[RFC] stop distributing worthless CAPTCHAS in 3.1

[tbackoff]

but I still think that it is more from bugs than AI

You're thinking wrong. phpBB 3 has no known vulnerabilities and it went through an extensive security audit.

Also, to everyone, please discuss the RFC. The cheap shots are not needed.

[Master_Cylinder]

Right, this isn't a "bug" in the phpBB or captcha *code*, it's just that it's not working well as an anti-spambot solution anymore.

[DavidIQ]

Already been discussed before:
https://area51.phpbb.com/phpBB/viewtopi ... 08&t=43579

[Master_Cylinder]

Already been discussed before:
https://area51.phpbb.com/phpBB/viewtopi ... 08&t=43579

My bad, feel free to merge, if you prefer...

[DavidIQ]

Yeah was digging through the list of topics to do the merge. All it means is that there is obviously a need/desire from even before to get rid of ineffective CAPTCHAs. This was recently brought to our attention elsewhere as well.

[Master_Cylinder]

Not a problem, you might even merge this one: viewtopic.php?f=108&t=42745
...since it's related. *shrug*

[BTRFISHING]

I personally use Sortables CAPTCHA

https://www.phpbb.com/community/viewtopic.php?t=1795925

I would love to see this integrated from the start

[tbackoff]

The problem is that any CAPTCHA included in phpBB will be broken by the spambots. So then we are right back where we started.

[imkingdavid]

Also, there's the issue of requiring JavaScript. We try to make it so that a default installation does not require JavaScript in order to function properly; sure it will not be as snappy or smooth, but it should still work. If we include, for instance, the Sortables CAPTCHA, no one that has disabled JavaScript will be able to register or do anything else that requires a CAPTCHA.

[Pony99CA]

Also, there's the issue of requiring JavaScript. We try to make it so that a default installation does not require JavaScript in order to function properly; sure it will not be as snappy or smooth, but it should still work. If we include, for instance, the Sortables CAPTCHA, no one that has disabled JavaScript will be able to register or do anything else that requires a CAPTCHA.

If HTML 5 still supports the NOSCRIPT tag, you could either give them an error telling them that JavaScript is required or maybe fall back to a Q&A CAPTCHA.

Steve