The 10 point case against CAPTCHA use

Did you know that approximately 80 to 90% of email received every day day in and day out by our mail server is spam – unsolicited, bulk email?

Spam-bots are automated systems that surf the Internet looking for ways to post spam messages to forums, blogs, wikis, guest books or any of a wide variety of web forms. Worse still, spammers are now paying people to post their spam.

We all know spammers change their methods frequently. But there are also some broader trends that slowly emerge over long periods. The economics of spam has changed considerably since Akismet first started back in 2005, and that has led to some new trends and changes in spam patterns recently. Here’s a quick summary of some of the most important changes in web spam we’ve seen over the last year. –  State of Web Spam blog.akismet.com/

John Suler, Ph.D, Department of Psychology, Science and Technology Center, Rider University: A strong relationship exists between one’s presence on the web and the amount of spam received. The more places in cyberspace that your e-mail address is listed, the more likely the spammers will find it and add it to their mailing lists. Paradoxically, then, the more available your address, the less likely people will be able to clearly contact you through the noise created by the spam you receive. Currently, I receive up to 100 spam emails a day.
–  The Psychology of Coping with Spam

CAPTCHAS

captchaCAPTCHA is an acronym for Completely Automated Public Turing test to tell Computers and Humans Apart and is a challenge-response test that was developed to fight ‘spam-bots’.   Captchas are security tools for preventing spam postings and log-ins. You have experienced them  as  images of  random letters and numbers that some  sites require you to decipher in order to submit a comment or log in to a resource.  The most common type of Captcha requires that the user type letters or digits from a distorted image that appears on the screen.

Web Accessibility

Software can be designed so both the able and disabled users can use any  site with ease. Web accessibility means that people with disabilities can use the Web. Web accessibility also benefits older people, with changing abilities due to aging.

Millions of people have disabilities that affect their use of the Web. Currently most Web sites and Web software have accessibility barriers that make it difficult or impossible for many people with disabilities to use the Web. As more accessible Web sites and software become available, people with disabilities are able to use and contribute to the Web more effectively.

This is the case against using Captcha.
1.   Captchas are an annoying inconvenience to legitimate commenters who do not like being delayed by having to type in Captchas codes or having to type in numerical solutions to arithmetic questions. (Arithmetic questions are a barrier to people who have learning difficulties or cognitive disabilities.)

2.  Captchas render content inaccessible to blind users or anyone who uses a screen reader system.  If you’re a US company, this is potentially an AMERICANS WITH DISABILITIES ACT (ADA) violation.

3.   Many Captcha codes cannot be read by people who are visually challenged and those with dyslexia also have trouble reading them.

4.   The use of Captchas is NOT a barrier to unethical humans, who are paid to spam. To get around Captchas and math comments, spammers are now paying people to make comments for them ie. to post their spam.

5.   A surprising amount of  Captcha software is buggy. Many Captchas do not work as expected and the bloggers who have buggy Captchas on their sites are not aware of it.

6.   Captcha will NOT keep the trackback spam out.

7.  Captchas are hackable.

8.   No anti-spam solution can ever be 100% effective or foolproof. Captchas do provide a primary level of defense against spambots,  but some of the more sophisticated bots are now able to read the more simple Captchas, and they are getting better all the time.

9.   According to a study by SEOmoz, if your site is monetized then  Captchas could be costing you conversions.

10.   Captchas are not the best solution to prevent spam.  Akismet and Defensio are superior choices.

Discussion
IMO CAPTCHAs are a barrier to commenting and Akismet and Defensio are better anti-spam choices. What’s your opinion?
Do you use CAPTCHA on your blog?
What’s your CAPTCHA user experience?

Related posts found in this blog:
Encouraging blog readers to comment
Can I turn off Aksimet, or view the spam it blocks?
How to deal with spam effectively

Read also: Should Bloggers Profit Off Of Spammers Via CAPTCHA Ads?

77 thoughts on “The 10 point case against CAPTCHA use

  1. I’m another person who hates CAPTCHA. Also being a online gamer for almost 20 years, I know there is nothing going to filter out people who are paid to spam. It happens in games all the time, they are called gold farmers. They are sitting over in China or India getting paid pennies an hour to troll the internet.

