The CAPTCHA Continues As A Challenge

This month, we are again seeing evidence of recent security changes by Microsoft. We see signs of continued frustration, in the process of publishing comments - and publishing posts, as part of the Import process.

In the process of diagnosing an apparent comment publishing problem, I ventured into the comment publishing experience, yet again.

I temporarily tweaked commenting permissions for this blog, to allow anonymous comments and to require the CAPTCHA.

With CAPTCHA required, I published a test comment to my earlier post in this blog.

I did my best - which was not good enough.



CAPTCHA solving continues, as a challenge.

I entered a test comment, and made appropriate selections.

I got a challenge.

"Select all the food."

I did my best.

Apparently, my best was not enough.

"Select all images with a store front."

I tried again. Not all images here were completely obvious, either.

My second try was successful.



Hmm.

Select all the food.

Zoom in on the fourth image, above - and tell me which pictures, that I did not select, are food? To whom? Will zooming always improve chances of success?

CAPTCHA solving, as spam interdiction, will always lead to frustration.

There will be cultural issues - and resolution problems - with CAPTCHAs. This version of the CAPTCHA beats the one from several years ago - but still will cause frustration.

And need I again point out - will require proper filter tuning, on each computer used. Note that ongoing changes by Microsoft are currently affecting publishing comments - and publishing posts during the Import process.

And our experience may very, depending upon many different details, varying by blog, by computer, and by person. My sympathies to all who must deal with spam - and with spam interdiction.

---

The CAPTCHA continues to be an unavoidable element in comment publishing and other episodes of #Blogger life. And like life, some episodes are more pleasant than others.

GPT / PTC / PTS Content Is Not Welcome, In Blogger

One of the most easily overlooked details, about Blogger blog content, is that GPT / PTC / PTS Content is not suitable, for Blogger blogs.

Blogger Content Policy has a section which describes GPT / PTC / PTS Content, in passing.

Spam: Spam takes several forms in Blogger, all of which can result in deletion of your account or blog. Some examples include creating blogs designed to drive traffic to your site or to move it up in search listings, posting comments on other people's blogs just to promote your site or product, and scraping existing content from other sources for the primary purpose of generating revenue or other personal gains.

Unfortunately, spammers have been imaginatively subtle, in their description of various make money fast programmes - and not so many blog owners think it necessary to contact a lawyer, to interpret the Content Policy document, when planning their new blog.

Too many blog owners, asking the frequently seen question in Blogger Help Forum: Get Help with an Issue, get answers they are not prepared to see.

Why was my blog deleted? I need the money from the blog, to feed my family!

And they are told, simply

GPT / PTC / PTS / PTV content is not welcome, in Blogger.

This response generally does not please them.

Maybe, education can reduce the popularity of GPT activity, in Blogger.

"GPT" is a collection of fraudulent and illegal activities.

"GPT" (aka "Get Paid To") is a collection of various activities.

• PTC, aka "Pay To Click" involves people clicking on ads, to earn the blog / website owner money.
• PTS, aka "Pay To Surf" involves people clicking on links, to access the blog, and to earn the blog / website owner money.
• PTV, aka "Pay To Verify" involves people solving CAPTCHAS, so spammers can publish spam, as Blogger blogs and comments, and in our email, using high volume publishing scripts.

These various activities have been carefully packaged, as useful "make money fast" techniques, by the more successful spammers, who called themselves "marketing consultants".

Ads are placed on peoples blogs, so the readers of the blogs will view the ads and buy the merchandise. People who sit in front of their computers, clicking away, are not looking at the ads, or planning to buy the merchandise.

GPT (PTC / PTS / PTV) is a type of fraud. Any blog which provides advice on using GPT - or uses GPT techniques to increase blog activity - encourages the fraud, with clever ads, and shiny payment programmes. Ask yourself how the various GPT "Services" make the money, that they pay to the blog owners, for hosting their ads.

If "GPT" was really lucrative, would the expert waste time selling it?

If the blog owner, who shows you the GPT programme, really had a way to get rich, would he waste effort, telling you how to get rich? No, he would be busy getting rich, without you. Blogs, with ads telling you how to get rich, are not showing you how to get rich - they are helping the blog owner to get rich - and you are paying for his success.

Who pays you to sit at your computer, and solve CAPTCHAs, all day? The people who sell the commercial scripts, that enable spammers to setup accounts and publish spam - like spam Blogger accounts, spam Blogger blogs, and spam Blogger comments. You are just a minimum wage employee, who makes the CAPTCHA solution section of the script run, and produce the spam accounts, blogs, and comments.

