Using CAPTCHA or other "I am not a robot" functionality

Sarah Robie · September 2018

Hello - To ensure the integrity of the email addresses we acquire through email signups, quizzes, and advocacy alerts, we are looking to expand our use of CAPTCHA. The issue is that CAPTCHA doesn't work well on mobile devices - most devices auto-capitalize the first letter a user enters, which renders the code incorrect. Blackbaud has indicated that it's looking into a solution, but I haven't heard of any progress.

Does anyone have a work-around for this mobile issue? Or has anyone implemented another "I am not a robot" functionality on LO surveys or advocacy alerts?

Erik Leaver · September 2018

Hi Sarah,

Because the newer versions of Captcha require server-side validation, this is a bit tricky. I've seen clients utilize the API to build the surveys/advocacy alerts on their website instead of inside Luminate so they could implement the server side code needed to run the newer versions of Captcha.

Another option would be to use a service like Kickbox or BriteVerify to do real time verification of the email addresses, though both of those services also utilize an API so you'd likely need to use a PageBuilder page to implement.

Best,

Erik

Daniel Hartanto · September 2018

Less than ideal (which Erik has stated on his) -- if we are in the situation where we are lacking the server-side environment to integrate such solution -- from my observation, the Math Captcha seems to fare better the image in terms of still minimizing spam yet mobile friendly. Here's an example of our actual implementation of. You can basically create your own Javascript based math problem for user to solve (like simple algebra).

https://donations.diabetes.org/site/SPageServer?pagename=DIY_Contact_Us

regards,

Daniel

Erik Leaver · September 2018

Hi Daniel,

While this will help eliminate some bad actors, client-side Javascript challengescan be disabled by a person or a script. Noah Cooper‍ shared an example with me on how this could be done using the delete operator. I was looking into this as reCaptcha can be implemented client-side -- but it defeats the purpose.

Best,

Erik

Noah Cooper · September 2018

Right -- it's important to remember that any client-side solution is going to be vulnerable. In a lot of cases, an organization might decide that something like reCAPTCHA is good enough for their purposes, but purely from a security perspective, anything that relies on JavaScript can be circumvented by someone who tries hard enough. Most solutions that implement reCAPTCHA rely on using something like the jQuery Validate plugin to validate the form onsubmit. jQuery plugins can be destroyed with a few dozen characters of JavaScript.

Sarah Robie · October 2018

Thanks for this insight, everyone. It's good to understand the vulnerabilities of using a reCAPTCHA or Match Captcha in the absence of APIs.

Also, we are looking to implement real-time email validation as well, as Erik mentioned. I'm hopeful that will be a huge help in the interim.

Using CAPTCHA or other "I am not a robot" functionality

Comments

Categories