Bringing Out The Anti-Spam Big Guns

by JD — Feb. 5, 2005 @ 1:15 AM

It seems that the blog spammers have upgraded their auto-spamming scripts and simple tricks like changing the posting filename are no longer working. Apparently, the new blog spammer bots actually parse through the blog page to discover the name of the posting script.

I’ve started getting 30-40 spam posts per day over the last week or so. This isn’t really a huge problem, since Wordpress catches certain "spam keywords" and throws the posts into the moderation queue. However, I have the blog set to auto-email me when a new comment is posted, so I get deluged with a flood of emails…

Wordpress Anti-SpamEnter, the Wordpress authimage hack:
This is by FAR the most effective anti-comment spam hack that I’ve seen. This hack generates an image containing a random series of letters and numbers. In order to post a comment, the visitor has to look at the image and enter in the code. Since spam-scripts can’t read images, they can’t post! Nice!

You can download the Wordpress authimage hack here:
http://www.gudlyf.com/index.php?p=376

Let me warn you: This hack takes a while to install and requires modifying several core Wordpress files. But, in the end, it is well worth it. You can see what the hack looks like in the comments section of this blog.

BTW: Yes, I’m well aware that some spam scripts can read images. However(thankfully) those scripts have not yet reached a point where they can read slanted images with little contrast(like those that authimage generates). So, for now this is an excellent anti-spam solution.

20 Comments »


  1. Comment by Andy — Feb. 11, 2005 @ 11:09 AM


    However (thankfully) those scripts have not yet reached a point where they can read slanted images with little contrast … So, for now this is an excellent anti-spam solution.

    Nor can visually impaired users. I can read the captcha you are currently using, but using reduced contrast hurts humans with less than perfect vision. I’m glad people who use these systems don’t want people with disabilities to comment on their pages.

  2. Comment by Joe Schmoe — Feb. 11, 2005 @ 11:41 AM

    Andy,
    It’s becoming obvious that you have a “cause” here and all… but I can assure you that I have nothing against the visually impaired. I switched to the authimage hack out of necessity, and because it is an easy, effective solution.

    It would be nice if the hack didn’t exclude visually impaired users… It would be nice if there were no blog spammers… hell it would be nice if money trees grew in my backyard and it rained gumdrops. But we live in an imperfect world, and sometimes imperfect solutions are necessary.

    Authimage stops spam[PERIOD] That’s why I use it. My daily blog spam count went from 50 to 0. Until there’s a better Wordpress anti-spam hack, I’ll be going with this one.

  3. Comment by Andy — Feb. 11, 2005 @ 11:56 AM

    Jeff Barr’s solution works well - in my estimation there are more people with visual impairments than who can’t read “Type Andy’s name in the box to post” and do it (you could also implement it in multiple languages, before someone says “What about those who can’t read English”)

    For people who speak the same language as the test is written in, at least, if they can’t understand the box then they are probably unlikely to have been able to read and appreciate the post, or make a comment. Far more likely, at least, than people of even basic intelligence who just happen to have a physical impairment.

    At least your captcha is one of the better ones - I’ve tried some that have really weird letter shapes and are crossed in many directions with the same or similarly coloured lines - it’s a complete nightmare. I gave up posting on some sites (probably wish your captcha was like theirs now, eh ;)

    Nothing personal, just hate the way things are going - unfortunately spammers seem to make it harder to comply to standards and maintain security.

  4. Comment by reparacion ordenadores — Feb. 13, 2005 @ 5:40 AM

    Three rules of the spam game:

    1) you can not win.
    2) you can not draw.
    3) you can not leave the play.

    Greetings,

    Antonio

  5. Comment by Joe Schmoe — Feb. 13, 2005 @ 5:53 AM

    For now, I think using low contrast and lines on the verification image are overkill. Thankfully, spam bots have not yet even advanced to the point that they can read my simple image verification codes. So why make things harder on the viewer with unnecessary image obfuscation?

  6. Comment by Patrick Carlow — Feb. 13, 2005 @ 2:43 PM

    Thanks for sharing this excellent solution. I’m in the planning stages for my first blog using wordpress and was looking for an anti-spam solution. I’ve decided now to go with this one based on your recommenedation.

