19

Don't get me wrong, my motives for this post are entirely altruistic. I enjoy StackOverflow and I want the system to be improved.

I do not like your captcha. I like reCaptcha, but I also like making a lot of edits to my posts and so get hit by the captcha a whole lot more than is necessary. You must revamp the "heat" system used to prompt people with the captcha. For instance if your score is 1k+, then you shouldn't be prompted with a captcha as much. Basically I just want to make sure my posts are accurate and clean without deciphering an entire novel for Google's reCaptcha service.

I accidentally found a bypass to your Captcha implementation. When I make an edit, and get prompted with the captcha, press "back", and then resubmit the form. Presto! No annoying captcha! This back trick seems to only work when you are editing, although I haven't fully tested it.

My Request: Fix the captcha to prevent bots from damaging content and annoying everyone.

| improve this question | |
  • 2
    Capthca? As in Franz? – Aarobot Apr 14 '10 at 21:23
  • 2
    @Aarobot oah i'd edit that, but then i'd have to solve another captcha :) – Rook Apr 14 '10 at 21:25
  • @Aarobot: He found a way to bypass the spell-checker too ("secuirty"?). He's that good. ;) – gnostradamus Apr 14 '10 at 21:26
  • @The Rook, I believe we have an informalish rule around here to not curse(going so far that brainf*ck must be censored) so I edited your question. I really wanted to say "from damaging content and making your users hate the pony overflow system." – Earlz Apr 14 '10 at 21:26
  • @Aarobot Oah yeah that's how i hacked the Gibson. – Rook Apr 14 '10 at 21:27
  • @Earlz yeah I am a firm believer in the first amendment, but that's a flame war I'd like to avoid. – Rook Apr 14 '10 at 21:28
  • 5
    Ironically, I got a captcha cleaning this up. – perbert Apr 14 '10 at 21:32
  • 2
    +1 for the loophole – Lance Roberts Apr 14 '10 at 21:40
  • I almost never get rate-limited anymore, and there are times when I do a lot of rapid edits. I think the system already auto-adjusts based on either past behaviour or rep, but I have only anecdotal evidence to back that up. – Aarobot Apr 14 '10 at 21:48
  • possible duplicate of meta.stackexchange.com/questions/9464/… – Pollyanna Apr 14 '10 at 21:50
  • possible duplicate of meta.stackexchange.com/questions/3346/… – Pollyanna Apr 14 '10 at 21:50
  • possible duplicate of meta.stackexchange.com/questions/35722/… – Daniel Daranas Apr 15 '10 at 13:20
  • possible duplicate of meta.stackexchange.com/questions/2167/… – Daniel Daranas Apr 15 '10 at 13:21
  • 1
    @Daniel and @Pollyanna, So let me get this straight, your trying to tell me that someone else has reported a vulnerability in SO's Captcha and it still hasn't been patched? And then you duplicate your comment? – Rook Apr 15 '10 at 21:16
  • 2
    @The Rook The duplicates are only partial - related to the hate for the captcha. So I recognize that the question is not really a duplicate. About your second question, the comments are not duplicated. – Daniel Daranas Apr 15 '10 at 23:53
9

We already adjust down the threshold, but you need 10k rep for that to happen.

Increase captcha threshold for post editing

| improve this answer | |
  • 1
    I can attest to captchas being way less annoying over 10k. I rarely see them now, and I often do a lot of rapid edits. – Ether Apr 14 '10 at 21:59
  • 3
    why 10k ? Why not 5k ? – Sathyajith Bhat Apr 14 '10 at 23:31
  • 2
    @Ess - I vote it should be moved up to 25k... ;-P – Pollyanna Apr 15 '10 at 3:56
  • 1
    @Ess: I vote 1.506k! (See me SO profile to see how I came up with that number!) – uɐɯsO uɐɥʇɐN Apr 15 '10 at 5:20
  • @Jeff Atwood I'm glad to see that you patched the vulnerability in a timely manner. Now I just left wishing that your made less annoying software. – Rook Apr 16 '10 at 18:52
  • @George Edison heh! @Pollyanna No fair :-/ – Sathyajith Bhat Apr 18 '10 at 2:11
16

I'd like to see it gone, completely, from high rep users.

I doubt it's going to happen though. Jeff and Co. are firm believers in rate limiting.

| improve this answer | |
  • 2
    @rook not a quote, he made that up. In fact I am going to take the extraordinary step of editing this post to remove it, as it is so misleading. – Jeff Atwood Apr 14 '10 at 21:49
  • @Jeff Atwood I removed my inflammatory comment. /me bows apologetically. – Rook Apr 14 '10 at 21:50
  • @Atwood @TheRook - Sorry, sounds like I caused an unnecessary ruckus... – Pollyanna Apr 15 '10 at 3:57
  • What was it? I missed it :( – uɐɯsO uɐɥʇɐN Apr 15 '10 at 5:19
  • @George, meta.stackoverflow.com/posts/46676/revisions – Brad Gilbert Apr 15 '10 at 14:49
9

Essentially, it seems to me you are asking for a "suspicious" bit on the user table, if you are ever presented with a CAPTCHA, no content should EVER be accepted from you until you solve a CAPTCHA.

My question to you would be, are you basing this on an actual issue we have with bots? We use the CAPTCHA as a rate limiter, if you want to answer questions or edit REALLY fast, you are going have to solve a CAPTCHA or wait for the 5 seconds to elapse.

Now, we have plenty of other mechanisms that protect us from bots. This is not the only one. It is essentially a never ending arms race; we adjust our immune system as bots become more sophisticated. We are accepting tons of content daily. At the moment our immune system is quite strong and we are not seeing too many bots and plain old spammers cause a big load on us.

As with any immune system, if the virus becomes more problematic we may need to adjust stuff.

| improve this answer | |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .