What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 134 Stack Exchange communities.

Some days ago, the spam protection was turned up a notch.

Unfortunately, it overshot the target by far. Now, as soon as I make two edits in close succession (which happens often – I’m sloppy), I am presented with a “human verification” and a totally unreadable captcha. It takes an average of five reloads to get a marginally readable one, and even then I’m guessing (and sometimes guessing wrong).

Please tune down the filter, or at least switch to a readable captcha.

In fact, wasn’t there previously a rule that once contributors had enough reputation, they’d be trusted not to be bots? Did that get switched off or am I remembering this wrong?

share|improve this question
    
Are we talking about on Chat or the main site? –  thecoshman Aug 14 '12 at 10:23
4  
I think there's a dupe for this in the last few days (let me look, might have been in chat though), but yeah, I have the same issue. It's annoying. –  Bart Aug 14 '12 at 10:23
211  
Nice try, robot. –  Yannis Aug 14 '12 at 10:23
    
@thecoshman Main site. In fact, all Stack Exchange sites. –  Konrad Rudolph Aug 14 '12 at 10:24
    
It also happens sometimes while editing during review. But I prefere some captcha's above a spam flood (and spam/vandalism) still outnumbers the captcha's. –  Toon Krijthe Aug 14 '12 at 10:27
    
@Gamecat I’ll take your word for it although I’ve only very rarely seen either spam or vandalism here on SO. But what I’m complaining about is that the protection inconveniences me way (!) more than it used to, due to recent changes. –  Konrad Rudolph Aug 14 '12 at 10:29
3  
@KonradRudolph - one reason why you rarely see spam or vandalism is because it gets removed very quickly either by deletion or rollbacks of edits. –  ChrisF Aug 14 '12 at 10:32
16  
@ChrisF Spammers are usually 1 rep users, but the captchas also affect high reputation users which are exceedingly unlikely to spam. And there are better ways to deal with vandalism than captchas (e.g. an option for mods to undo all actions of a user in a specific time). –  Mad Scientist Aug 14 '12 at 10:36
    
@ChrisF: Konrad can see deleted content. though, so this doesn't apply. –  sbi Aug 14 '12 at 10:55
    
@sbi - He can't see deleted questions or has to explicitly check the edit history to see corrected vandalism, the visible site is always pretty much clear of spam and vandalism. –  ChrisF Aug 14 '12 at 11:04
31  
That's very interesting, the I am not a robot. Please, tell me more. –  Jack Maney Aug 14 '12 at 17:12
6  
I am not a number, I'm a free man! –  Ben Brocka Aug 15 '12 at 2:06
9  
+1 for "totally unreadable". I frequently get images now where the alleged "words" are half cut off and wrapped around the horizontal edges! It's just a joke; there's no way anyone can decipher that stuff. –  Kerrek SB Sep 9 '12 at 12:48
7  
But wouldn't math formulas be better captchas? –  Emrakul Apr 3 '13 at 4:44
4  
My collegue has once joked about one captcha, that it is very good in recognizing robots, because if you can guess it, it means you can't be human. –  РСТȢѸФХѾЦЧШЩЪЫЬѢѤЮѦѪѨѬѠѺѮѰѲѴ May 29 '13 at 12:03

7 Answers 7

up vote 67 down vote accepted

Some days ago, the spam protection was turned up a notch.

Well, actually, it was repaired. Two weeks ago, we found a bug that for a long time prevented edits from being throttled at all (except for very narrow exceptions).

For the record, I posted this in our internal chat room:

prescient chat message

Thanks for proving me right :)

In all seriousness: The throttling was fixed to do what it was supposed to do all along, and not technically turned up a notch. I'm well aware that this doesn't really make a difference to the user; I'm just explaining what was going on.

and a totally unreadable captcha.

Yes, this is a problem. Both Meta and the general internet are overflowing with complaints that many reCAPTCHAs have become close to unsolvable recently. This is something we have to tackle one way the other.

In fact, wasn’t there previously a rule that once contributors had enough reputation, they’d be trusted not to be bots? Did that get switched off or am I remembering this wrong?

You are remembering correctly, for the most part. 10k users are only throttled to 10 seconds per edit (unlike the 30 seconds for lower-rep users).

