negative_captcha 0.2.beta → 0.2.beta2
Sign up to get free protection for your applications and to get access to all the features.
- data/README.markdown +111 -0
- data/Rakefile +1 -1
- data/lib/negative_captcha/view_helpers.rb +47 -45
- data/lib/negative_captcha.rb +2 -1
- metadata +5 -5
- data/README.textile +0 -150
data/README.markdown
ADDED
|
@@ -0,0 +1,111 @@
|
|
|
1
|
+
# Negative Captcha
|
|
2
|
+
|
|
3
|
+
## What is a Negative Captcha?
|
|
4
|
+
|
|
5
|
+
A negative captcha has the exact same purpose as your run-of-the-mill image captcha: To keep bots from submitting forms. Image ("positive") captchas do this by implementing a step which only humans can do, but bots cannot: read jumbled characters from an image. But this is bad. It creates usability problems, it hurts conversion rates, and it confuses the shit out of lots of people. Why not do it the other way around? Negative captchas create a form that has tasks that only bots can perform, but humans cannot. This has the exact same effect, with (anecdotally) a much lower false positive identification rate when compared with positive captchas. All of this comes without making humans go through any extra trouble to submit the form. It really is win-win.
|
|
6
|
+
|
|
7
|
+
## How does it work?
|
|
8
|
+
|
|
9
|
+
In a negative captcha form there are two main parts and three ancillary parts. I'll explain them thusly.
|
|
10
|
+
|
|
11
|
+
### Honeypots
|
|
12
|
+
|
|
13
|
+
Honeypots are form fields which look exactly like real form fields. Bots will see them and fill them out. Humans cannot see them and thusly will not fill them out. They are hidden indirectly- usually by positioning them off to the left of the browser. They look kind of like this:
|
|
14
|
+
|
|
15
|
+
<div style="position: absolute; left: -2000px;"><input type="text" name="name" value="" /></div>
|
|
16
|
+
|
|
17
|
+
### Real fields
|
|
18
|
+
|
|
19
|
+
These fields are the ones humans will see, will subsequently fill out, and that you'll pull your real form data out of. The form name will be hashed so that bots will not know what it is. They look kind of like this:
|
|
20
|
+
|
|
21
|
+
<input type="text" name="685966bd3a1975667b4777cc56188c7e" />
|
|
22
|
+
|
|
23
|
+
### Timestamp
|
|
24
|
+
|
|
25
|
+
This is a field that is used in the hash key to make the hash different on every GET request, and to prevent replayability.
|
|
26
|
+
|
|
27
|
+
### Spinner
|
|
28
|
+
|
|
29
|
+
This is a rotating key that is used in the hash method to prevent replayability. I'm not sold on its usefulness.
|
|
30
|
+
|
|
31
|
+
### Secret key
|
|
32
|
+
|
|
33
|
+
This is simply some key that is used in the hashing method to prevent bots from backing out the name of the field from the hashed field name.
|
|
34
|
+
|
|
35
|
+
## How does Negative Captcha work?
|
|
36
|
+
|
|
37
|
+
### Installation
|
|
38
|
+
|
|
39
|
+
You can let bundler install Negative Captcha by adding this line to your application’s Gemfile:
|
|
40
|
+
|
|
41
|
+
gem 'negative_captcha'
|
|
42
|
+
|
|
43
|
+
And then execute:
|
|
44
|
+
|
|
45
|
+
bundle install
|
|
46
|
+
|
|
47
|
+
### Controller Hooks
|
|
48
|
+
|
|
49
|
+
Place this before filter at the top of the controller you are protecting:
|
|
50
|
+
|
|
51
|
+
before_filter :setup_negative_captcha, :only => [:new, :create]
|
|
52
|
+
|
|
53
|
+
In the same controller include the following private method:
|
|
54
|
+
|
|
55
|
+
private
|
|
56
|
+
def setup_negative_captcha
|
|
57
|
+
@captcha = NegativeCaptcha.new(
|
|
58
|
+
:secret => NEGATIVE_CAPTCHA_SECRET, #A secret key entered in environment.rb. 'rake secret' will give you a good one.
