So, a few days ago, I lamented the use of CAPTCHA on so many web sites, as it seems that the usability issues it causes have been completely overlooked by most developers. I promised I would follow up with some alternatives to this method, so without further adieu…
Mathematical Puzzles
The benefit of this approach is that you can provide random simple problems to solve, normally simple math, without having to distort text. While the user is probably surprised that they would have to tell you what 4 + 3 is to get an account, you can easily explain its purposes. It is generally quick and painless and through random problem creation, you can ensure that bots don’t figure out all your puzzles.
UPDATE: check out a rails plugin that does math based CAPTCHA called less-captcha
Logic Puzzles
If simple math is not your thing, then logic puzzles are another useful alternative. For example, you can ask a user to pick out an obvious color (like black) that is not a part of the colors of a rainbow. You could also ask the user to tell you which animal has feathers…an owl, dog or cat. These items are simple for most humans to comprehend, but complex for a bot to handle programmatically.
E-mail Verification
This method, which involves the system sending a user a quick verification email and having the user respond to that email, has seen some decline in overall use. However, it is still an effective way to weed out unwanted bots from clogging up your account forms. The most obvious downside is that it could hinder the sign-up process if there were any delays in the user getting the message. Add to that the inability to control factors such as the delay, and it makes this a less attractive alternative.
Also, email verification is not a useful method if you are simply trying to verify that a human is making comments on your blog, participating in a chat, etc.
Blank form fields
As of this writing, I have not seen this method used that often, but it seems simple enough. Basically, when you create some type of form (a sign-up page, personal information gatherer, etc.) you insert a couple of extra form fields and then provide instructions to the user to not place any data in the fields. An automated bot will fill out all form fields it encounters, telling the submitted form that the data received is probably from an automated source.
I wonder if you could effective provide extra form fields in the code, but then hide them through opacity settings in CSS. That way, you would ensure that any data entered was from a bot, because the user would not be able to see the hidden form fields.
Manage it yourself
Finally, the most user-friendly of all the options…do the heavy-lifting of sifting through good and bad results yourself. There are tools out there, and most popular blogging engines have spam-filtering (like Akismet for example), that assist in filtering out submitted form data, posts, etc., but there will still be some manual aspect of it. Ultimately, you must decide if it is worth adding a barrier between you and potential customers or interactions just to save you a few minutes of grief each week.
Generally speaking, it is just a bad idea to use CAPTCHA methods that utilize distorted imagery anywhere on your web site. Consider your parents or grandparents…would they have an issue using that method if they were trying to sign up for your web site? The last thing you want to do is make it challenging for someone to use your app, get involved in your blog or join your community.
Just do the right thing.
