CAPTCHA Verification Is Broken, For Some Blogs, In Various Applications

We're seeing a number of problem reports, in Blogger Help Forum: Something Is Broken, about various problems which involve CAPTCHA verification processes.

The symptoms are fairly diverse.

• Some blog owners report problems with commenting, on their blogs.
• Some report problems with high posting volumes.
• Some report problems getting abuse review requested, for their blogs falsely accused of hosting abusive content.

The reporting volumes, and perceived urgency, for each case, will vary.

The known problems involve various bX codes, issued in place of the CAPTCHA form.

• An unverified code is being seen, by people trying to post comments, on blogs using CAPTCHA screening.
• Blog owners are reporting various bX codes, when trying to post high volume blogs.
• Other blog owners are reporting "bX-niui1k", when trying to request spam review, from the dashboard "Deleted blogs" list.
• It's possible that there are other CAPTCHA applications, also seeing bX codes.

The audience observing the bX codes will differ - because the relationship of the people needing to use the CAPTCHA, and the volume of CAPTCHA use by the affected people, will differ.

People observing a bX code, when trying to post a comment, will be guests on blogs which use CAPTCHA screening - since blog members and owners are not subject to comment screening. CAPTCHA screening is optional for comment moderation, in general - and it's possible that many blog owners are not using CAPTCHA screening on their blogs.

It's also possible that only blogs which use the full page and popup comment forms are vulnerable, to this problem. The report volumes involving bX codes involved with comment moderation are low - and this will make affinity analysis difficult.

People observing a bX code, when trying to post at high volume, will be blog owners who post frequently. The reports of this problem are low to medium volume - possibly because many blog owners avoid posting excessively. This may be because we have observed that repeatedly solving a CAPTCHA will be inconvenient.

The people who report this problem are fairly insistent that this problem needs to be solved. Since the bX code is observed repeatedly (once for each high volume post attempted), by the blog owners affected, this case will involve the most controversy. Several blog owners have reported seeing differing bX codes.

People observing a bX code, when trying to submit an abusive blog review request from the "Deleted blogs" dashboard list, will be blog owners whose blogs were deleted or locked, spuriously, for abusive content (aka "spam hosting"). These people will post in the forums, and can be helped fairly easily, by our promptly offering a manual review, submitted to Blogger Support.

This case represents the most frequently reported symptom - but since the people affected can be helped with minimum fuss - and since this case is only observed once for each blog involved, this case will involve less controversy. This case has been reported, as noted, consistently producing the "bX-niui1k" code.

It's possible that CAPTCHAs are used in other unidentified applications - and we may yet have other cases to discuss, if the base problem is not resolved fairly promptly. Blogger Support is currently aware that there is a problem - and hopefully, where the problem lies.

>> Top

If You Use CAPTCHA Screening On Your Blog, Try Publishing A Comment, As A Guest

Not all Blogger blog owners, using CAPTCHA screening to reduce abusive comments on their blogs, know first hand what the typical CAPTCHA puzzle can be like.

We're seeing a few concerned blog owners, in Blogger Help Forum: Something Is Broken, asking why they're seeing fewer comments on their blogs.

I'm hearing from people that they can't post comments on my blog. I tested, and comments are working just fine. What is the problem, here?

Not all blog owners bother to test the CAPTCHA, on their blogs - or even know why they don't see one, when commenting.

Not all blog owners, enabling Word verification in their blog commenting settings, bother to read the tool tip behind the "?".

Show word verification
This will require people leaving comments on your blog to complete a word verification step, which will help reduce comment spam. Learn more.
Blog authors will not see word verification for comments.

The simple advice

Blog authors will not see word verification for comments.

does not sink in, to everybody.

This leaves many blog owners unaware of how frustrating it may be, for their guests to comment, on their blogs.

If you're a blog owner, musing whether to add word verification to your blog, in an effort to cut down on the spamming and trolling going on in many blog comment threads, maybe you should try posting on your blog, as a guest. With "Show word verification" set to "Yes", logout from Blogger - or clear cache, cookies, and sessions (yes, all 3!) - then restart the browser, and try leaving a comment on your blog.

What you discover may not please you. Then ask yourself how many of your readers will have the patience, to solve a CAPTCHA, every time they wish to publish a comment?

As a blog owner, you have 3 settings which are used, in proper combination, to provide a safe environment for your readers to leave comments.

1. Authentication.
2. CAPTCHA Screening.
3. Moderation.

Consider using one or both of the other two options, if possible.

