Thread

About one of every twenty people registering for my site’s forums are getting frustrated because of this error message:

“You did not submit the word exactly as it appears in the image”

They say they are submitting the word properly, in some cases they’ve even tried reloading the page and using a new word.

It appears to be specific to certain users.

The registration is here:
http://www.moviemaker.com/forums/member/register/

I’m using ExpressionEngine Discussion Forum - Version 2.0.0 (20070918) Any suggestions?

TTFN
Travis

It’s the occasional problem that is hard to troubleshoot.

I just registered using Firefox 2.0.0.9 for Windows, and no error message for me.

Do these people have any thing in common? Location, browser, etc.?

No common thread that I’ve been able to spot yet.

TTFN
Travis

Hm- I just registered ok on IE.  We need to find a pattern or this is going to be a killer to trouble shoot.  Does it happen more than once to the same person?  What browser are they using?  What word(s) are failing.  Um… can you think of anything that might suggest a pattern?  Wonder if it happens when two people register at the same time.  I don’t think so, but…  Can you spot anything on your end that might give us a better hint?

The people who have responded with details are both using AOL to connect, though one’s using a Mac 10.3.6 and one’s using a PC and IE 6.

TTFN
Travis

This sounds like it may be an issue with AOL’s proxy caching serving up an older version of the page with the wrong CAPTCHA.

AOL is probably the culprit, as I believe they still rotate IP addresses, so it would be possible that their IP address rotates between the form being generated and their submission.  The error message would be identical, as their CAPTCHA submission simply doesn’t match with any of the valid IP/CAPTCHA pairs in the database.

Is there a way to disable the IP-matching requirement of the captcha test?

TTFN
Travis

Not without hacking, and that would kind of defeat the purpose.  You’d be better off disabling CAPTCHA altogether.

Fair enough.

But actually, this IP shifting should be an issue just once—it would be probably fairly rare for an IP address to shift if the user tried over and over again, no?

Why does the captcha have a matching IP requirement, anyway?  I realize it’s extra protection, but since each captcha can only be used once…

Consider a very busy site, where captchas are being generated constantly.  This could leave hundreds of valid words in the database, and typing in any of these words would validate for the user, whether it was “their” captcha or not.

Good point—I always use the appended number setting, and also forgot that EE uses a word list, not just a random collection of letters. That would be much less likely to be duplicated, but is also much harder to type correctly.

OK, I’ll watch and see if AOL continues to be the common culprit, thanks!

An update to this thread.  The problem with Captchas blocking people from AOL continued and seemed to get worse, but I couldn’t turn off captchas altogether because this site is very high visibility and gets a lot of spam.

I finally had to go into the comments and registration PHP files and disable the IP check with a small hack.

This has the small disadvantage of letting visitor A possibly submit the text from a captcha originally shown to visitor B and be allowed to post—i.e. they don’t have to use the text from their own captcha, they can use any valid captcha.

But since I have a good amount of variety in the captcha creation, and because visitor A’s use of visitor B’s captcha doesn’t erase it (that only happens when visitor B uses the captcha) this method is working for now.

I’d still really like for this to be a configuration option, which is why I made it a feature request.

TTFN
Travis

Just out of curiosity, have you tried turning off CAPTCHAs for a short period of time and measured how much spam it was deterring?  Almost all the spam we’re seeing these days is by humans at terminals.  If it’s still effective and might benefit others, you could consider making a Wiki article out of your modification.

I did it the other way: I had captchas turned off, and was getting significant spam (many per day), then turned captchas on, and spam dropped (more like a weekly process).  I don’t have numbers to quote, I wasn’t measuring at the time, but I think I will on my next client’s site.

TTFN
Travis