Captchas + Yahoo! Chat = No Bots (for Now)

tansqrx

Sep 6 2007, 03:15 AM

Just in case you haven’t been keeping up with Yahoo! Chat, it looks like a new sheriff is in town (http://blog.messenger.yahoo.com/blog/2007/08/29/new-entry-process-for-chat-rooms/). Just before the Labor Day weekend Yahoo! started making users enter a captcha before they could enter a chat room. This could possibly mean that the chat rooms will be bot free for the time being.

My first impression of the system was not that bad. I logged in with Yahelite and was quickly prompted to enter the captcha in a separate dialogue box. I do have to admit that the process did get very tedious as you have to enter the captcha every single time you change rooms. This is very hard on me because I tend to change rooms almost every minute. I have also noted that the captchas are getting longer. This is most likely to make it harder for captcha guessing program to work.

My impressions of the new system quickly went down hill once I tried to chat from the official Messenger client. Instead of a dialogue box, a hyperlink appears. The link opens your default web browser where you are then presented with the image and a space to enter the text. The soon became way too bothersome and I reverted back to Yahelite.

The last comment on this new scheme is one of bot evolution. The captcha for chat is brand new and thus the bot writers have not had time to catch up. As I have discussed before, there are already programs that can correctly guess the captcha more than 95% of the time. It is only a matter of time before these technologies are adapted to chat bots once again. Even if the majority of bots do adapt, the less programming adept writers will be left out and thus few bots will be in the rooms, even in the long run.

WeaponX

Sep 7 2007, 01:37 AM

Guess it was only a matter of time before they pushed the image verification for this. Most online forums have this feature already and it does help decrease the amount of spammers.

I'm sure there are ways for spambots to read those letters in the image verification, but if Yahoo can obscure the image even more it will probably be more effective. I have seen some where the letters are heavily distorted with tiny thread-like images in the background (like the watermark in checks).

turbopowerdmaxsteel

Sep 7 2007, 04:10 AM

This was long overdue as Yahoo! seemed to have abandoned the chat completely. Changing the captcha frequently (like Rapidshare does) will ensure bot programs have a hard time spamming the rooms. One interesting captcha I saw was where the user had to type in the result of a simple arithmetic calulation depicted by the Captcha. However, this will only help prevent room cycler bots. The spammers can still have their dirty bots inside a room. I don't know how many bot programs have been adapted to the changes, but I am certainly not going to update mine.

Even if, its just for now, this move by Yahoo! is for the better.

tansqrx

Sep 12 2007, 08:58 PM

I was also going to suggest a captcha system similar to Rapidshare. It seems like every time I am there the font changes for the captcha.

JeremyShaw

Sep 13 2007, 12:59 AM

Yes, but as noted by TIME, people willing to get a few free things (nasty... things) might be compelled by hackers/spammers to enter CAPTCHA's just to get in.

turbopowerdmaxsteel

Sep 13 2007, 01:27 PM

The future development of Yahoo Responder Bot, one of the best Yahoo! chat bots has also been terminated. The developer cited that he would not be able to outrace Yahoo's captcha protection mechanism, especially if it changes frequently. From what I saw back at his forum, the spammers are ready to pay him any amount of money, even on a daily basis, if only he would continue the development. I wonder why they are so desperate to spam around. The way Yahoo! chat has been for the last couple of months, the bots are only going to spam each other. Surely, there are better ways to cash in!

FeedBacker

Oct 20 2007, 10:28 AM

Yea---the botting still continues---1 guy in room politics 7 known as 1313---has over 42 names in the room---even after all the yahoo updating and captchas updating---1 name per ip is still the only way to stop spammers----yahoo still does not get it-----I wish they would listen to us on how to fix the bot problem once and for all ----but its yahoo and its free---

-Tony

turbopowerdmaxsteel

Nov 16 2007, 05:53 PM

They cannot apply the one IP per username restriction, because quite a few people share the same IP address. Even adsense acknowledges this fact and is therefore (to some extent) lenient on self clicks.

Regarding the captchas, well they can always be entered by a human. Some are even resorting to hiring cheap labour to periodically key in the captchas from a remote location.

The thing is, its very hard to absolutely curb the activity of the bots, if not impossible. Yahoo might change the chat login code, but the other clients can also adapt to this by logging yahoo's network activity.

tansqrx

Nov 17 2007, 07:18 AM

Well just to let everyone know, if you do get that CAPTCHA cracking code don’t forget to tell me about it. It’s only a matter of time before a developer releases it. I understand that it’s good to keep it away from spammers but I can think of several less sleazy ways to use it.

xboxrulz

Nov 18 2007, 02:52 AM

Yahoo Chat as in chatrooms or YIM?

I never go into Yahoo Chatrooms so I can really care less

.

xboxrulz

Latest Entries

tansqrx

Nov 9 2008, 07:29 AM

I don’t know if the user vote would work very well because if Yahoo! has taught us one thing it’s that the system can and will be hacked. Here is what I would do. If I wanted to flag someone for SPAM just to cause problems for a user then I would load my list of “clean” names and log them all into the chat room. I would then initiate a vote and all of the clean bots would vote to kick them. Same story different method for harassment in Yahoo! chat rooms.

I have to say that I am impressed with how this thread has taken off. Some really good discussion.

turbopowerdmaxsteel

Nov 6 2008, 01:42 AM

Actually, there is a SPAM protection mechanism at Yahoo's end. It blocks messages with links from suspicious usernames and IPs. For example, if the conversation was started with a link or the same link (or even link to the same domain name) is repeatedly sent, the account & IP gets blocked. This ban doesn't apply to links being sent to buddies. The actual spam protection algorithm is much more complicated than what I have described and it works quite well considering the fact that many spammers ask for ways to bypass it.

You are right about a user moderated protection. It would be really handy in chat rooms. Say if 4-5 clean room users vote an account as SPAM, it should be banned. By clean users I mean those that are active in the room and are rated low on the spam rating.

tansqrx

Nov 5 2008, 11:36 PM

I’m not necessarily against CAPTCHAs, just that you have to enter one every single time you change rooms. From what I have seen I also think it would be easy create a bot identification program on Yahoo!’s end. Most of the SPAM bots point back to only one or two websites and if they advertise such a site then they could be placed on a list. Also most bots use the same template for profile pages that can be easily identified. Lastly, many bots use a very distinct username such as <common woman’s first name><common adjective (usually provocative)><random three digit number>.

I don’t think a user should be kicked automatically by the system but instead a suspicious account should be put on a list in real time and a human make the final decision. The sad fact is that it is obvious that Yahoo! does not have even one real human monitoring the system at all. I believe that just one shift of workers monitoring 24/7 could improve the Yahoo! chat rooms drastically. Instead chat is running on some server in a deserted closet and it never gets any attention.

minimcmonkey

Nov 4 2008, 10:12 PM

They should make you enter a captcha on login, then send a session cookie, that way, you only have to enter it once each time you log in.
Although that would mean possibility of bots being logged in by the makers, then left to roam free, so there could be a detection system, which would check if a user was
- changing chat room a lot
- most of the things the user said contained a link
- they often link to the same website
- they say similar things a lot

turbopowerdmaxsteel

Nov 4 2008, 11:47 AM

I don't think the captchas are that bad. Some things need to be changed, though. The most annoying part of the captchas is that you have to open a web page in the browser to enter it. A built in GUI to enter the captcha would be very handy. The captchas should be limited to 1 per 2-3 hrs of room joining or so. Users often need to surf through rooms before they finally get in a room with real users and real conversations. Also, as you mentioned in a topic that the existing Yahoo captchas have been broken; so they need to be changed.