  2. Pingback: 10 REASONS FOR NOT USING CAPTCHA | My Blog

  3. A very good post. I am blind and use Jaws (screen reading software which converts text into speech and braille allowing me to read my computer’s screen). Jaws is unable to read captchas so if there is no audio alternative to the visual captcha I am unable to submit a comment/contact a webmaster etc. Although audio works for me it is totally ineffective for people who are blind and profoundly deaf.

    I think the use of inaccessible captcha runs counter to the provisions of the Equalities Act here in the UK. The Act specifies that providers of goods and services must make “reasonable adjustments” so as to ensure that their products and services can be accessed by people with disabilities. Clearly a captcha which can not be interpreted by a disabled person is in breech of the Act.
    Kevin

  4. I wish captcha was banished from the net altogether, at least, the sort that requires you to see an image or hear a sound. Not even the audio captchas are good enough, the deaf-blind are still slapped in the face by a big “You’re not human because you can’t solve a captcha! Get out of here!” on sites that use these awful things. Audio captchas often don’t even work. No Google/Blogger audio captcha will play on my computer but other sounds do. Sites that let people host their content for free, I.E. Boardhost and Groupsite should at least give each forum/network’s administrator the option not to use captchas at all. I wish I could switch that nuisance off on my sites hosted by these places. Even Yahoo Groups sticks you with captchas everywhere.

  5. @Evan “This is funny though, because as I was commenting on blogs the other day I got really mad at a captcha, so I turned them off on my blog.”

    I did exactly the same thing a couple months ago myself. I thought if i was having this much problems, after three genuine tries, so where my visitors so I turned it off too. I moderate everything anyway so between the akismet and wp-spamfree plug-ins not many spams get by so far, although some of those human spammers do, and always will.

  6. Great topic, I do remember reading somewhere that some captcha services have additional purposes like reading old faded books that are scanned in. There’s two words, one is the legitimate captcha and the other tries to find common answers.

    This is funny though, because as I was commenting on blogs the other day I got really mad at a captcha, so I turned them off on my blog.

  7. Hi TT.
    Couldn’t agree more, very timely post. We run a small restaurant and accept bookings made using a Contact form. Well you know what happened, a booking with no contact number and so I responded to the email address thereby confirming my email address – you’d think I’d know better at my age !!!

    So I decided to add a CAPTCHA code to the contact form. But it just didn’t look or feel right. Read your article and promptly dumped it and also from the 2 blogs I run. I get grumpy when I get a CAPTCHA code wrong because it is barey readable, I tend not to return to the site, unless it is a very good blog about wine, then I forgive the irritation.

    Solution to the restaurant bookings problem, a large note in red that if you are making a booking I will only accept it if you include a contact tel. number. Then I can phone and confirm. The other option is to refuse to take online bookings, which I might resort to if the polite request doesn’t work.

    It is important to us because we are a small and intimate owner run restaurant (max 16 seats) and a table of 4 that is a ‘no-show’ has a material impact.

    Keep writing, I’ll keep reading.

      • Tks TT. Re Akismet, it is excellent and I have not found a comment that it has flagged as anything but SPAM. If in doubt I open the associated website and it is always flaky, either rubbish or an attempt to sell something. The style of comment is a give-away, very general., nothing specific.
        I dump whatever Akismet flags, and in this case I don’t mind if the baby is thrown out with the bathwater.

  8. Hi TT,

    I have a CAPTCHA on my email form on the contact page, but that’s it. I’m not a big fan of CAPTCHAs at all. I always mess them up and its so frustrating! I notice a lot of people have a checkmark thing on in their blog comments where the commenter needs to check the box to confirm not being a spammer. Not sure if this is hackable as well (it probably is). The spam comments I get caught in the Akismet filter is insane! It’s unbelievable. Thanks for sharing this info!

