rails - Choosing captcha plugin [closed]

Question

There are a lot of captchas plugins in Rails and also many types of solutions for preventing spamming and flooding. So it isn't only Rails question.

Let's see what types of plugins do we have:

1. Classic image captcha (zendesk's Captcha, Simple_captcha, Validates_captcha, winton's Captcha, Raptcha).

positive:

• Can be effective to prevent automatic decrypt (not sure about Simple_captcha, but it seems that both zendesk's and winton's captchas don't achieve that, as they use pre-generated images (instead of on-demand), so our possible spam bots can be learned on that images).

negative:

• Require DB table (at least Simple Captcha. Not so bad, but do they clean it after use?).
• Require RMagick or similar (not so actual for me, as I already have it on my site).
• Fail manual decrypt ($2/1000 images as I know).
• Annoying to users and can hurts conversion rates.

2. ReCaptcha (Recaptcha, Rack-recaptcha).

positive:

• Can be effective to prevent automatic decrypt.
• Don't require Rmagick and DB table.

negative:

• Make api-calls to 3rd-party site.
• Fail manual decrypt.
• Even more annoying than previous.

3. Honey pots (Negative-captcha, Trap_door, Reverse_captcha, Honeypot-captcha, Bouncy_bots, invisible_captcha).

positive:

• User doesn't know about captcha presense.
• Don't require Rmagick and DB table.

negative:

• May fail automatic decrypt (are there any bots that can recognize this plugins?).
• Fail manual decrypt.

4. Text-base (Humanizer, Brain_buster, Gotcha).

positive:

• Don't require Rmagick and DB table (except of Brain_buster).

negative:

• May fail automatic decrypt.
• Fail manual decrypt.
• Little bit annoying (can be localized).

5. Other (Acts_as_snook)

positive:

• User doesn't know about captcha presense.
• Don't require Rmagick and DB table.

negative:

Don't know if there any because it's very unusual. But I think it may cause problems in case of flooding, as it can require post's moderation in some times.

6. Akismet-like solutions (don't know about their efficiency).

positive:

• User doesn't know about captcha presense.
• Don't require Rmagick and DB table.

negative:

• Make api-calls to 3rd-party site.
• Deliver user's details to 3rd-party site (very, very bad).

I also should say a few words about my site. Users can see protected form only after an ajax request (after putting something to cart for example). Are modern bots have abilities to do ajax requests and storing cookies?

Tedesco

I have a Rails app hosted on Heroku, I would like to use captcha for user signup form. Which solution viable on production ? I can't run RMagick on Heroku right ? – Anteater

I've used simple logic to filter rails forms from spam and it is working great on several production applications. It is like honeypot, but a little bit different:) Recently I moved this plugin into gem protected_form, check it out. It would great to have feedback. – Deduce

Answer 1

Flooding is a different problem from spam. You should definitely build the logic around rate limiting into your application, you can do this using validation to check that the user hasn't, for example, placed more than 2 orders in the last 15 minutes.

In regards to captchas any of the plugins you select are most likely going to be great. I wouldn't think of having to install RMagick as a positive or negative, it really isn't that hard to get working. If it was me choosing, my first instinct would be to go with recaptcha, it's the least annoying of them all.

Spam is another issue, it's often entered by human users who can bypass your captcha. Akismet is great for catching spam, definitely take a look at it, you can use it in conjunction with something like recaptcha.

Finally, modern bots are very sophisticated. Far more sophisticated than any of us probably expect. They can fully automate browsers, use OCR to read captcha text and generate spammy content that will bypass even the most sophisticated filters. That said, it's not about "stopping all spam/bots" it's about making the barrier to entry just high enough that it isn't worth it for the casual user.

Salem

Well, Im also going to use one of that plugins for users registration (without email notifications). So I can only watch user's IP to prevent flooding. But as seen today there are many botnets doing that. So IP blocking is bad idea, isn't it? – Tedesco

Users IPs change, or they may have a work and home computer. – Salem

I mean block the IP instead of saving it for the particular user. IPs can be blocked for some time, 1 hour for example. – Tedesco

Answer 2

Good analysis of the existing plugins.

Modern bots are quite sophisticated, and their developers are paid a lot, so they are always trying to get around the latest defense. For that reason I think its good to stick with an option that is actively maintained and worked on, like ReCaptcha. I also think that the users understand the interface and feel safe knowing that you are taking steps to protect their data.

I had to sift through all of the rails captcha options for a project, and wrote up a sample app for my client to test and try out. simple-captcha-demo.heroku.com

They were all pretty easy to use and set up, and I like using heroku as a test bed to get something set up quickly, and let a client test it out. I also wrote up some of my experience and gotchas on my blog RailsPerformance.com

There may be new plugins, its always good to see what the trending is on www.ruby-toolbox.com

Revegetate

Nice demo page! The reCaptcha link at the very top is broken, in case you care. – Oulman

@clay Thanks. I fixed that broken link, and made it so it won't break again. – Revegetate