|
|
59
|
+
:spinner => request.remote_ip,
|
|
60
|
+
:fields => [:name, :email, :body], #Whatever fields are in your form
|
|
61
|
+
:params => params
|
|
62
|
+
)
|
|
63
|
+
end
|
|
64
|
+
|
|
65
|
+
Modify your POST action(s) to check for the validity of the negative captcha form
|
|
66
|
+
|
|
67
|
+
def create
|
|
68
|
+
@comment = Comment.new(@captcha.values) #Decrypted params
|
|
69
|
+
if @captcha.valid? && @comment.save
|
|
70
|
+
redirect_to @comment
|
|
71
|
+
else
|
|
72
|
+
flash[:notice] = @captcha.error if @captcha.error
|
|
73
|
+
render :action => 'new'
|
|
74
|
+
end
|
|
75
|
+
end
|
|
76
|
+
|
|
77
|
+
### Form Example
|
|
78
|
+
|
|
79
|
+
Modify your form to include the honeypots and other fields. You can probably leave any select, radio, and check box fields alone. The text field/text area helpers should be sufficient.
|
|
80
|
+
|
|
81
|
+
<% form_tag comments_path do -%>
|
|
82
|
+
<%= raw negative_captcha(@captcha) %>
|
|
83
|
+
<ul class="contact_us">
|
|
84
|
+
<li>
|
|
85
|
+
<%= negative_label_tag(@captcha, :name, 'Name:') %>
|
|
86
|
+
<%= negative_text_field_tag @captcha, :name %>
|
|
87
|
+
</li>
|
|
88
|
+
<li>
|
|
89
|
+
<%= negative_label_tag(@captcha, :email, 'Email:') %>
|
|
90
|
+
<%= negative_text_field_tag @captcha, :email %>
|
|
91
|
+
</li>
|
|
92
|
+
<li>
|
|
93
|
+
<%= negative_label_tag(@captcha, :body, 'Your Comment:') %>
|
|
94
|
+
<%= negative_text_area_tag @captcha, :body %>
|
|
95
|
+
</li>
|
|
96
|
+
<li>
|
|
97
|
+
<%= submit_tag %>
|
|
98
|
+
</li>
|
|
99
|
+
</ul>
|
|
100
|
+
<% end -%>
|
|
101
|
+
|
|
102
|
+
### Test and enjoy!
|
|
103
|
+
|
|
104
|
+
## Possible Gotchas and other concerns
|
|
105
|
+
|
|
106
|
+
* It is still possible for someone to write a bot to exploit a single site by closely examining the DOM. This means that if you are Yahoo, Google or Facebook, negative captchas will not be a complete solution. But if you have a small application, negative captchas will likely be a very, very good solution for you. There are no easy work-arounds to this quite yet. Let me know if you have one.
|
|
107
|
+
* I'm not a genius. It is possible that a bot can figure out the hashed values and determine which forms are which. I don't know how, but I think they might be able to. I welcome people who have thought this out more thoroughly to criticize this method and help me find solutions. I like this idea a lot and want it to succeed.
|
|
108
|
+
|
|
109
|
+
## Credit
|
|
110
|
+
|
|
111
|
+
The idea of a negative captcha is not mine. It originates (I think) from Damien Katz of CouchDB. I (Erik Peterson) wrote the plugin. Calvin Yu wrote the original class which I refactored quite a bit and made into the gem.
|
data/Rakefile
CHANGED
|
@@ -17,7 +17,7 @@ Rake::RDocTask.new(:rdoc) do |rdoc|
|
|
|
17
17
|
rdoc.rdoc_dir = 'rdoc'
|
|
18
18
|
rdoc.title = 'NegativeCaptcha'
|
|
19
19
|
rdoc.options << '--line-numbers' << '--inline-source'
|
|
20
|
-
rdoc.rdoc_files.include('README.
