WebWiz Forum + Captcha =?

Hi! We're licensing the WebWiz Forum, and used to have Captcha installed up to version 9. Upon the upgrade; Captcha magically disappeared function-wise; but the version 10 source code is virtually "littered" with captcha references. :-)

CAPTCHA was removed from Web Wiz Forums version 10 as it no-longer works against the more advanced bots that have CAPTCHA code OCR built in and can read CAPTCHA codes that even humans can not.

Instead Web Wiz Forums version 10 uses a number of complex session, encryption, and unique page/form systems that prevent automated registrations and logins.

We can not comment on security measures at StopForumSpam as we are not partnered with them, we do include integration with their service within Web Wiz Forums, but that is as far as the affiliation goes.

We do host thousands of websites that use Web Wiz Forums and monitor them through custom rules in network gateway IPS services and log files and not seen any remote automated form submission that has got passed the current protection for the Forum Registration. We have seen remote form submission which is getting passed the post submission and will be putting in place extra measures on the next release.

The Web Wiz Forums is a multiple stage process for registration already as you can not submit a registration directly to the Member Registration page. You have to go through the Member Agreement page which creates a unique registration form using encrypted form fields unique each time. Additional protection also comes from  multiple tokens that are unique to each Registration form created. It is very complex with many multiple solutions in place that prevent remote form submission with many months spent on development and real world testing including on large forums we host for companies including MIcrosoft which are under constant attack from advanced automated submissions and other attacks.

What you will see is real people registering using strange user names like '123TT7aV' and emails like 'a.b.c@gmail.com' to get around blocked usernames and email addresses in StopForumsSpames database. These spammers are real people working in modern day sweat shops working 12 hour days for a few dollars in order to spam forums. This is likely what you are seeing in forums.

Most clients who complain to us of spam within Web Wiz Forums it is because they are not using the tools available to stop spammers. After setting up Web Wiz Forums to prevent spammers we see busy forums that are plague with spam drop from 20+ spam posts a day to 2 or 3 a month.

The first thing you should do to prevent spam is create a new user ladder group for 0 to 10 points. This group should have posting URL's and images disabled as well as signatures. As spammers are paid by the number of forums they spam with links by having these disabled for new users spammers quickly move to easier targets.

You should also make sure StopForumSpam is enabled and set to check for Usernames or IP Addresses.

Other information on preventing spam is on the page below:-

http://www.webwiz.net/web-wiz-forums/kb/spam-prevention.htm

Today, I've had the honor and pleasure of deleting a high number of "Bru49Z9" accounts on our 10.16 system. This is to say that we will certainly appreciate even more countermeasures from WebWiz :-)

Bruce, you were talking about a new version with more bells and whistles against unwanted user registrations and spam; when will these be put into action? Will it be with 10.18, 11.0, on this side of new years eve, or next year?

I'm asking simply because we will have to consider what to do next. I suppose that this is the eternal struggle between the bad guys (the underpaid workers of emerging (post-) industrialized countries), and the good guys (us, of course :-), and this means that it is a matter of trust. Trust that we will be able to fine-tune the solution, with e.g.

- geolocation controlling the possibility of user self-registrationg; e.g. letting GB users register and get into use immediately, whilst those of less fortunate countries are given the oppurtunity to establish accounts that are immediately blocked and/ore suspended from the start on, or not given the opportunity to register at all.

I realize that such changes will take some time, hence the wish to know a bit more about coming plans. OK - at least that much that I'm relieved, and så little that the "bad guys" will not be able to countermeasure before measures are put into action :-)

Sincerely yours,

Arna.