Abuse detection, like highway traffic enforcement, doesn't take place in every spot on the globe, on a 7 x 24 x 3600 basis. Some people get caught (blogs get detected), other people (blogs) go un detected - from day to day.

To put and end to "GPT" and other fraud, we go one blog, at a time.

For abuse classification to produce results, each blog must be classified, on its own, as detected. Other illegal blogs will be classified, later.

If you start a blog, fill it with GPT content, and publicise it using GPT technique, you'll be one more blog owner lamenting, in Blogger Help Forum: Get Help with an Issue.

Why was my blog deleted? I worked hard for 1 year, spent much money advertising!

Start a new blog, with legitimate, interesting, unique, and useful content, based on a subject that interests you. Don't become one more victim, of advice from the older spammers.

Comments, Owner Choices, And Reader Choices

Much of what we do in life - and what we do when using Blogger - is based upon, and limited by, choice.

Some choices we get to make, for ourselves. Other choices are made for us, by people who make their own choices.

Some blog owners do not want their readers to have to login to Blogger, to comment on their blogs. Other blog owners do not want their readers to have to solve a CAPTCHA, to comment on their blogs.

A few blog owners do not want their readers to have to do either.

It seems anyone who wishes to leave a comment, will have to do some form of login, either via Google or a CAPTCHA, to do so! Is there a reason for this, would it not be easier, for anyone to just leave a comment?

And the answer here is simple.

It would be easier, if neither were required.

But reality - involving activity by spammers, and activity to counter spammers - leaves some of us with less choices.

Long ago, Blogger allowed anonymous comments, without a CAPTCHA to solve. Spammers benefited from that possibility.

Later, Blogger added the ezCAPTCHA, to be required at the owners decision. Some owners chose to not select the CAPTCHA, because their readers were inconvenienced. Spammers continued to benefit from blogs which allowed anonymous comments, and no CAPTCHA.

Recently, Blogger added the non optional reCAPTCHA. This requires anybody not logged in to have the choice - login, or solve a CAPTCHA.

Unfortunately, the latter change made the third party cookie filter issue more critical. People who are already logged in, but are subject to third party cookie filtering, have to login, or solve a CAPTCHA. This requirement may vary, according to the variant of the commenting form, used by the blog.

Now, a blog owner has 4 choices, to control anonymous comments.

1. Don't allow anonymous comments, and don't require a CAPTCHA. People who are not logged in will have to login, to comment.
2. Don't allow anonymous comments, but require a CAPTCHA. People who have not logged in will have to login, and solve a CAPTCHA.
3. Allow anonymous comments, and don't require a CAPTCHA. People who have not logged in will have to either login, or solve a CAPTCHA.
4. Allow anonymous comments, and require a CAPTCHA. People who are not logged in will have to solve a CAPTCHA.

Some people will have to either login, or solve a CAPTCHA, to comment. Depending upon what choices are made by the blog owner, the readers may have any 2 of 3 choices.

1. Solve a non owner optional reCAPTCHA.
2. Solve an owner optional ezCAPTCHA.
3. Login.

You'll like the ezCAPTCHA a lot more than the reCAPTCHA.

People who are logged in to Blogger / Google, and are not subject to third party cookie filters, may not see a CAPTCHA - and will not have to login to comment. People who are logged in, but are subject to third party cookie filters, will have to either login, or solve a CAPTCHA.

Owners of blogs which attract readers, who choose to maintain their cookie filters, will benefit more from the new CAPTCHA, than owners of blogs which attract readers who do not choose - or do not care - to maintain their cookie filters.

To make the choices easier to understand, Blogger would have to make "Require CAPTCHA" a binary option, for at least 3 comment authentication levels.

1. Anonymous.
   • Require CAPTCHA.
   • Don't require CAPTCHA.
2. OpenID.
   • Require CAPTCHA.
   • Don't require CAPTCHA.
3. Google account.
   • Require CAPTCHA.
   • Don't require CAPTCHA.
4. Members.
   • Require CAPTCHA.
   • Don't require CAPTCHA.

If Blogger were to offer this binary option, too many owners would select "Anonymous" / "Don't require CAPTCHA" - and spammers would continue to flood the spam filters - as they were, before the latest update.

As long as spammers choose to do business - and choose to target our blogs, in their business - our choices, as blog owners and readers, will be limited.

>> Top

The CAPTCHA, For Anonymous Comments, Isn't Going Away

Several weeks ago, Blogger added a security feature to Blogger commenting, to reduce comment spam.

Note: Even if you don't have word verification turned on, anonymous commenters might be asked to enter some text. This helps protect your blog from abuse.