|
|
20
|
+
rdoc.rdoc_files.include('README.markdown')
|
|
21
21
|
rdoc.rdoc_files.include('lib/**/*.rb')
|
|
22
22
|
end
|
|
23
23
|
|
|
@@ -4,58 +4,60 @@ module NegativeCaptchaViewHelpers
|
|
|
4
4
|
included do
|
|
5
5
|
end
|
|
6
6
|
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
7
|
+
module ClassMethods
|
|
8
|
+
def negative_captcha(captcha)
|
|
9
|
+
[
|
|
10
|
+
hidden_field_tag('timestamp', captcha.timestamp),
|
|
11
|
+
hidden_field_tag('spinner', captcha.spinner),
|
|
12
|
+
].join
|
|
13
|
+
end
|
|
13
14
|
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
15
|
+
def negative_text_field_tag(negative_captcha, field, options={})
|
|
16
|
+
text_field_tag(
|
|
17
|
+
negative_captcha.fields[field],
|
|
18
|
+
negative_captcha.values[field],
|
|
19
|
+
options
|
|
20
|
+
) +
|
|
21
|
+
content_tag('div', :style => 'position: absolute; left: -2000px;') do
|
|
22
|
+
text_field_tag(field, '', :tabindex => '999', :autocomplete => 'off')
|
|
23
|
+
end
|
|
22
24
|
end
|
|
23
|
-
end
|
|
24
25
|
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
26
|
+
def negative_text_area_tag(negative_captcha, field, options={})
|
|
27
|
+
text_area_tag(
|
|
28
|
+
negative_captcha.fields[field],
|
|
29
|
+
negative_captcha.values[field],
|
|
30
|
+
options
|
|
31
|
+
) +
|
|
32
|
+
content_tag('div', :style => 'position: absolute; left: -2000px;') do
|
|
33
|
+
text_area_tag(field, '', :tabindex => '999', :autocomplete => 'off')
|
|
34
|
+
end
|
|
33
35
|
end
|
|
34
|
-
end
|
|
35
36
|
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
37
|
+
def negative_hidden_field_tag(negative_captcha, field, options={})
|
|
38
|
+
hidden_field_tag(
|
|
39
|
+
negative_captcha.fields[field],
|
|
40
|
+
negative_captcha.values[field],
|
|
41
|
+
options
|
|
42
|
+
) +
|
|
43
|
+
"<div style='position: absolute; left: -2000px;'>" +
|
|
44
|
+
hidden_field_tag(field, '', :tabindex => '999') +
|
|
45
|
+
"</div>"
|
|
46
|
+
end
|
|
46
47
|
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
48
|
+
def negative_password_field_tag(negative_captcha, field, options={})
|
|
49
|
+
password_field_tag(
|
|
50
|
+
negative_captcha.fields[field],
|
|
51
|
+
negative_captcha.values[field],
|
|
52
|
+
options) +
|
|
53
|
+
"<div style='position: absolute; left: -2000px;'>" +
|
|
54
|
+
password_field_tag(field, '', :tabindex => '999') +
|
|
55
|
+
"</div>"
|
|
56
|
+
end
|
|
56
57
|
|
|
57
|
-
|
|
58
|
-
|
|
58
|
+
def negative_label_tag(negative_captcha, field, name, options={})
|
|
59
|
+
label_tag(negative_captcha.fields[field], name, options)
|
|
60
|
+
end
|
|
59
61
|
end
|
|
60
62
|
|
|
61
63
|
#TODO: Select, check_box, etc
|
data/lib/negative_captcha.rb
CHANGED
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
require 'digest/md5'
|
|
2
|
+
require 'action_view'
|
|
2
3
|
|
|
3
4
|
class NegativeCaptcha
|
|
4
5
|
attr_accessor :fields,
|
|
@@ -77,6 +78,6 @@ end
|
|
|
77
78
|
|
|
78
79
|
|
|
79
80
|
require 'negative_captcha/view_helpers'
|
|
80
|
-
|
|
81
|
+
ActionView::Base.send :include, NegativeCaptchaViewHelpers
|
|
81
82
|
|
|
82
83
|
require "negative_captcha/form_builder"
|
metadata
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: negative_captcha
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.2.
|
|
4
|
+
version: 0.2.beta2
|
|
5
5
|
prerelease: 4
|
|
6
6
|
platform: ruby
|
|
7
7
|
authors:
|
|
@@ -9,10 +9,10 @@ authors:
|
|
|
9
9
|
autorequire:
|
|
10
10
|
bindir: bin
|
|
11
11
|
cert_chain: []
|
|
12
|
-
date: 2012-
|
|
12
|
+
date: 2012-06-01 00:00:00.000000000 Z
|
|
13
13
|
dependencies:
|
|
14
14
|
- !ruby/object:Gem::Dependency
|
|
15
|
-
name:
|
|
15
|
+
name: actionpack
|
|
16
16
|
requirement: !ruby/object:Gem::Requirement
|
|
17
17
|
none: false
|
|
18
18
|
requirements:
|
|
@@ -35,7 +35,7 @@ extensions: []
|
|
|
35
35
|
extra_rdoc_files: []
|
|
36
36
|
files:
|
|
37
37
|
- LICENSE
|
|
38
|
-
- README.
|
|
38
|
+
- README.markdown
|
|
39
39
|
- Rakefile
|
|
40
40
|
- lib/negative_captcha.rb
|
|
41
41
|
- lib/negative_captcha/form_builder.rb
|
|
@@ -60,7 +60,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
|
60
60
|
version: 1.3.1
|
|
61
61
|
requirements: []
|
|
62
62
|
rubyforge_project:
|
|
63
|
-
rubygems_version: 1.8.