  7. Comment by willem — Feb. 14, 2005 @ 8:31 AM

    hi, really nice the editor of you, but i have this little question. I have this error in the images selection page. “Library doesn’t physically exist” how can i fix this. maybe it is simple but i’m trying it now for over 3 hours and getting creazy! thanks willem.

  8. Comment by Alex — Feb. 26, 2005 @ 1:21 PM

    I have installed plugin according to instructions and it works when user is not logged in. When user is logged, the picture with code is not shown and therefore it is impossible to post (the error still shown.

  9. Comment by tophorse — Feb. 27, 2005 @ 3:11 PM

    my wordpress blog got hit so hard with spam that i reset everything. i think i’ll install this validator hack thingy, sounds great. lemme know how accurate it is!

  10. Comment by Joe Schmoe — Feb. 27, 2005 @ 3:30 PM

    Hey tophorse,
    Before you do that, you might want to try tweaking some of the new anti-spam features of Wordpress 1.5(I see that you just installed it). It’s got some cool stuff like a block-list, banning anonymous proxies, etc.

    I’m gonna give the new features a go before I switch back to authimage.

  11. Comment by James O'Donnell — Apr. 5, 2005 @ 12:51 AM

    Just FYI -> This plugin can be bypassed. I had it on WP 1.2 for some time, I then started to get a lot of spam about 2 months later. It turns out that the image this plugin generates is 100% passable. You can find out more here: http://sam.zoy.org/pwntcha/

  12. Comment by Joe Schmoe — Apr. 5, 2005 @ 2:49 AM

    But most spam-scripts in current use are not advanced enough to decode captchas. I never received a single spam while using authimage. Even that script you link to- the code is not publicly available.

    Just seems that most blog spammers aren’t using very advanced scripts to do their spamming… These days, I’m using an anti-spam system on this site that is MUCH simpler than a captcha, and the site has been spam-free for months.

  13. Comment by Kriss Lasik — Jun. 22, 2005 @ 4:48 PM

    But what about the crip? When user is logged, the picture with code is not shown and therefore it is impossible to post (the error still shown.

  14. Comment by josh schmidte — Nov. 1, 2005 @ 2:49 AM

    ‘course there are algortihms to generate an audio file in various formats (mp3, etc.) for visually impaired users. This is actually quite easy since there are some free text-to-speech servers on the web…

  15. Comment by Brother Bark — Nov. 21, 2005 @ 2:16 AM

    Try the highly effective combination of [Spam Karma 2] and [Bad Behavior]. I’m fairly certain Spam Karma 2 whips out captchas if needed, which is more flexible than an always-on captcha.

  16. Comment by Denis — Nov. 6, 2006 @ 4:00 AM

    good day

  17. Comment by bedrijfskleding — May. 16, 2008 @ 7:29 AM

    does it still works?

  18. Comment by Mary — Jun. 5, 2008 @ 8:49 PM

    Joe Schmoe, it would be nice if you were to experience what it's like to be visually impaired, because maybe you'd be less of an asshat.

    As it happens, I can read the code you use. And I know there are valid reasons for requiring codes right now. Fair enough.

    But a site like YouTube is impossible for me to use. I can comment  3 times before the code kicks in. I have two degrees in English, a law degree, and an MBA, and they are USELESS to me here. I cannot convey the frustration of trying to figure out the letters and type them in - and then to be told I was wrong.

  19. JD Comment by JD — Jun. 6, 2008 @ 1:42 AM

    I have a BS degree. It's in BullShit detection Mary. If you're such an angry blind lady, then how did you enter the code to make that last post? Huh?! Bah, YEAH, GOT YA. I'm fucking awesome!

    I feel no need to defend my choice until I receive an angry comment from someone who CAN'T actually read the code. That’s right - until I get a comment from someone who can't post, I am convinced that at least 99.97% of the world thinks that this code thing is the best idea ever on the internets.

  20. Comment by tom — Jun. 30, 2008 @ 7:28 AM

    shes probably blind in her brown eye too.someone sort her out lol.

RSS feed for comments on this post. TrackBack URI

Leave a comment

 

 

 

 

 

 

 




 

©2008 The Mudbomb Radio Show • All Rights Reserved