    Elise

    • Hi Elise,
      It’s good to meet you and even better because we share the same POV on captchas. As for hackability … well, everything is hackable. And, you’re welcome. :)

  9. I use captcha on wordpress as it is really easy to use. I don’t mind having to do a captcha as long as they purchase or use a captcha system that is easy to read. Google uses a crap one I would have thought they would invest in a better system. So as long as they are easy to use I don’t mind sites that have them.

  10. Hi TT, hope you are doing OK?!! :)

    I have a question, I can’t seem to figure out what the concept of ‘Dofollow’ is? Sorry not related to the Spam control information that is posted above, but was just checking if you can give me a quick link.. I have read good and bad things, and now I am so frustrated to the point that I am worried if I should even comment on places where its says it is a DoFollow blog :) Because it says DoFollows attract a lot of spammers.. ;)
    Are my fears unfounded??
    Thanks!!!

    • I will be publishing a post on “do-follow” and “no-follow” in the future. I’m not in a rush to do that as I have many wordpress.com followers and it’s not important to them.

      At this point in time it’s important for you to know that as your blog is a wordpress.com blog the links in usernames to blogs of those who comment on your posts are all “no-follow” links. That means that they do not pass PageRank to your commenters. The active link to their blog is there linked to their username in comments and it can be used to access it, but the links do not get the passing of PageRank that occurs when you backlink to posts located in other blogs in your own published posts. So the good news is that as you are a wordpress.com blogger there’s no need to fret about this at all. :)

      • Oh ok..! Gotcha.. I just read about ‘PageRank’ the other day on your blog.. Ha ha.. I don’t seem to ever get to the point of knowing ‘everything’ about blogs.. ;)
        Thanks for the quick turnaround, appreciate that, for your new followers, just one word about you, AWESOME!

        • TT,
          I have had another issue recently.. :( Something that scares me too actually! I have had at least 4 different subscribers in the past one month.. People whom I cant recall meeting them or reading them, because of lack of link definitely.. and also because I cant recognize their gravatar..
          How do I make sure that people who subscribe are all real people?? Is there a subscription control/approval mechanism in place for WP??
          Thanks for your time!!

        • Anyone can subscribe to your blog through a RSS feeder service and you will not know who they are. They can subscribe to your entries (posts) at this link
          http://aconnectiontomyheart.wordpress.com/feed/
          They can subscribe to your comments at this link
          http://aconnectiontomyheart.wordpress.com/comments/feed/

          I do not use the wordpress.com blog subscription feature. I offer email subscriptions through Feedburner. If I move my blogs using Feedburner this means I can keep my subscribers by creating a new feed at Feedburner for the new site.

          I have my RSS feeds set to summary here > Dashboard > Settings > Reading.
          Doing that put and end to the blog scrapers who used to suck up my posts moments after they were published and place them on blogspot splogs that they pimp out for adsense pennies. Also note that by offering summaries I encourage readers to click into the blog. If I offered full posts not only would I have the blog scrapers problem but I would also be discouraging readers from clicking in to posts and commenting on them.

          If you are using wordpress.com emailed blog subscriptions then the support documentation is here > http://en.support.wordpress.com/blog-subscriptions/ and here > http://en.support.wordpress.com/subscriptions/ and any further questions must be directed to Staff > http://en.support.wordpress.com/contact/

          There is no means that I know of of verifying that those who subscribe are people and not bots.

        • Thanks TT for the detailed reply, all the links that you provided reaffirm what you summarized for me in the last sentence. There is no way to restrict or confirm subscribers to my site and “approve” them, other than “removing” them after the fact.. !

          Other than that, I recently changed the setting to “Show summary” of my post to email subscribers. So, that is taken care of.

          Thanks for your time as always.. Your link exchange article sure does look interesting.. On to that now ;)

        • @Heart
          You made the same decision I did. :) You’re welcome. I just answered your questions on the Blogroll or Links Page post in the nick of time.

  11. I did use CAPTCHA on my blog for comments/contact but soon turned them off. They are a royal pain. I hate it when I visit sites and I have to fuss with them. Some are worse than others. I really hate those two word ones because sometimes I cannot read it and I have nothing wrong with my sight.

    I often get the impression that the site owner does not wish you to comment or interact, so I just think to hell with that I am off.