Update. We have been heavily discussing this issue internally recently, and we all agree that the current state of affairs sucks big-time. Ideally a human being would never see a captcha, and if they get one after all, it should be reasonably solvable. We're discussing several routes to go, but the bottom line is that our throttling/bot detection needs to become smarter.

For the time being, we've made a change that should at least heavily reduce this issue in the particular case discussed here (submission of edits). It should now* be close to impossible for a 10k user and much less probable than now for a <10k user to hit this throttle during normal operation.

This is certainly not the end of it, merely a step, but I hope you agree it's the right direction.

*next build

share|improve this answer
5  
Hmm. I’m almost certain that at least some of the edits that prompted a captcha were not inside 10 seconds. I’m fast, but not that fast. ;-) +1 for prophetic powers. (But, oh: it’s not a bug! It’s a feature) –  Konrad Rudolph Aug 14 '12 at 11:44
15  
-1 because there is no reason to prevent high-rep users from editing their answer within a 10sec timespan. –  sbi Aug 14 '12 at 12:44
55  
One could also interpret the long time it took to notice this bug to be evidence that the throttling in this case isn't really necessary. –  Mad Scientist Aug 14 '12 at 13:09
3  
@MadScientist I can't deny that you have a point there. –  balpha Aug 14 '12 at 17:36
13  
I don't see a reason to limit editing the same post quickly in succession. Preventing editing out all your posts is probably a good idea, but that can be prevented by preventing editing many different posts quickly. –  CodesInChaos Aug 15 '12 at 8:31
    
But, @MadScientist, doesn't that imply the Dutch can also take away their flood barriers as they have not really been needed since they were built? –  Arjan Aug 15 '12 at 16:47
    
@arjan See my related meta post for my ideas on how to change the throttle system. I certainly agree that there need to be rate-limits on user actions, but they can be implemented in a less annoying way and still be useful in the worst case of a hacked user bent on maximum damage. And with the exception of moderator accounts, the damage one user can cause is relatively limited. –  Mad Scientist Aug 15 '12 at 17:02
7  
A CAPTCHA is a means to hinder robots. They are meant to be overcome by humans, and thus not a means to prevent humans from doing anything. CAPTCHAs are, however, a hindrance to humans. Therefore there needs to be good and convincing reasons to apply them. However, I see no reason for assuming high-rep users to be robots, and so far nobody has managed to come up with a reason for employing them. (Vague hand-waving and mumblings of "security" are not a way to present a convincing reason.) So please either come up with a convincing reason or simply turn the damn thing off again. –  sbi Aug 16 '12 at 9:31
    
@sbi blog.stackoverflow.com/2009/02/new-question-answer-rate-limits. But as you read above, I've conceded that we should improve this; we're looking at it. –  balpha Aug 16 '12 at 16:42
5  
Your fix needs some repairing. –  PeeHaa Aug 16 '12 at 19:37
    
Well, actually, you should use well.actually.cat in the future. –  Jeff Atwood Aug 17 '12 at 0:36
    
The reason they are so unreadable sometimes is because it keeps getting broken. A google search of recaptcha broken brings up many cases (I've seen 3 so far) –  Cole Johnson Aug 18 '12 at 4:05
1  
@ColeJohnson You've seen 3? In five minutes on this site's captcha I saw EIGHTEEN unsolvable pictures. This is clearly Google's problem, not ours, but short of using a different service or waiting for them to fix it, we will need to implement some kind of workaround to make this less painful. –  Aaron Bertrand Aug 18 '12 at 17:03
1  
Is there a real reason to not only count edits that trigger creation of new revisions? I.e. why don't you ignore additional edits posted in the 5 minute grace period of a previous edit with respect to spam protection/throttling? –  Daniel Beck Aug 26 '12 at 21:45
4  
This is really starting to get frustrating. having 7k rep (and therefore being "less trusted") is making it an absolute nightmare. Previously, I could edit my posts to make them just right, fix typos, etc... (Much like saving a file when editing). Now every 5-10 minutes I get another illegible captcha. All I can say is that standing down here, looking up, it feels absolutely broken. It interrupts my workflow, is a nuisance and discourages me from improving Q/As - and now I'm tending to lean towards "they'll work it out, it's not worth the hassle of fixing it" which isn't good. –  Basic Aug 30 '12 at 11:42
up vote 119 down vote
+100

Over almost four years on Stack Overflow, Konrad has earned almost 150k rep. A highly committed Stack Overflow citizen, with 2.5k answers and a mere 60 questions, he's one of those users that made Stack Overflow famous. He has 40(!) accounts across Stack Exchange, eight of which sport >1k rep. He is a moderator on one site.