|
|
63
|
+
rubygems_version: 1.8.23
|
|
64
64
|
signing_key:
|
|
65
65
|
specification_version: 3
|
|
66
66
|
summary: A library to make creating negative captchas less painful
|
data/README.textile
DELETED
|
@@ -1,150 +0,0 @@
|
|
|
1
|
-
h1. Negative Captcha
|
|
2
|
-
|
|
3
|
-
h2. What is a Negative Captcha?
|
|
4
|
-
|
|
5
|
-
A negative captcha has the exact same purpose as your run-of-the-mill image captcha: To keep bots from submitting forms. Image ("positive") captchas do this by implementing a step which only humans can do, but bots cannot: read jumbled characters from an image. But this is bad. It creates usability problems, it hurts conversion rates, and it confuses the shit out of lots of people. Why not do it the other way around? Negative captchas create a form that has tasks that only bots can perform, but humans cannot. This has the exact same effect, with (anecdotally) a much lower false positive identification rate when compared with positive captchas. All of this comes without making humans go through any extra trouble to submit the form. It really is win-win.
|
|
6
|
-
|
|
7
|
-
h2. How does it work?
|
|
8
|
-
|
|
9
|
-
In a negative captcha form there are two main parts and three ancillary parts. I'll explain them thusly.
|
|
10
|
-
|
|
11
|
-
h3. Honeypots
|
|
12
|
-
|
|
13
|
-
Honeypots are form fields which look exactly like real form fields. Bots will see them and fill them out. Humans cannot see them and thusly will not fill them out. They are hidden indirectly- usually by positioning them off to the left of the browser. They look kind of like this:
|
|
14
|
-
|
|
15
|
-
<pre>
|
|
16
|
-
<code>
|
|
17
|
-
<div style="position: absolute; left: -2000px;"><input type="text" name="name" value="" /></div>
|
|
18
|
-
</code>
|
|
19
|
-
</pre>
|
|
20
|
-
|
|
21
|
-
h3. Real fields
|
|
22
|
-
|
|
23
|
-
These fields are the ones humans will see, will subsequently fill out, and that you'll pull your real form data out of. The form name will be hashed so that bots will not know what it is. They look kind of like this:
|
|
24
|
-
|
|
25
|
-
<pre>
|
|
26
|
-
<code>
|
|
27
|
-
<input type="text" name="685966bd3a1975667b4777cc56188c7e" />
|
|
28
|
-
</code>
|
|
29
|
-
</pre>
|
|
30
|
-
|
|
31
|
-
h4. Timestamp
|
|
32
|
-
|
|
33
|
-
This is a field that is used in the hash key to make the hash different on every GET request, and to prevent replayability.
|
|
34
|
-
|
|
35
|
-
h4. Spinner
|
|
36
|
-
|
|
37
|
-
This is a rotating key that is used in the hash method to prevent replayability. I'm not sold on its usefulness.
|
|
38
|
-
|
|
39
|
-
h4. Secret key
|
|
40
|
-
|
|
41
|
-
This is simply some key that is used in the hashing method to prevent bots from backing out the name of the field from the hashed field name.
|
|
42
|
-
|
|
43
|
-
h2. How does Negative Captcha work?
|
|
44
|
-
|
|
45
|
-
h3. Installation
|
|
46
|
-
|
|
47
|
-
h4. Rails 3
|
|
48
|
-
|
|
49
|
-
You can let bundler install Negative Captcha by adding this line to your application’s Gemfile:
|
|
50
|
-
|
|
51
|
-
<pre>
|
|
52
|
-
<code>
|
|
53
|
-
gem 'negative-captcha', :git => 'git://github.com/stefants/negative-captcha.git'
|
|
54
|
-
</code>
|
|
55
|
-
</pre>
|
|
56
|
-
|
|
57
|
-
And then execute:
|
|
58
|
-
|
|
59
|
-
<pre>
|
|
60
|
-
<code>
|
|
61
|
-
bundle install
|
|
62
|
-
</code>
|
|
63
|
-
</pre>
|
|
64
|
-
|
|
65
|
-
h3. Controller Hooks
|
|
66
|
-
|
|
67
|
-
Place this before filter at the top of the controller you are protecting:
|
|
68
|
-
|
|
69
|
-
<pre>
|
|
70
|
-
<code>
|
|
71
|
-
before_filter :setup_negative_captcha, :only => [:new, :create]
|
|
72
|
-
</code>
|
|
73
|
-
</pre>
|
|
74
|
-
|
|
75
|
-
In the same controller include the following private method:
|
|
76
|
-
|
|
77
|
-
<pre>
|
|
78
|
-
<code>
|
|
79
|
-
private
|
|
80
|
-
def setup_negative_captcha
|
|
81
|
-
@captcha = NegativeCaptcha.new(
|
|
82
|
-
:secret => NEGATIVE_CAPTCHA_SECRET, #A secret key entered in environment.rb. 'rake secret' will give you a good one.
