Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Subject: Re: human validation on post comments
Date: Tue, 21 Mar 2006 14:42:01 +0100
Message-ID: <6BCB9D8A16AC4241919521715F4D8BCEA3519D@algol.sollentuna.se>
Thread-Topic: [pgsql-www] human validation on post comments
Thread-Index: AcZMqkdRe4tdx4feQZGGrSeF4mVncwAQre6Q
From: "Magnus Hagander" <mha@sollentuna.net>
To: "David Fetter" <david@fetter.org>,
	"PostgreSQL WWW" <pgsql-www@postgresql.org>

> > > I have been integrating a component that will ask the=20
> user to enter=20
> > > the word in a dynamic image before their comments can be=20
> submitted.
> >=20
> > Terrific!  I'm sure the people who clear the comments will=20
> have nice=20
> > things to say.
> >=20
> > The image is generated dynamically?   That's good -- the spammers
> > are already working on systems that harvest static images=20
> from sites=20
> > and match them against a database.  Grrrr.
>=20
> Actually, they've already got one, and here's how it works:
>=20
> 1.  Put up a free porn site.
> 2.  Present somebody else's capcha image as an entry.
> 3.  Let the person see the porn if they've correctly cracked the
>     capcha.
> 4.  Spam site.
>=20
> The sad part of this one is that they don't have to crack any=20
> single capcha system.  Instead, they've cracked the entire=20
> capcha process.

I don't know how this particular system is set up, but how can they
defeat something like:

* Fill in form data. Submit
* Generate verification page containing an image. Along with the code,
store the hash of the form data.
* Validate the image against the hash of the data.

Means you need to put in all your data in the form beforehand, so you
have to tailor one page to each set of contenst. Or am I thinking
completely wrong here :-)

//Magnus