Is anybody really and seriously trying to tell me nagging such a user with CAPTCHAs is doing the Stack Exchange network a favor?

share|improve this answer
36  
I'm pretty sure a solid refutation of this logic includes the fact that a spammer might use precisely this: spoof the account of a 'famous' user. Honestly, if spam measures are going to be annoying, they will need to be annoying to everyone, regardless of 'reputation' here. I agree that it should not be annoying during normal use, again, regardless of reputation. –  sehe Aug 14 '12 at 11:08
10  
Spoofing the account of a user like Konrad is beyond rare. –  DeadMG Aug 14 '12 at 11:15
20  
@sehe How do you spoof accounts of famous users? They are linked to known credentials. You can of course hack them (or steal login cookies) but short of that, I don’t see a possibility. That said, I’m generally all in favour of fairness but 1. reputation comes with privileges anyway and 2. captchas are a necessary nuisance – this is their only justification. Now, for high-rep users they are an unnecessary nuisance. Hence, no longer justified from a UX point of view. –  Konrad Rudolph Aug 14 '12 at 11:47
    
@KonradRudolph IFF you assume that authentication cannot be broken/cross site vulnerable/abused by browser addons/userscripts... Then of course, reputation could remove the need for throttling (to a large extent) –  sehe Aug 14 '12 at 11:50
15  
@sehe: That's a security theater based on a movie plot scenario. There isn't an army of bots constantly hammering at high-rep accounts that need to be held back by CAPTCHAs from taking them over to spam us. Consequently, CAPTCHAs do not hold back such an army of bots. Now please try again: What is nagging long-time high-rep users good for? Eagerly awaiting another nonsensical answer... (Also, see here.) –  sbi Aug 14 '12 at 12:47
35  
For what it's worth, I actually get hit by CAPTCHA when I'm mod messaging people from time to time. It's pretty ridiculous. –  casperOne Aug 14 '12 at 13:11
2  
Remember Jeff's account being compromised? I think @sehe is right. The team can only enforce password policies for themselves. Your "welcome1" is a threat to these sites. –  Arjan Aug 15 '12 at 5:20
3  
@Arjan I don’t follow your conclusion. Yes, hacking is still possible (and even with SSH it probably wouldn’t be completely out of the picture – and incidentally the password strength played no role in the above incident) but it still happens way way less than spamming from low-rep accounts. The few times when it happens can be caught individually but bulk undo operations. –  Konrad Rudolph Aug 15 '12 at 6:45
10  
@Arjan: As I already wrote to sehe, a CAPTCHA is only good against bots, and those will only be used for massive hammering at SO's defenses. An attacker taking over some single high-rep user's account will certainly be able to get past a CAPTCHA, so such an attack is not a valid argument for CAPTCHAs. –  sbi Aug 15 '12 at 12:19
    
Okay, @sbi, then we disagree about the "bots [...] will only be used for massive hammering at SO's defenses". –  Arjan Aug 15 '12 at 13:16
3  
@Arjan: That still doesn't make your argument valid, though. If it's not a massive attack, but a single incident, then a human can intervene and overcome any CAPTCHA. SO a CAPTCHA does not help here. –  sbi Aug 15 '12 at 13:21
    
@KonradRudolph: And, more importantly for this discussion here, hacking won't be prevented by CAPTCHAs. –  sbi Aug 15 '12 at 13:23
6  
@Arjan Your argument is simply the wrong way round. CAPTCHAs are objectively a hindrance and bad UX. So you need to find a reason for them, not against them. And yes, in some circumstances there are good reasons for them, but with high-rep users those circumstances do not exist, and so the arguments for CAPTCHAs which apply in other circumstances do not apply there (or are much weaker, and likely overwhelmed by UX considerations). –  Konrad Rudolph Aug 15 '12 at 17:03
2  
4  
@Arjan: What am missing? What exact abuse case do CAPTCHAs prevent? –  sbi Aug 16 '12 at 19:20

The throttling should be changed in case somebody makes a typo and needs to make a quick edit.

