Re: [support] Many false applications for accounts
I tried Honeypot, and it indeed cut down the number of false applications by about 80%. I could easily put in a field that legitimate users could fill in correctly, but spammers could not. But how could I check this and automatically cancel applications with bad information for that field? For example, on one site for a fraternity, I asked for the street address of the fraternity. Jim On 4/7/14, 8:00 AM, support-request@drupal.org wrote:
----------------------------------------------------------------------
Message: 1 Date: Mon, 7 Apr 2014 07:28:40 -0400 From: Philip_Wetzel@nhd.uscourts.gov Subject: Re: [support] Many false applications for accounts To: support@drupal.org Cc: support-bounces@drupal.org, wdlists@gmail.com Message-ID: <OFF8EAD2B1.CAE81554-ON85257CB3.003ED071-85257CB3.003F0DAD@uscmail.uscourts.gov>
Content-Type: text/plain; charset=US-ASCII
The CAPTCHA code has been broken a number of times and they've re-engineered it. If it's not currently effective, they'll probably come up with a fix. The game goes on.
From: MBR <mbr@arlsoft.com> To: support@drupal.org, wdlists@gmail.com, Date: 04/05/2014 12:31 PM Subject: Re: [support] Many false applications for accounts Sent by: support-bounces@drupal.org
It's been reported that the bad guys have set up CAPTCHA-breaking networks that distribute the CAPTCHA to people in third-world countries who get paid a small amount for each CAPTCHA they solve. It's looking like CAPTCHA is no longer effective.
I had to solve this problem for a site that was getting hit by about 15 bogus account-registrations per hour, even though CAPTCHA was enabled. The most effective approach I know of at present is to install a module that does reverse-CAPTCHA - i.e. instead of asking the human to prove he's human, it tricks the malware that's trying to pretend to be a human into demonstrating behavior that proves it's just a dumb piece of software. It does this by adding additional <input> tags to every <form> and making them invisible with CSS. A human won't fill in these fields because they won't be displayed. But software that's just parsing HTML will find these fields and fill them in, thus allowing the code on your server to distinguish between responses from humans and responses from machines.
Among the modules that implement this approach are Honeypot, Botcha, and Spamicide. I tried Botcha, but I ran into installation problems. I didn't try Spamicide because it had a critical bug report claiming that the installation erased the default/files directory. Honeypot installed without problems and instantly cut the rate of bogus registrations dramatically. It didn't cut it all the way to 0 as I'd hoped it would, but the rate dropped from about 15/hr. to about 3/day. Mark Rosenthal mbr@arlsoft.com On 4/5/14 8:51 AM, Walt Daniels wrote: I get them to, but it is not mollom's fault. They are actually registering and typing the captcha just like a legitimate user. In our case they even have to use a legitimate email as they cannot do anything more than an anonymous user until the verify their email. I don't see any pattern I could apply to the user names that would distinguish them from our valid users who have some pretty weird usernames. You could find or right a module that enforced using "real names", i.e. John Doe. But I even got some like that that turn out to be spammers.
On Sat, Apr 5, 2014 at 8:13 AM, Linda Romey <lromey@gmail.com> wrote: I am having the same issue. Have you contacted Mollom? That's on my to-do list. I'm not sure of the value of the monthly fee if I still have to continually monitor my site and delete spam accounts manually.
On Sat, Apr 5, 2014 at 8:09 AM, James Rome <jamesrome@gmail.com> wrote: I have Mollom installed, but yet a handful of account applications escape their captcha/analysis each day. The problem is that the only obviously wrong field is the username, which is not listed as a field in the Mollom configuration. I get names such as: qropspension_5362
Is there any other way to get rid of these would-be spammers?
-- James A. Rome
-- [ Drupal support list | http://lists.drupal.org/ ]
-- [ Drupal support list | http://lists.drupal.org/ ]
-- [ Drupal support list | http://lists.drupal.org/ ]
------------------------------
When you pay for on-line purchases via PayPal, it does a 'simulated' transaction for a dollar to verify the accuracy of the data entered. In checking the mail log for my mail server - Postfix/Dovecot, when I send emails there is a message from the remote server confirming the validity of the address. As most registration faculties require an email address, would it not be difficult to do something similar to PayPal in checking whether the remote mail server for the email address will accept the emails for the address entered before processing the registration. Just a thought. Alison At 12:07 AM 08-04-14, you wrote:
I tried Honeypot, and it indeed cut down the number of false applications by about 80%. I could easily put in a field that legitimate users could fill in correctly, but spammers could not. But how could I check this and automatically cancel applications with bad information for that field? For example, on one site for a fraternity, I asked for the street address of the fraternity.
Jim
On 4/7/14, 8:00 AM, support-request@drupal.org wrote:
----------------------------------------------------------------------
Message: 1 Date: Mon, 7 Apr 2014 07:28:40 -0400 From: Philip_Wetzel@nhd.uscourts.gov Subject: Re: [support] Many false applications for accounts To: support@drupal.org Cc: support-bounces@drupal.org, wdlists@gmail.com Message-ID: <OFF8EAD2B1.CAE81554-ON85257CB3.003ED071-85257CB3.003F0DAD@uscmail.uscourts.gov>
Content-Type: text/plain; charset=US-ASCII
The CAPTCHA code has been broken a number of times and they've re-engineered it. If it's not currently effective, they'll probably come up with a fix. The game goes on.