    When I realised that I did not like them I asked how I could expect others to like it on my blog, so I will never use CAPTCHA again. In addition, taking in your points concerning disabled people adds more power to the argument against CAPTCHA. I am ashamed to admit it, I never even thought about that but it is such a valid point. It must be hell for some disabled people to use sites with all these awkward “security measures” in place.

    I use Askimet and it seems to work fine. I am not being inudated with spam messages and yet, I am receiving more messages from people. The CAPTCHA can be a real turn off because there is always the expectation for it to go wrong, so perhaps my removing it has made people feel more confident.

    Spam is just a fact of life on the internet and I think most of us have the good sense to be able to spot it and simply delete it. Like Ron said, plenty of spammers are human beings and so could easily tick a box or type in a CAPTCHA. A judgement call is what is needed.

  12. Well, one thing I don’t get is why people are still spamming others. OK, they are smart, but what do these folks get out of spam because 90% of this 90% spam mail goes straight to “Spam” folder is never opened! Similar is the case with spam comment.

    And by the way, I prefer text quiz rather than captchas on contact form and only backend protection(Akismet) for comments. Yep, captchas can have audio but nothing is better than a text question saying 2+2=5/6? as people with visual problems can easily increase text size and see the question.

    • Greetings Ishan,
      Arithmetic questions pose no difficulty for me because I don’t have cognitive disabilities but I’m aware that they can be a problem for those with learning disabilities.

  13. HI Titi,
    This is an interesting read..more so cause I recently told a friend who has a blog on blogspot to get rid of that captcha thing. I find it hugely irritating…and of no use. Spammer know how to do a lot more than we think. I do prefer akismet..but sometimes even that can be punctured.
    Much love,
    Z~

    • Hi Zeenat,
      You’re right – no anti-spam system will ever be perfect but I use Akismet and Defensio.When it comes to captcha it is so frustrating for me that I wouldn’t even consider using it on my blogs.

  14. Buy Viagra ..

    // just kidding :D

    4. The use of Captchas is NOT a barrier to unethical humans, who are paid to spam. To get around Captchas and math comments, spammers are now paying people to make comments for them ie. to post their spam.

    I now use the G.A.S.P. plugin (Growmap Anti-Spam Plugin) that stops bots cold from bot comment spam. It’s pretty hard to stop all human spam – unless you have that internal plugin called – “common sense”. Sometimes newbies who just want to appreciate your post or show that they really do agree and have actually nothing to say could come out sounding like spam at times. It’s easier to delete real comments if you are deleting hundreds or thousands of comments. But, if you stop the automated spam cold – the real comments are easy to decipher which are spam and which are not. At least i.m.h.o.

    • Hello there,
      Tristan pointed to the same plugin above. Thanks for expanding here on it. As we are both experienced bloggers we can spot the human generated spam. New bloggers are so desirous of comments and so lacking in experience that it does get posted on their blogs.

  15. Obviously nothing will be 100% effective but there are audio CAPTCHAs out there like reCAPTCHA which looks pretty clever, although I’ve never actually used it.

    Your post did make me think of this comic which is what we all dream of seeing, be warned though, it does use a rude word!

  16. While I don’t have vision problems or dyslexia, I know -I- have a hard enough time just reading some of those CAPTCHAs…

    I can only IMAGINE what folks who are visually impaired or dyslexic might be experiencing with it.

    It’s just a frustrating roadblock to communication.

    I’ve noticed Blogger is doing a whole lot better in identifying spam and keeping it from getting through lately.

    I also end up turning on comment approvals, which help me prevent any spam from seeing the light of day. It’s only a little more effort for me, and well worth it for the reader’s experience.

  17. In my personal opinion CAPTCHA is a huge pain, It is nice to have CAPTCHA if you get hundreds of comments each day on you blog but if you don’t CAPTCHA can discourage people from posting a comment.

