需要关于易于使用但安全的验证码的建议/想法
首先，我很清楚与验证码相关的安全性/可用性权衡，并且不需要对此进行任何解释。
我知道 reCAPTCHA 是验证码技术中最先进的，但我们只是不想在我们的网站上使用它，因为用户在阅读扭曲的单词时面临困难。我们的网站是一个为学生提供实时在线课程的学习门户，因此用户将是学生（即将毕业的证书级别）和教师。
我一直在寻找不同的想法，并发现了一些好的想法，例如：
- http://www.usereffect.com/topic/2009-07-13-captcha-is-there-a-更好的方法。
提出对人类来说很容易的问题，例如“哪个味道更好或”。但我需要存储多少这样的问题才能安全呢？
我问这个问题的目的是为了获得尽可能多的想法。我认为在最终确定之前，我仍然可以分析很多用户友好但安全的方法。
请根据垃圾邮件机器人的工作方式强调您建议的方法的优缺点。我不太了解他们的许多优点和缺点。
谢谢，
桑迪潘
To start with, I am well aware of the security/usability trade-off associated with captchas and do not need any explanation on that.
I know that reCAPTCHA is the state-of-the-art in captcha technology but we just do not want to use it for our site because of the difficulty faced by users to read distorted words. Our site is a study portal for students offering live online classes, so the users will be students (leaving certificate level) and teachers.
I have been searching for different ideas and found some good ones like:-
The Sesame Street Solutionas given in http://www.usereffect.com/topic/2009-07-13-captcha-is-there-a-better-way.Asking questions which are very easy for humans like "which one tastes better or ". But how many such questions do I need to store to be safe?
My purpose of asking this question is to get as many ideas as possible. I think there are still a lot of user-friendly but secure ways I could analyse before finalizing.
Please highlight the pros and cons of the method you suggest with reference to the way spam bots work. I am not much aware of many of their strengths and weaknesses.
Thanks,
Sandeepan
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
阅读扭曲的单词是一回事，但要求合法用户输入这样的内容可能会变得非常烦人。因此，不要因反垃圾邮件措施而给用户带来负担，这一点非常重要。
Damien Katz 使用否定验证码来阻止垃圾邮件机器人。这种技术也称为蜜罐领域，易于实现，不需要用户做任何事情。
Ned Batchelder 描述了更复杂的蜜罐实现。它涉及随机字段名称和哈希值，以确保机器人没有篡改表单。
他在文章中指出：
因此，只需要一个简单的技巧就可以迷惑大多数垃圾邮件机器人。再多一点魔法就能对付剩下的机器人。
关于芝麻街解决方案，提出简单的问题或从列表中选择正确的动物：这些问题对于垃圾邮件机器人来说很难回答，但对于用户来说也可能很困难。特别是如果您的网站拥有国际受众，第一语言不是英语的人可能难以理解这些问题。对于学生观众来说，这可能不是问题，但需要记住。
Reading distorted words is one thing, but also asking legit users to enter things like this can get quite annoying. So it's important you don't burden the user with anti-spam measures.
Damien Katz has used a negative captcha to stop spam bots. This technique, also called honeypot field, is easy to implement and doesn't require the user to do anything.
A more complex honeypot implementation is described by Ned Batchelder. It involves randomized field names and hashed values to make sure bots haven't tampered with the form.
In his article he states the following:
So it only takes a simple trick to confuse the majority of spam bots. A little bit more magic will take care of the remaining bots.
Regarding the Sesame Street solution, asking simple question or selecting the correct animal from a list: these are questions that are hard for spam bots to answer, but they can be difficult for users as well. Especially if your site has an international audience, people with a first language other than English may have trouble understanding the questions. It may not be an issue with your student audience, but it is something to keep in mind.
我的一位同事实现的一个方法是呈现一系列带有复选框的随机图像，例如茶杯、船、猫等，并要求用户勾选所有猫（比如说），或者船和树。
这些图像实际上是相当简单的两种颜色图标，但如果需要，您可以使用真实照片。
只需确保您的图像名称不能代表其内容即可。
One a colleague of mine implemented was to present a series of random images of things like tea cups, boats, cats etc. with checkboxes and ask the user to tick all the cats (say), or perhaps the boat and the tree.
The images were fairly simple two colour icons really, though you could use real photos if necessary.
Just make sure that your image names aren't representative of their contents.
首先，ASP.NET 有一个控件，它并不是真正的“验证码”，但实际上恰恰相反 - 一个非常简单的脚本，可确保访问程序可以评估 JavaScript。这摆脱了除了最复杂的抓取工具之外的所有内容，特别是如果 JavaScript 测试的结构会发生变化（即它不仅仅是 var y = 2; var x=y+(来自服务器的随机数); verify(x))
Google和 Craigslist 都使用电话号码，这要求讨厌的机器人至少可以访问支持短信的号码（或语音识别 + 语音线路）
我最喜欢的验证码是点击计算机无法识别的内容，例如挑选动物图片简短列表中的一只猫。
考虑可访问性和易于实施非常重要，reCAPTCHA 在这方面做得很好。
First, ASP.NET has a control that isn't truly a "captcha," but in fact quite the reverse - a very simple script which makes sure that the visiting program can evaluate JavaScript. This gets rid of all but the most complex scrapers, especially if the JavaScript test has a structure that changes (i.e. it isn't just var y = 2; var x=y+(random number from server); verify(x))
Google and Craigslist both use phone numbers, which mandate that a nasty bot at least have access to an SMS-capable number (or speech recognition + voice line)
My favorite captcha is clicking on something that a computer can't recognize, such as picking out a cat from a short list of animal pictures.
It's important to consider accessibility and ease of implementation, which reCAPTCHA does very well.