[Open] Negative Captchas - help me understand spam bots better

Question

I have to decide a technique to prevent spam bots from registering my site. In this question I am mainly asking about negative captchas.

I came to know about many weaknesses of bots but want to know more. I read somewhere that majority of bots do not render/support javascript. Why is it so? How do I test that the visiting program can't evaluate javascript?

I started with this question http://stackoverflow.com/questions/3356337/need-suggestions-ideas-for-easy-to-use-but-secure-captchas Please answer to that question if you have some good captcha ideas.

Then I got ideas about negative captchas here http://damienkatz.net/2007/01/negative_captch.html

But Damien has written that though this technique likely won't work on big community sites (for long), it will work just fine for most smaller sites.

So, what are the chances of somebody making site-specific bots? I assume my site will be a very popular one. How much safe this technique will be considering that?

Negative captchas using complex honeypot implementations here described here http://nedbatchelder.com/text/stopbots.html

Does anybody know how easily can it be implemented? Are there some plugins available?

Thanks,

Sandeepan

Answer 1

Try this one..

Confident Technologies has created a unique Image-based Authentication and Verification solutions that can be imbedded within WCM's. As an example their Images-based Captcha solution offers pure ease of use and more security from BOTS and SPAM when websites have web pages where users can comment, register or blog. Because they are inherently easier the end user has a higher quality experience resulting in less abandons and more loyalty. They also offer Image-based password and authentication solutions that are easier and more secure. http://confidenttechnologies.com/products/

The CAPTCHA products are available for PHP, ASP.NET, Python, Wordpress, Drupal and Joomla; it is FREE and as easy to implement as recaptcha.

Answer 2

How do I test that the visiting program can't evaluate javascript?

Create a hidden field with some fixed value, then write a js which increments or changes it and you will see in the response..