikely that any bots will able to get past it because its use is not widespread.</p> <p>You could make it more secure by doing the following:</p> <ul> <li>Generate unique name/value pairs for the checkbox on the server side, and output those values in obfuscated javascript to the client</li> <li>Serve the script away from your form, preferably in an external javascript file that is generated by a script.</li> <li>Verify that the values sent for the checkbox match a pair that was previously generated, and not used before.</li> </ul> <p>If you do those things, I think you could have an effective checkbox captcha. If someone does catch on to it on your site, it may still be trivial to defeat, even with the above safeguards in place, but it may take a while, and still be effective for you most of the time.</p>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload