views:

165

answers:

5

In the blog comments for SO and other blogs, I've noticed a trend in some users posting what the captcha was that they had to solve to get their post accepted.

Are they doing this in order to aid captcha-breaking bots?

If so, is there a way to programmatically (server-side) compare the users' input to the captcha to strip it out of the comment? Is that worth the effort?

+6  A: 

It's just a meme.
It won't default the captcha (unless you use a poor one with a very small list of words). For one, a bot won't be able to get the captcha image that goes with the text.

Definitely not worth trying to strip it out from comments (concentrate on those damn "first post"s!)

Greg
You have a spelling error. It's "Frist!" ;)
Chris Lively
No no, it's "First psot!"
Nifle
A: 

If a captcha is correctly developed, then it should be pseudo-random for every user. So, this wouldn't help anybody, bot or otherwise. If the captcha is unique per blog post, then the users could be posting the captcha to help those users who are blind or have poor vision.

Totty
A: 

I don't see how it would aid the bots as they'll get a completely different captcha. The only way it would work is if a bot was somehow already attached to the user at the time of the posting, but then again, it would be able to store both the picture and the answer in some database instead of the comment body.

Artem Russakovskii
My thinking was if you make a bot crawl blog comments for the captchas I was thinking this could be used to build a dictionary for future attacks. This appears to be unlikely/not useful based on how captchas are generated.
Rob Allen
+3  A: 

I've always seen that practice (which I abhor, incidentally, because it adds nothing of value to the discussion) as an incidental note of coincidence between the topic of discussion and the CAPTCHA word.

DDaviesBrackett
+3  A: 

No. Captchas are only valid captchas if they can automatically generate new puzzles so posting the answer wouldn't help since the same puzzle won't ever be seen again.

Spencer Ruport
+1 If this wouldn't be like this, instead of crawling the comments the (technical) hard way, you could just use human-guided training on say 100 captchas and then let your bot continue with this training data.
schnaader