  18. I don’t like sites that use CAPTCHA. Sometimes the CAPTCHA widget can’t be read and I can’t get the image correct to complete my comment. Also at times Blogger or the software using the CAPTCHA sticks and my comment is lost. It is so frustrating when this happens. Just makes me not even what to leave a comment. I think using Akismet and Defensio are such better choices. I use Akismet and it gets 99% of the spam comments at my blog. I find it a much better choice than messing around trying to get people to decipher some image when they want to just leave me a comment.

    • I’m happy to hear you agree with my Akismet ot Defensio suggestions. The whole point of having a blog is to create discussion and anything that’s a barrier to commenting is problematic.

  19. I will admit to not using CAPTCHA on my blog and I simply use the rule that the first post from any email address is moderated and then they are free to write what they like. This is because a) I prefer to make as easy as possible to comment and b) some of the spam is just superb. It is comedy of the highest value. One of them was so good I just posted it as an article.

    • Your spam prevention strategy is comment moderation and I use it too. Everything on a blog affects its brand. As for enjoying spam and posting it – no way – no how will I risk egging on those who create it. And no way will I have it negatively affect my blog’s brand.

  20. I don’t use CAPTCHA for commenting. Akismet catches most fo my spam, and the few comments it doesn’t catch is put on hold anyway, since all comments are moderated.

    I do use CAPTCHA on my contact form, though. Not sure why actually.

  21. Interesting post, TT – I always learn something new when I read your entries. Didn’t know what CAPTCHA meant, but I sure do know how annoying I find them.

    I don’t have them set up on my blog, and I’ve been lucky – I’ve only had two or three spam-like comments.

    • Thanks for your reply. As a visually challenged person I curse them. They are so awful and it amazes me that people make the CAPTCHA choice when they could make much better anti-spam choices. Maybe they just aren’t aware of the issues that blind, visually impaired, dyslexic, and those with leaning disabilities experience. I published this post to raise awareness.

  22. I love posting comments as much as i can but sometimes captcha can get in the way. I love Akismet by wordpress. By the way people who are not really tech savvy will be confused about what the term means. i worked in customer care over the phone and my callers are always bothered by captcha young or old.

    • Hi Baxter,
      I end up posting comments late in the day after work. That means my eyesight is not as good as it was earlier in the day. It also means I am tired. Nothing is more frustrating than attempting over and over to enter a captcha code and failing. This happens to me frequently so I decided to blog it.

  23. I really hate all these spam checkers, I find them very frustrating, but unfortunately I still use them on my blog. I just don’t have the time to weed through all the spam each day, which unfortunately tends to outweigh my actual comments by about 10-1 .

    I am curious about this Defensio, I think I will look it up after this post and consider changing from Capcha to it.

    Thanks for the info TT.

  24. I personally don’t have a problem with Captcha codes, but I very much see your point. What I DON’T like is when I constantly have to hit the comment button – sometimes four times when Captcha is involved – to get my comment through. Ugh! What a waste of time. Right now I don’t use it. I just manually deleted spam comments. I might get to a point where I have to use some sort of system, but I’m trying to avoid it. If I get there, I’ll make sure to explore the other options you suggest.

  25. when i set my blog up it was pretty simple for me. i just asked myself what i like. i do not like those stupid codes. annoying, time consuming, and a lot of times i can’t read the crazy way it is written and end up typing it in 2 or 3 times to get it right. so i didn’t put them on mine. if i get spam, when it becomes an issue, then i will work on some way to combat that. until then, i’m sticking with what i would like to see when i comment

  26. Wonderful post. I can only wish these CAPTCHA users learn something from this post. These are really irritating for any visitor especially on blogosphere. This post of yours can be named after your an earlier post “How to lose your reader” to “How to lose your commentator”

    Thumbs up!

    • You are quite right this ought to be added to my other two posts that result in bloggers losing me as a reader. What I have experienced is that fully sighted people without learning disabilities assume that we are all just like them. On one hand, they either deny or minimize the problems we face when trying to comment. On the other hand, if they have monetized blogging tips blogs they are publishing posts on how to get more readers and ad clickers and product purchasers. Obviously, there’s a serious disconnect between those who have no disabilities and those who do.

  27. Yes, yes, yes, captchas are horrible, especially those that should the letters blurry AND have lines crossing them or things like that. I hate them!

