Most accessible configuration

mgifford - April 17, 2009 - 03:28
Project:CAPTCHA Pack
Version:5.x-1.1
Component:Documentation
Category:support request
Priority:normal
Assigned:Unassigned
Status:active
Issue tags:accessibility
Description

I just had a comment about the accessibility of my CAPTCHA config. I use the captcha pack (for D5) and want to know which choices would give me the best results to eliminate comment spam, but not eliminate users with disabilities.

#1

soxofaan - May 15, 2009 - 20:40
Title:Most Accessible Configuration» Most accessible configuration

It depends on the target audience you have in mind.

If you really are worried about efficiency and accessibility, you should also try out the Mollom module

#2

mgifford - May 17, 2009 - 04:13

Lots of outstanding issues with the Mollom module unfortunately. Had some complaints lately about it on the Drupal Groups.

So, let's say that we're targeting CAPTCHA configs that need to work for screen readers. Is there any way to configure the existing tools in this set of modules to block bots, but not screen readers?

Mike

#3

soxofaan - May 17, 2009 - 08:50
Category:feature request» support request

The math CAPTCHA (from CAPTCHA pack or CAPTCHA core module), the unrelated word CAPTCHA and maybe even the lost character CAPTCHA should be accessible for screen readers.

How effective these are depends on the sophistication of the spam bots.
But to have a simple baseline performance measure:
say the bots know the set of possible answers (which is rather limited in case of the aforementioned modules) and just pick randomly, the block efficiency would be (with the default settings):

  • math CAPTCHA: around 19/20 = 95% (right answer is between 1 and 20)
  • unrelated word CAPTCHA: 4/5 = 80% (pick the right word from 5 possibilities)
  • lost character CAPTCHA: 25/26 = 96% (pick right character from all possible characters)

You can configure the challenges to have higher efficiencies.

More sophisticated bots could do better of course, the challenges are not impossible to automate, but I didn't hear of this happening, yet. I even think that the typical spam bots that target low profile sites for the moment are simpler than the random answering scheme described above.
But you shouldn't put these CAPTCHAs on a high profile site of course, it doesn't require a PhD in computer science to write a spam bot that can crack them :)

#4

mgifford - May 17, 2009 - 20:08

Thanks for this! Putting these 3 on random would certainly help confuse the bots. But yes, it's a matter of odds to get rid of all of them.

Oh yeah, could this be put into the documentation for CAPTCHA? That way it could be available more easily for others.

Mike

 
 

Drupal is a registered trademark of Dries Buytaert.