Yes you can prob mail providers and determine if the email is valid, but they may lie. I believe AOL replies yes to any request, at least they used to. On Mon, Apr 7, 2014 at 4:36 PM, Alison <penguin@alisoncc.com> wrote:
When you pay for on-line purchases via PayPal, it does a 'simulated' transaction for a dollar to verify the accuracy of the data entered. In checking the mail log for my mail server - Postfix/Dovecot, when I send emails there is a message from the remote server confirming the validity of the address. As most registration faculties require an email address, would it not be difficult to do something similar to PayPal in checking whether the remote mail server for the email address will accept the emails for the address entered before processing the registration. Just a thought.
Alison
At 12:07 AM 08-04-14, you wrote:
I tried Honeypot, and it indeed cut down the number of false applications by about 80%. I could easily put in a field that legitimate users could fill in correctly, but spammers could not. But how could I check this and automatically cancel applications with bad information for that field? For example, on one site for a fraternity, I asked for the street address of the fraternity.
Jim
On 4/7/14, 8:00 AM, support-request@drupal.org wrote:
----------------------------------------------------------------------
Message: 1 Date: Mon, 7 Apr 2014 07:28:40 -0400 From: Philip_Wetzel@nhd.uscourts.gov Subject: Re: [support] Many false applications for accounts To: support@drupal.org Cc: support-bounces@drupal.org, wdlists@gmail.com Message-ID: < OFF8EAD2B1.CAE81554-ON85257CB3.003ED071-85257CB3.003F0DAD@uscmail.uscourts.gov
Content-Type: text/plain; charset=US-ASCII
The CAPTCHA code has been broken a number of times and they've re-engineered it. If it's not currently effective, they'll probably
come
up with a fix. The game goes on.
-- [ Drupal support list | http://lists.drupal.org/ ]
From: "Walt Daniels" <wdlists@gmail.com> To: support@drupal.org Sent: Monday, April 7, 2014 1:55:59 PM Subject: Re: [support] Many false applications for accounts
Yes you can prob mail providers and determine if the email is valid, but they may lie. I believe AOL replies yes to any request, at least they used to.
Hi Folks, Isn't the traditional way to handle this simply send a link to the registrant's email account? Bogus e-mail; no access. Chris.
Sending a verify link to the registrant to verify is the only way to be sure an email address is valid (at least for a short period of time). On Mon, Apr 7, 2014 at 4:59 PM, Chris Miller <cjm@tryx.org> wrote:
*From: *"Walt Daniels" <wdlists@gmail.com> *To: *support@drupal.org *Sent: *Monday, April 7, 2014 1:55:59 PM
*Subject: *Re: [support] Many false applications for accounts
Yes you can prob mail providers and determine if the email is valid, but they may lie. I believe AOL replies yes to any request, at least they used to.
Hi Folks,
Isn't the traditional way to handle this simply send a link to the registrant's email account? Bogus e-mail; no access.
Chris.
Keep an eye on the email addresses too. GMail offers simple aliasing of email addresses. Basically youremail+somealias@gmail.com will go to youremail. (FYI - a + is valid in an email account, but GMail doesn't allow them in their accounts, so doing a broad *+*@*.* would catch emails that are legit) Jamie Holly http://hollyit.net On 4/7/2014 5:41 PM, Walt Daniels wrote:
Sending a verify link to the registrant to verify is the only way to be sure an email address is valid (at least for a short period of time).
On Mon, Apr 7, 2014 at 4:59 PM, Chris Miller <cjm@tryx.org <mailto:cjm@tryx.org>> wrote:
*From: *"Walt Daniels" <wdlists@gmail.com <mailto:wdlists@gmail.com>> *To: *support@drupal.org <mailto:support@drupal.org> *Sent: *Monday, April 7, 2014 1:55:59 PM
*Subject: *Re: [support] Many false applications for accounts
Yes you can prob mail providers and determine if the email is valid, but they may lie. I believe AOL replies yes to any request, at least they used to.
Hi Folks,
Isn't the traditional way to handle this simply send a link to the registrant's email account? Bogus e-mail; no access.
Chris.
Is there a module for that? ;-) On Apr 7, 2014, at 2:41 PM, Walt Daniels <wdlists@gmail.com> wrote:
Sending a verify link to the registrant to verify is the only way to be sure an email address is valid (at least for a short period of time).
See http://www.nynjtc.org/admin/user/settings See also logintoboggan We run that way but spammers still register. They just go through the process any nonspammer would have to go through. On Mon, Apr 7, 2014 at 7:12 PM, Warren Keuffel <wkeuffel@gmail.com> wrote:
Is there a module for that? ;-)
On Apr 7, 2014, at 2:41 PM, Walt Daniels <wdlists@gmail.com> wrote:
Sending a verify link to the registrant to verify is the only way to be sure an email address is valid (at least for a short period of time).
-- [ Drupal support list | http://lists.drupal.org/ ]
Unfortunately that doesn't solve the problem. Non-bogus email address controlled by malware = access. Mark On 4/7/14 4:59 PM, Chris Miller wrote:
*From: *"Walt Daniels" <wdlists@gmail.com> *To: *support@drupal.org *Sent: *Monday, April 7, 2014 1:55:59 PM *Subject: *Re: [support] Many false applications for accounts
Yes you can prob mail providers and determine if the email is valid, but they may lie. I believe AOL replies yes to any request, at least they used to.
Hi Folks,
Isn't the traditional way to handle this simply send a link to the registrant's email account? Bogus e-mail; no access.
Chris.
participants (7)
-
Alison -
Chris Miller -
James Rome -
Jamie Holly -
MBR -
Walt Daniels -
Warren Keuffel