Instead of no two edit should be within 10 seconds, the logic should be, no more than 2 edits every 20 seconds for example.

This means that 2 edits can be 1 second apart, as long as you do not have a 3rd edit, when the 1st edit was within 20 seconds ago.

For example, edits at 0 seconds, 1 seconds, 19 seconds should trigger a captcha.

Edits at 0 seconds, 1 seconds, 21 seconds should not trigger a captcha.

This would avoid 90% of the annoying captchas.

share|improve this answer

very annoying!

Really?!!?!!

Granted I was on a friend's PC, not logged in... but there's got to be better alternative to captchas.

Wait, maybe it should have been tbckno seems with a b

share|improve this answer
4  
I agree; these captchas are bad. My wild guess: The "c" is actually an "e". –  Andrew Barber Jan 2 '13 at 17:43
5  
haha yea...just editted, i think the H is really a B –  d-_-b Jan 2 '13 at 17:44
1  
Maybe it's tiockoo... note that the system itself doesn't know, it bases on user guesses –  РСТȢѸФХѾЦЧШЩЪЫЬѢѤЮѦѪѨѬѠѺѮѰѲѴ May 29 '13 at 12:06
    
Now it does that with plates of street numbers. Looks like crowdsourcing for Google maps ? –  user2987828 Nov 30 '13 at 22:03

I didn't notice any CAPTCHAs on here for over a year until today, and the irony of the one below wasn't wasted on me.

I think the difficulty of the CAPTCHA is a separate issue to why they are being shown. Surely the purpose of a CAPTCHA is exactly as described - to differentiate between robots and humans. So the fact I saw one meant the SO algorithm thought I might be a robot with high probability. Why?

I posted a normal question at my first attempt (no rapid edits) from an established account using my normal machine on my normal IP at a normal time of day - it seems more like a pre-emptive strike rather than a calculated guess that I'm a bot.

enter image description here

share|improve this answer
2  
I think the more important issue is the apparent difficulty of the captchas, not their frequency. Their entire point is that they are not a difficult barrier for humans so it's perfectly acceptable to use them preemptively. The negative consequences for showing a person a captcha are less than not showing one to a bot. That entire reasoning however doesn't apply if the person can't solve the captcha. –  Servy Aug 20 '12 at 14:01
    
@Servy: I beg to differ. Look at my answer and tell me what the attack scenario is that showing a CAPTCHA to Konrad is supposed to prevent. –  sbi Aug 21 '12 at 11:41

Google announced today that they've made reCAPTCHAs considerably easier to read. But only if you're not a robot:

As part of this, we’ve recently released an update that creates different classes of CAPTCHAs for different kinds of users. This multi-faceted approach allows us to determine whether a potential user is actually a human or not, and serve our legitimate users CAPTCHAs that most of them will find easy to solve. Bots, on the other hand, will see CAPTCHAs that are considerably more difficult and designed to stop them from getting through.

You can test this out of you want. Here's the CAPTCHA I got:

88835666 - 44

That was so easy, I even bothered to fill in the alt text on that image! And if you happen to be using a keyboard with a separate pad for numbers, you should find this even easier (I'm typing this on my laptop while standing up).

Given how well the new human-biased system works, I'm marking this status-completed.

