New subject: [Mediawiki-l] CAPTCHA recommendation for account-creation bots?

27 Feb 2012

On 02/27/2012 02:17 PM, mediawiki-l-request(a)lists.wikimedia.org wrote:
...
  Date: Mon, 27 Feb 2012 17:57:14 +0000
 From: Daniel Barrett &lt;danb(a)VistaPrint.com&gt;
 To: MediaWiki announcements and site admin list
 	&lt;mediawiki-l(a)lists.wikimedia.org&gt;
 Subject: [Mediawiki-l] CAPTCHA recommendation for account-creation
 	bots?
 Message-ID:
 	&lt;68CF225601ADF74BA1F8A2511535F85D0A9D20DB(a)WNDMAIL02.vistaprint.net&gt;
 Content-Type: text/plain; charset="us-ascii"

 Spam bots are creating accounts on my music wiki
(http://www.blazemonger.com/GG/Special:RecentChanges). What is the best extension to
prevent this? I installed ConfirmEdit and tried the default CAPTCHA (SimpleCAPTCHA) but it
didn't stop the bots.  Before I experiment with the many other options, I thought
I'd ask what people recommend.

 Fortunately the bots can't edit articles, just create useless accounts.

 Thanks,
 DanB 
I'll take this opportunity to point out that Dan's not the only one.
People who run MediaWiki instances come into IRC (#mediawiki) every day
asking for help fighting spam and vandalism.  Some emails that have come
my way (reprinted with permission):

Jason Vertrees wrote:
...
  HI Sumana,

 After opening up my wiki for free registration, I immediately got
 three spam accounts. One turned into real spam being injected into and
 then cleaned from the wiki. None of the methods aside from preventing
 self-registration seem to work against spam. Unfortunately, this also
 prevents growth.

 I read the links you provided--do you have anything else more proactive?

 Thanks,

 -- Jason 

Sergey Chernyshev wrote:
"Do you by any chance know a reliable way to combat spam? I'm tired of
the hordes of spammers attacking my MW projects.... Unfortunately, I'm
well aware of current anti-spam features and none of them simplify the
spam combat to the level similar to WordPress, for example."
(http://www.mediawikiwidgets.org/)

Anne Gray wrote of sfeditorwatch.com and sfartistwatch.com, which have
Google Analytics, ReCaptcha and Bad Behavior installed:
...

 Thank you for offering to help try to figure out what's gone wrong
 with sfeditorwatch.com and sfartistwatch.com.  Cheryl's email reminds
 me that activity on the sf editors wiki was really picking up for a
 while, the year before it started getting attention from spambots.
 Once I started having to protect pages to keep from losing content and
 the wiki started being full of spam, participation declined sharply.
 It rapidly hit the point where I as an administrator couldn't possibly
 hope to keep up.  Then reCaptcha broke and people *couldn't* edit
 their own pages.  At this point, I'm pretty sure bots are almost the
 only thing active there.... [snip]
...
  Sfartistwatch never really took off partly, I think,
because it's
 really non-obvious how to post images (I still have never learned).
 And I'm worried that if we turn it on, it will get hit by the kind of
 spammers that are posting hundreds of spam images to the Carl Brandon
 society wiki...

 I don't know enough to set up bots to patrol, to set up notifications
 so that I as the administrator can "watch" all the pages, or to use
 scripts or whatever to nuke the massive amounts of spam pages that are
 created regularly.  Bots are clearly getting past recaptcha to
 register users (they're doing that on the carl brandon wiki, too), and
 the "Random page" button is totally useless for a visitor who is
 actually interested in the topic of the wiki (is there a way to
 reprogram that, so it only selects a random page that has a category,
 at least?  (it would be sooo nice, when you Block a user for spam or
 vandalism, for the following page to list pages that user created,
 with checkboxes beside them, and provide the option to select all of
 them at once and delete them.  Even better if it gave the option of
 automatically protecting against future re-creation of those spam
 pages.)... 
Most of these administrators are smart people who just need a little
help fighting the bots.  It sounds like the recommendations from this
group so far are:

* https://www.mediawiki.org/wiki/Extension:QuestyCaptcha , a plugin for
the ConfirmEdit extension
* http://www.mediawiki.org/wiki/Extension:SimpleAntiSpam

so I've added those to these help pages:

* https://www.mediawiki.org/wiki/Anti-spam_features
* https://www.mediawiki.org/wiki/Manual:Combating_spam
* https://www.mediawiki.org/wiki/Manual:Combating_vandalism

and welcome additional improvements to those docs, especially if
recommendations that are in there right now are no longer worthy of
recommendation.

Also, anyone want to take a crack at cleaning out what's no longer
applicable in https://www.mediawiki.org/wiki/Spam_Filter so I can
suggest it as a project for contributors?
-- 
Sumana Harihareswara
Volunteer Development Coordinator
Wikimedia Foundation

Re: [Mediawiki-l] CAPTCHA recommendation for account-creation bots?