    Great post TT ;-)

    • Hi Deray,
      As you know I am visually challenged and the kind of captchas that you describe drive me crazy. I simply cannot read them. Thanks for weighing in and telling me you have trouble with them too. I thought that might be the case but I wanted to ask my sighted readers what they experience to be sure and you did that. :)

  28. @Tristan “There’s just a little check box that you click when commenting that confirms you’re a real person and not a spammer! ”

    What’s to stop a spammer doing that? Many are real people, they’re not all bots.

  29. Great post, and I wholeheartedly agree. Captcha sucks, except that I think Akismet sucks, too. Too many real comments get caught, in my experience. I use a plugin called GASP. It’s super simple. There’s just a little check box that you click when commenting that confirms you’re a real person and not a spammer! Simple and effective, and I hardly ever get spam.

    • I use Defensio on my self-gosted WordPress.org install and it works very well for me. As I do not have a d-follow blog and do not reward commenters with keywordluv or with commentluv my blog does not attract much spam.

      I’m wondering if you are unaware of the legions of fake commenters online, who are hired to comment on blogs? I spot their comments on many blogs that I read and as I stated in point 4. captchas are useless when it comes to detecting humans who are hired to leave comments.

      Thanks for entering the discussion. :)

  30. Gosh you are so right there. I can’t even recall how often I’ve had to hit the “reload” button because I couldn’t read them. Not everyone in this world has 20/20 vision. Sometimes you can have the captcha played back to you – the problem with that it you often have to install something, at which point i give up wanting to post the comment! Personally I think they are a good idea, but sometimes they are just a little bit too secure.

    • Hi Glenny,
      Thanks for commenting. In some cases I have to ask my husband or friends, when they are available, to enter the code for me on my comments. In many cases they aren’t available so I simply cannot leave comments at all. It’s so frustrating. :(

  31. We use Captcha for our contact form but we don’t use Captcha for comments. We moderate all comments and get email notifications of comments in the moderation queue.

    I checked the blog to moderate the four comments received a couple of afternoons ago and there were indeed four comments. There were also 270 spam comments.

    I trawled through them all looking for any false positives.

    So I don’t know what the downside of Captcha is, but the downside of spam is the time taken to trawl through it.

    Sometimes I feel like emptying spam without reading through them looking for the real comments that Akismet got wrong.

    • Hi David,
      Thanks for weighing in. I appreciate it. Akismet and Defensio require us to educate them. It’s easy for them to detect bot spam but it’s not easy for them to detect human generated spam and that’s what’s happening now. Unethical people are accepting jobs which amount to submitting spam comments so their employer’s spam link is posted into comments.

  32. 3. Many Captcha codes cannot be read by people who are visually challenged and those with dyslexia also have trouble reading them.

    I’d go further – because these things are the bane of my life, especially when shopping online (look, if you want my money, stop getting in my way!) – too many Captcha codes are unreadable by anybody at all, and they are generally those where the idiot using them has omitted a change button. If that happens in an online store then they’ve lost my business, permanently (and why they’re deemed necessary, usually as part of the checkout process, which is supposed to be secure, is beyond me).

    As for point 5 – buggy software – I’ve lost count of the number of times I’ve been unable to post a comment even though I’ve input the correct characters – up to a dozen times, and more, in some cases. That can sometimes be a browser-related issue, but Firefox has been around for quite a while, and has a large market share, so if your blog or online store, online newspaper or whatever isn’t FF compatible, it’s high time you got with the program.

    Ah . . . That feels better!

    • Hi Ron,
      I have lots of trouble with these catpchas. The ones with the busy and dark backgrounds are almost impossible to read. In some cases I have to ask my husband to enter the codes for me. I’ve also experienced many that do not have accessibility options and those that are buggy or broken. The use of captchas deters me from leaving comments on blogs and from purchasing any goods from sites that use them for online purchasing. Thanks for weighing in on this. I was sure that I couldn’t be alone when it comes to disliking this anti-spam tool.

Your comments are welcomed. Please submit them here.

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Connecting to %s