This change has not pleased everybody.

I disabled "prove you're not a robot" for commenting. Why do my readers still have to solve a CAPTCHA, each time they comment?

This blog owner is not looking at the bigger picture. This new feature will benefit many blog owners - when Blogger is used, properly.

By adding a CAPTCHA, to the option to allow anonymous comments, we get several benefits.

• People can allow anonymous comments, without allowing uncontrolled spammer activity.
• People can allow authenticated comments, and not require a CAPTCHA.
• The overall level of spam, currently being seen on some blogs which allow anonymous comments and require no CAPTCHA, will drop. This will allow Blogger Security engineers the chance to concentrate, more intently, on the remaining spam.

Instead of restricting the ability for people to comment on our blogs, this change actually increases the ability for people to comment - and decreases the spam.

People who are logged in to Blogger - and who are visible as logged in - won't even see the new CAPTCHA, even if they want to comment anonymously. Only people who are not logged in (or who are not seen as logged in), and who wish to comment without logging in, will be inconvenienced.

The biggest problem, with the new CAPTCHA form, is with people who are seeing the CAPTCHA even when logged in - because they are filtering "third party" cookies. Those people will have the choice of logging in again, or solving the CAPTCHA.

Anybody who is not logged in can avoid having to solve the CAPTCHA, even if one is presented, by logging in to Blogger. Since the standard Google "One account" login is used, people who do not have a Blogger account can setup one, on the fly, in a couple of minutes. This option is not obvious, from the commenting form - especially with the CAPTCHA displayed - but it is present.

Since the commenting form comes in 4 versions, depending upon template type and comment form placement, Blogger Engineering will need to make a coordinated effort, to improve the overall design of the comment form.

The various buttons and links, which allow the comments to be published using the many options, will have to be displayed better - to make it apparent to everybody that logging in to Blogger can avoid use of the CAPTCHA - even if the reader wishes to not identify, by commenting anonymously. And, other improvements are needed, also.

And once again, I will point out that a better user experience will be had by all who can properly maintain their computers, and not block "third party" cookies. Anybody, who is able to login to Blogger, should be able to comment anonymously, without inconvenience of the CAPTCHA.

Some solutions in Blogger require our action - not just action by Blogger Engineering.

>> Top

The New Commenting CAPTCHA Is Inconsistent

The new CAPTCHA, added by Blogger last week to restrict spam in anonymous comments, is already showing signs of unwanted effect, with some blogs.

Besides making the commenting sequence more complicated, the sequence, in general, is inconsistent. Differences in the sequence, when compared between the three commenting form placement options (embedded, popup, and full page), varied by the original CAPTCHA screening option, and the moderation option, have been noted. And how many readers, commenting on their favourite blog, will think of hitting "Publish" with "Google account" selected, to login and avoid the CAPTCHA?

The CAPTCHA form itself will discourage comments, being made by the casual blog reader, against many blogs. And the CAPTCHA, as added to all three comment forms, now makes cookie filtering issues equally critical, for the embedded, popup, and full page forms, alike.

As designed, CAPTCHA screening should simply affect people who wish to publish comments, anonymously.

Some blogs may require the CAPTCHA, for anonymous and authenticated comments, alike - when a reader is not logged in to Blogger. Other blogs may allow people to avoid the CAPTCHA, altogether - who even comment, anonymously, without solving a CAPTCHA, when logged in.

With some blogs, you may hit the "Publish" button immediately, and go straight to login - and other times, be stopped by the refusal

Comment should not be empty

Alternately, you may compose your comment, then select "Google account" - and upon returning from login, find an empty comment window.

Depending upon which comment placement option / template type is in use, you may see any of those inconsistencies.

• Dynamic template.
• Embedded.
• Full page.
• Pop-up window.

Each of these different comment forms variants has its own peculiarities.

These inconsistencies are more critical, because some readers filter cookies, improperly. With third party cookies filtered, the login status is not correctly identified by the commenting process - and the CAPTCHA may be required where it should not apply.

We may even see, with enough different people trying to comment, a return of the commenting login loop - where people login, repeatedly, but are denied by the CAPTCHA form in the commenting process.

Making things still worse, the CAPTCHA form is nasty. People who are less technically astute, and who have problems maintaining the filters on their computer, may be less tolerant of the CAPTCHA process - and may simply find other blogs, maybe outside Blogger / Google in general, which are more permissive.

The need for the CAPTCHA form, in general, is real - but the implementation needs improvement. Until unimproved, many Blogger blogs will feel negative effects.

>> Top