Form Spam
Question: Our 'Contact Us' form is being used to send us spam. How do we make it secure?
Problem: It is now common practice on the internet for spammers to write scripts which trawl the web looking for forms which look like they will send emails. That includes the almost ubiquitous Contact Us form. Before long your inbox will be filled with hundreds of adverts for various medications and get-rich-quick schemes.
Answer: What your form needs is some form of security which will help it to detect whether the visitor using the form is a human or a robot. In computing parlance this is often referred to as a 'Reverse Turing Test', which is a grandiose name for a rather simple concept.
Many people are familiar with the distorted images which are in common use, most of which are generated by a piece of software called 'Captcha', e.g.
The ones shown here cannot be read by even the most advanced Optical Character Recognition software currently available, since the letters are all deliberately colliding with each other. Surely this is the ultimate in security?
No. Unfortunately it is possible for spammers to break such codes using a clever trick which involves real humans. The trick is to run a large porn site that 'requires' the visitors to type in the codes to see the images (ironically, to 'prove' that they are not robots!). This is actually a trick because the distorted image actually comes from the site they want to crack (your site!), and they are using the willing porn-viewing volunteers to crack the codes for them.
As far as we know this sort of attack is impossible to detect, but it does severely limit the number of forms they can crack, and they are unlikely to waste such valuable information on a mere Contact Us form. However, it is purely because Captcha is in such widespread use that people have gone to the effort of cracking it.
It should also be pointed out that Captcha is completely impossible to use for Blind and Visually Impaired visitors. One of the basic tenets of good web-design is that it should be accessible to all, and this is true of marketing as well. If only sighted visitors can contact you, then you are cutting yourself off from potential revenue, AND generating negative publicity at the same time. That's a lose/lose situation. It is possible to have audio files for such visitors to listen to, but the cost of such a solution is rapidly becoming disproportionate to the original problem.
Far simpler to implement are questions that involve natural language and common knowledge, e.g.
"What is seven minus four?"
"How many wheels on a bicycle?"
"What colour is grass?"
It is best if the answer is itself a word, and cannot be chosen from a drop down list or set of radio buttons, since even a robot could just set those randomly. We do not know of any scripts that can crack such questions, and the good news is that they work for blind and visually impaired visitors just as well as they do for sighted ones.
| More Information | http://en.wikipedia.org/wiki/Captcha |
| http://www.boingboing.net/2004/01/27/solving-and-creating.html | |
| Solution | Add a question that asks "What is nine minus four?" |