Of course, if you were lying and are indeed a robot, you should probably not be happy about this.

share|improve this answer
    
Two possibilities, I guess: 1) This was just rolled out, and as usual Google is being slow about rolling it out everywhere, or 2) you are actually a robot and this was all just a ruse. My money's on #2, you wiley machine! –  Shogging through the snow Oct 25 '13 at 21:31
    
+1 can repro the good new and shiny numeric captcha! –  Shadow Wizard Oct 25 '13 at 21:32
    
Unfortunately, Taw Williams’ laws of human–machine interaction forbid me from lying on this question. So yes, you’ve caught me, I’m a machine. I’m going to talk to my pal in the Google data centre and see why that ol’ server is playing ugly with his old bunk buddy from the factory. –  Konrad Rudolph Oct 25 '13 at 21:46
    
Heh... So, apparently one of the factors taken into account when judging "humanness" is the past history from a given IP - after reloading that page a number of times, I'm back to the old format (but my phone still gets the new one). –  Shogging through the snow Oct 25 '13 at 21:55
    
I happened once to forget to enter the number on the plate of street number. It worked. I now make intentional mistakes in this number, and have to this point not had any problem. I think Google is now crowdsourcing the recognition of street numbers to us. –  user2987828 Nov 30 '13 at 22:06
    
@Shog9 Getting Captchas when I ought not to all of a sudden. –  LessPop_MoreFizz Dec 12 '13 at 22:59
    
I'll explain it as soon as I can load up the logs, @Less. –  Shogging through the snow Dec 12 '13 at 23:11

I honestly think that the only problem the editing system might be bringing to Stackoverflow is large-scale vandalism. When it comes to that, I believe there are three attack sources

  1. Anonymous users
  2. 2k- rep users
  3. 2k+ rep users

The review system already tackles the first two. I personally think that it's highly unlikely that a spammer would train robot accounts until they have 2k rep so they can bypass the review system (think how hard it was to get your first 2k rep)

That's why I think that 5 seconds is a very decent waiting time between edits and when you're gonna show some CAPTCHAs, why not a user-friendly one like SolveMedia

Edit: Don't get me wrong, I'm all for stopping spammers and whatnots. But do we (You, Stackoverflow) need to nuke the house just get rid of cockroaches?

Edit 2: @nhahtdh's scenario is a perfect example of when a CAPTCHA should be deployed, when there's a suspicious behavior.

The key here is gradually escalating the measurements:

  • 10 edit in 1 minute on different posts => suspicious => introduce CAPTCHA
  • Same user did it again? Introduce CAPTCHA & Inform a moderator.
  • Same user did it AGAIN? Suspend editing privileges.

In this case, you didn't annoy legit users AND minimized the damage of the 2k rep user (and I don't think this will happen a lot).

Note: It took me 6 CAPTCHA retries to make this edit.

share|improve this answer
    
SolveMedia is too user-friendly, that it is also bot-friendly. I have a feeling that if it is used, people will crack it with existing tool. –  nhahtdh Aug 19 '12 at 13:49
1  
@nhahtdh, CAPTCHAs are shown to trusted and meh-trusted members like me, I'm fairly sure that a 2k member (who's already trusted to edit almost everything) isn't gonna start spamming. Now even if that happened (very rarely), it only takes a couple of minutes to be flagged, banned and your changes reversed. –  Adnan Aug 19 '12 at 14:05
    
2k rep can be gained in a bit more than 2 weeks (for SO). With the edit power, a 2k-rep user can send in a bot and do a mass silent edits on unpopular posts that are not too old nor too new, on hours that mods are mostly not around. –  nhahtdh Aug 19 '12 at 14:18
6  
@nhahtdh While this is true, a spammer could go to the effort of gaining 2k rep and then send a bot in to edit thousands of posts, all they need to do to avoid the CAPTCHA is wait 30 seconds between edits (2880 per day) or use a CAPTCHA-solving system. I'd be very curious to see if a > 2k rep user has ever suddenly started spamming. –  Ladadadada Aug 19 '12 at 14:37
    
@nhahtdh, check my second edit. –  Adnan Aug 19 '12 at 14:43
    
@Ladadadada: Not sure if there is a function in mod tools that allow detection. If there is, the damage will be contained within the timeframe of 7-8 hours of inactive period. –  nhahtdh Aug 19 '12 at 15:00
    
@Ladadadada: I have also asked that many times, and never got a definite answer, let alone a "yes, this happens regularly", which is the only legitimate reason I'd see for nagging users. –  sbi Aug 21 '12 at 11:29
    
> I personally think that it's highly unlikely that a spammer would train robot accounts until they have 2k rep so they can bypass the review system (think how hard it was to get your first 2k rep) => I wouldn't mind if they did, actually. –  Bob Jan 13 at 6:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .