设计身份验证：需要验证码吗？
我正在使用 Rails 3 下的 devise 身份验证插件。目前，我已禁用电子邮件确认，因此注册非常简单快捷。
我想知道是否需要某种验证码来保护网站免受机器人攻击。我想避免我的数据库充满假用户，尽管这不会对系统造成太大损害（除了填满磁盘！）。
如果强烈建议使用验证码，那么如果登录/注册仅限于 HTTPS 也是如此吗？机器人使用 HTTPS 吗？
I'm using the devise authentication plugin under rails 3. At the moment, I have disabled the email confirmation, so that sign up is really easy and fast.
I'm wondering if some kind of captcha is necessary to protect the site agains bots. I would like to avoid having my database filled with fake users, although this couldn't do much harm to the system (except filling up the disks!).
If a captcha is strongly recommended, is it also true if sign in/up is restricted to HTTPS? Do bots use HTTPS?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
我认为这是一种必要的罪恶。希望我们不必使用它，但我们并不生活在一个理想的世界中。图像旋转验证码绝对不美观，应该避免。
我认为您需要灵活对待验证码和您使用的验证码类型。该战略将会而且应该不断发展。
最初，当您没有很多用户时，您可以完全避免验证码。一旦事情开始加速并且您开始在系统中看到机器人，请使用隐形验证码（或反向验证码）。反向验证码基本上依赖于某些未被人类填写的字段来识别人类（通过使用 css 将其设置为不可见，在表单上放置一个人类无法看到的字段；机器人会找到该字段，填充它，如果字段被填充，您就知道它是不是人类；如果你愿意的话，可以说是蜜罐场）。
最终，当您的网站变得非常受欢迎并且成为机器人的目标时，您将采用更难的验证码，这种验证码不容易被破解，但用户可能会为了注册您非常非常受欢迎的网站而忽略它。
所以从没有验证码开始，然后进化。
i think it's a necessary evil. Wish we didnt have to use it but we dont live in an ideal world. Image twirly captcha is definitely not aesthetically nice and should really be avoided.
I think you need to be flexible about captcha and the kind of captcha you use. The strategy will and should evolve.
Initially when you dont have many users, you may avoid captcha altogether. Once things start picking up steam and you start seeing bots in the system, go for inivisible captcha (or reverse captcha). Reverse captcha basically relies on certain field NOT being filled by humans to identify humans (put a field which humans cant see on the form by making it invisible using css; bots will find that field, fill it and if the fields comes filled you know its not a human; a honeypot field if you will).
Eventually when you site becomes really popular, and a target for bots, you'll go for harder captcha which wont be easy to break but users might overlook it in order to signup to your very-very-popular site.
So start with no captcha and then evolve.
我不明白机器人如何无法访问使用 SSL 的页面，因此如果您想避免机器人用户，请添加验证码或激活电子邮件确认。另一种非常非常简单的替代方案（如果您想进行注册/登录）可能是使用 OmniAuth（Devise 也支持）。
I don't see how bots couldn't access pages that uses SSL, so if you want to avoid bot users, add the captcha or activate the email confirmation. An alternative (if you want to make sign up/sign in) really, really easy could be to use OmniAuth (which is also supported by Devise).
我推荐一个验证码，它是一个很好的机器人过滤器，不需要太多工作；如果您担心其有效性，请使用 reCAPTCHA - 它似乎具有相当的弹性并且集成良好。
至于 HTTPS 机器人 - 如果它们现在不存在，那么几个月后就会出现（随着 FireSheep 的出现，越来越多的网站正在考虑使用 HTTPS）。
I'd recommend a CAPTCHA, it's a good bot filter for not that much work; if you're worried about its effectivity, use reCAPTCHA - it seems to be reasonably resilient and integrates well.
As for HTTPS bots - if they don't exist now, they will in a few months (as more sites are considering HTTPS in the wake of FireSheep).