Form Submission using CAPTCHA

“Completely Automated Public Turing test to tell Computers and Humans Apart” in short CAPTCHA. Before I could start, I know there are people who are expert in Captcha, there are people who may be newbie and some may be intermediate. I will try my best to put some sound information on this topic which could be useful for different levels.

Now, why we need to separate Human and Computer when both are working on some interface to achieve something together. Yes it is required, because there have been continuous challenges in saving and posting the non-redundant data on internet safely. For the companies who provide the free email accounts, could be a victim of bots (bots are normally web robots, usually a program/script which runs on regular interval), that will create thousands of free email accounts if the User Registration Form has not been handled properly.

There are hackers and/or unauthorized users who will run some automated scripts and try to use the form data for their purpose. They not only read the data and manipulate them but also they could save the information for future proposes. There are instances where the automated programs (published by bots) could use the form data and send unsolicited spans to the number or users.  The best solution for blocking these kinds of attacks would be going with CAPTCHA.

CAPTCHA could be used to restrict these kinds of attacks. If I want to make some points about the CAPTCHA, I would say the following:

• It could be used to prevent automated mass registration of accounts to online mail sites, forums, and blogs and even for polling sites or auction sites.
• There may be some mechanism available using HTML tag to prevent Search Engine bots to restrict the page access. But it will still be open for bots to be able to go inside the site and do whatever they want to do. It provides an effective mechanism to hide your email address from Web scrapers.
• Usually, bots find difficulty in analysing and decoding the captcha keys. So they will not be able to submit the form without passing captcha validation.
•  The idea is to provide users to validate the CAPTCHA before submitting the form.

CAPTCHA Advantages:

• CAPTCHA protects against any bots or brute force or misuse of information.
• It helps in avoiding automatic form submissions.
• CAPTCHA could be used to prevent attacks on Registration, Feedback/Rating Survey, Ticket booking system, any Appointment booking etc.
• Protecting Email Addresses from Scrapers. There are spammers who will be crawling the Web continuously in the search of email address. If Captcha has been implemented it will be very difficult for the bots to bypass the validation and submit the form.
• It helps in preventing Comment Spam in Blogs. These abusive scripts could be continuously submitting some unnecessary comments. It could be used for raising the ranks of the blog in the search engines.
• By using a CAPTCHA, only humans can enter comments on a blog (as they have to pass the captcha validation).
• CAPTCHAs could be used to prevent the attacker for locking the account by providing wrong password or scanning through the system to get the correct password. It could be implemented to validate the CAPTCHA for certain number of times of unsuccessful logins.

Best Practices:

• Right Combinations: Use combination of images, texts and numbers with distorted display.
• Images: Write the script which will generate the images which are complex enough to be deciphered but good enough to be read by the human irrespective of age, language of gender.
• Avoid Complex Design: Make it simple and soothing. It is useless to have complex design for captcha which are difficult for users.
• Say No to Dictionary Word: Do not use scripts which will generate the texts based on dictionary. Use some algorithm which will generate random strings. It is easier for human to identify a distorted word compare to recognize individual distorted characters. The drawback of using the dictionary word scheme in CAPTCHA is the vulnerability to dictionary attack.
• Avoid Complex Background Design: Using colour and complex background pattern are proven to be ineffective since it can reduce the usability without any significant security level improvement.
• Restrict Offensive CAPTCHA: The other factor in CAPTCHA content related to usability issues is the usage of offensive words. Every offensive word that generated automatically by CAPTCHA has a negative effect in user’s satisfaction and eventually will reduce the usability. The best solution to overcome this problem is by keep maintaining the list of words which are considered as offensive or abusive and prevent it from being generated by CAPTCHA.
• Don't Create your own CAPTCHA: There are so many proven plug-ins and jars are available on internet developed by major companies. I personally feel reusing those Captcha scripts rather than developing my own. It will be difficult to understand all the scenarios.  They are up and running with all the possible cases covered.
• Script Security: Building a secure CAPTCHA code is not easy. In addition to making the images unreadable by computers, the system should ensure that there are no easy ways around it at the script level.
• Popularity: Now a day’s Captcha is being used by many famous Web Sites. Some of them are: 
• Google
• Yahoo
• Hotmal
• Paypal etc.

Code Example:

For Step by Step Code Implementation of Captcha, Please follow the ROSE INDIA Site.