[RFC] stop distributing worthless CAPTCHAS in 3.1

[Kamahl19]

In my opinion, we should remove all picture based captchas because most of them are useless and the rest will be useless in time of 3.1 release date. phpBB could come with Q&A plugin and JS based captcha plugin. Q&A would be the default plugin and there would be a warning for administrator when he will want to choose the JS based plugin. phpBB default installation would still work without JS and admin with knowledge about JS requirement could choose better captcha without installing the MOD.

[leschek]

Q&A would be the default plugin

I'm not developer, but I don't think this is best idea. You would have to add setting for QaA into installation page (and force users to fill this setting) or provide default question and answer and somehow explain to administrators that they have to change it. And if they don't change it their boards would be unprotected. I guess it's better to have not so good working picture captcha than one on all boards same default question.

[Kamahl19]

Not so good working captcha = broken captcha = no problem for bots but annoying for real users. So yea, I would rather have no captcha then bad captcha. Moreover, I dont see a problem in setting the Q&A in installation process.

[Pony99CA]

Q&A would be the default plugin

I'm not developer, but I don't think this is best idea. You would have to add setting for QaA into installation page (and force users to fill this setting) or provide default question and answer and somehow explain to administrators that they have to change it. And if they don't change it their boards would be unprotected. I guess it's better to have not so good working picture captcha than one on all boards same default question.

There's already an RFC discussing making Q&A the default CAPTCHA, and I proposed a simple way to avoid every board having the same question. So let's not rehash that in this topic.

This topic should be about what CAPTCHAs should be kept and what the default CAPTCHA would be. If we agree on Q&A, we can discuss that in the linked topic; if we decide on something else, we can discuss that here and mark that topic as Rejected.

Steve

[Master_Cylinder]

Rehashing that isn't a bad thing since there wasn't agreement whether the random Q&A would be solvable by bots. When you ask for "odd," "even" or "first, third and sixth characters" some bots can figure that out, imho. The biggest problem with Q&A (even if it's forced at install) is that there is NO way to force admins to write *good* questions so you KNOW some admin will use "what's my favorite color?" or "what is my favorite car?"

[Kamahl19]

Agree, those random Q can be broken. Admin should find out Q related to his forum. For example I was working on forum for citizens of one British town and I proposed to use the questions like "In what district is our town" and "What is the full name of our town". They have no spam now. Or I have been working on a forum about old books etc, so I suggested something like "Who ate the Little red raiding hood", again no spam since then.

So maybe good examples for admins would be better then randomly generated Q.

[leschek]

This topic should be about what CAPTCHAs should be kept and what the default CAPTCHA would be. If we agree on Q&A, we can discuss that in the linked topic; if we decide on something else, we can discuss that here and mark that topic as Rejected.

Then I would keep QaA, reCaptcha and as default the for bots most difficult picture captcha.

[Mess]

"Who ate the Little red raiding hood"

Interesting. Googling that question gives the answer in the first 3 hits. If you spell it correct "Who ate the little red riding hood".
Maybe its because the answer is complex enough that is not easily cracked.

Other questions which can be easily googled are cracked. Like "What is 7 x 5" or "what is the capital of algeria"

[Kamahl19]

leschek, most difficult picture captcha is also able to broke and it is very annoying for people. Even I with good sight am not able to read many captchas. And reCaptcha is broken, so why should we keep it? I had reCaptcha on 2 my boards and I had 100 bots per day. Totally useless.

Mess, the Q was in Slovak language. Moreover, I dont think that compures understand this question and can find the A via google. I see it is in third article, but bot does not know that wolf is the answer, because the word wolf is in sentence.

Yes 7 x 5 is not good idea. We need more "board specific" Q.

[Master_Cylinder]

Nobody ate Red, the wolf ate grandma and tried to eat Red but the woodsman saved her with his ax.

Something needs to be done about captcha but what should replace it is a bit complicated.