|
|
83
|
-
:spinner => request.remote_ip,
|
|
84
|
-
:fields => [:name, :email, :body], #Whatever fields are in your form
|
|
85
|
-
:params => params)
|
|
86
|
-
end
|
|
87
|
-
</code>
|
|
88
|
-
</pre>
|
|
89
|
-
|
|
90
|
-
Modify your POST action(s) to check for the validity of the negative captcha form
|
|
91
|
-
|
|
92
|
-
<pre>
|
|
93
|
-
<code>
|
|
94
|
-
def create
|
|
95
|
-
@comment = Comment.new(@captcha.values) #Decrypted params
|
|
96
|
-
if @captcha.valid? && @comment.save
|
|
97
|
-
redirect_to @comment
|
|
98
|
-
else
|
|
99
|
-
flash[:notice] = @captcha.error if @captcha.error
|
|
100
|
-
render :action => 'new'
|
|
101
|
-
end
|
|
102
|
-
end
|
|
103
|
-
</code>
|
|
104
|
-
</pre>
|
|
105
|
-
|
|
106
|
-
h3. Form Example
|
|
107
|
-
|
|
108
|
-
Modify your form to include the honeypots and other fields. You can probably leave any select, radio, and check box fields alone. The text field/text area helpers should be sufficient.
|
|
109
|
-
|
|
110
|
-
<pre>
|
|
111
|
-
<code>
|
|
112
|
-
<% form_tag comments_path do -%>
|
|
113
|
-
<%= raw negative_captcha(@captcha) %>
|
|
114
|
-
<ul class="contact_us">
|
|
115
|
-
<li>
|
|
116
|
-
<%= negative_label_tag(@captcha, :name, 'Name:') %>
|
|
117
|
-
<%= negative_text_field_tag @captcha, :name %>
|
|
118
|
-
</li>
|
|
119
|
-
<li>
|
|
120
|
-
<%= negative_label_tag(@captcha, :email, 'Email:') %>
|
|
121
|
-
<%= negative_text_field_tag @captcha, :email %>
|
|
122
|
-
</li>
|
|
123
|
-
<li>
|
|
124
|
-
<%= negative_label_tag(@captcha, :body, 'Your Comment:') %>
|
|
125
|
-
<%= negative_text_area_tag @captcha, :body %>
|
|
126
|
-
</li>
|
|
127
|
-
<li>
|
|
128
|
-
<%= submit_tag %>
|
|
129
|
-
</li>
|
|
130
|
-
</ul>
|
|
131
|
-
<% end -%>
|
|
132
|
-
</code>
|
|
133
|
-
</pre>
|
|
134
|
-
|
|
135
|
-
h3. Test and enjoy!
|
|
136
|
-
|
|
137
|
-
h2. Possible Gotchas and other concerns
|
|
138
|
-
|
|
139
|
-
* It is still possible for someone to write a bot to exploit a single site by closely examining the DOM. This means that if you are Yahoo, Google or Facebook, negative captchas will not be a complete solution. But if you have a small application, negative captchas will likely be a very, very good solution for you. There are no easy work-arounds to this quite yet. Let me know if you have one.
|
|
140
|
-
* I'm not a genius. It is possible that a bot can figure out the hashed values and determine which forms are which. I don't know how, but I think they might be able to. I welcome people who have thought this out more thoroughly to criticize this method and help me find solutions. I like this idea a lot and want it to succeed.
|
|
141
|
-
|
|
142
|
-
h2. Credit
|
|
143
|
-
|
|
144
|
-
The idea of a negative captcha is not mine. It originates (I think) from Damien Katz of CouchDB. I (Erik Peterson) wrote the plugin. Calvin Yu wrote the original class which I refactored quite a bit and made into the plugin.
|
|
145
|
-
|
|
146
|
-
We did this while working on "Skribit":http://skribit.com/, an Atlanta startup (if you have a blog, please check us out at "http://skribit.com/":http://skribit.com/)
|
|
147
|
-
|
|
148
|
-
If you have any questions, concerns or have found any bugs, please email me at erik@skribit.com
|
|
149
|
-
|
|
150
|
-
If you'd like to help improve or refactor this plugin, please create a fork on Github and let me know about it. "http://github.com/subwindow/negative-captcha":http://github.com/subwindow/negative-captcha
|