>> Top

Blogger Blogs And Commenting Permissions

Not all Blogger blog owners know that the ability to comment, like the ability to publish and read posts, is a privilege which they control - and a responsibility which they need to control, carefully.

Any blog owner who wishes to publish a blog, and not be subject to frequent deletion of the blog, as a suspected malware or spam host, needs to understand the responsibilities, and the risks.

There are levels of ability to post comments to a blog, which you select from the dashboard Settings - "Posts and comments" wizard. Protect yourself, if you allow comments.

• Anyone - includes Anonymous Users.
• Everybody with a Google, or an OpenID, account.
• Everybody with a Google account.
• Blog members only.
• Comments disabled.

Choose this setting with great care.

If you allow comments by "Anyone", prepare to deal with the spam. Note that anonymous users can post either anonymously, or using "Name / URL" tags, at their discretion, with "Anyone" selected. "Name / URL" does not provide authentication. "Anyone" means anyone, period.

Besides "Who can comment?", you may also control comment publishing using CAPTCHA (aka "word verification") screening, and using comment moderation. These settings, like "Who can comment?", are part of the Settings - "Posts and comments" wizard.

Every blog owner, hoping for any visibility in the Blogosphere, needs to choose these settings carefully - or risk being buried by spam.

• Who can comment?
• Comment Moderation.
• Comment Notification Email.
• Show word verification

Comment Moderation, and Comment Notification Email, together, provide 2 settings which can bury your email Inbox, depending upon activity of commenting on your blog. Choose these settings wisely.

If you allow spam comments without control, you may later find yourself asking for help, in Blogger Help Forum: Something Is Broken

Help me! My blog was deleted by Blogger!

Protect your blog, and your blog's future, by allowing comments, responsibly.

>> Top

The Latest Round Of CAPTCHAs Left Me Speechless

During the past week, I have seen a small handful of mentions of the latest Blogger CAPTCHA form, so I was not surprised this evening when I encountered one, in real life. In this case, where I was privileged to see these real examples, I suspect that the CAPTCHA itself was only marginally involved, as the cause of the problem being discussed, in Blogger Help Forum: Something Is Broken.

In looking at these three examples, I immediately hit "Publish" on the first two. I attempted the third, simply because I wanted to move forward with the actual problem diagnosis.

The "easy" "words" which contain "characters" in black, on a clean white background, are sort of guessable. I've seen enough of them. They suck - but they are predictable.

The other "words", in the shadow box, with noisy details - I guess represent the latest attempt to keep them from being guessable by automated processes. These, I fear, are simply over the edge.

??? After looking several times, I can see a dim "3" - so I suppose I would guess that, if I was reasonably sure that I had a good chance with the other, relatively easy "word" ("tokshous"?).



????? This one, I cannot begin to see characters. I would immediately pass on this one, every time. Even if "asuchSe" is correct for the "easy" "word" (or might that be "asuch5e"??). FAIL.



I can sort of see characters - possibly all capital letters, and a space in the middle. A guess, fortunately correct, was "AF9" (hoping that the space was not significant). And, hoping "Iflages" to be the "easy" word (that could be "If1ages", just as easily).



You get one chance with each CAPTCHA - a wrong guess, on either "word", simply leaves you looking at a different CAPTCHA. So, you have no opportunity to learn from your mistakes.

The above 3 examples show the "non easy" "word" semi visible, at least. Recently, I have seen some CAPTCHAs where the "non easy" "word" was just a black box on the screen - no content at all visible. In one case, I hit "Publish" 4 times without entering anything - simply because I could see absolutely no detail in the black box. Will your readers be that persistent?

If you are using CAPTCHA screening in the comments, on your blog, you will have to decide for yourself whether you wish to continue doing so. I removed the CAPTCHA from my blog, a month ago. Had I not removed the CAPTCHA a month ago, I would most surely have done so, today.

Were I be idly preparing to comment on your blog (for any purpose not involving me diagnosing a problem for someone), and were I to encounter these CAPTCHAs, this would simply be the last time I attempted to publish a comment, on your blog.

Comment publication I regard as maybe optional - it's no great problem (to me) if I can't publish a comment, on your blog. I have no idea what I will do, when encountering these abominations under a high stress situation, however.

1. Account creation.
2. Account / blog unlock.
3. Two step authentication necessitated re login (which I do see, regularly, when using the forums).

None of those 3 scenarios lend themselves to sitting there and guessing indecipherable puzzles, with marginally predictable outcome. Especially as my suspicion is that CAPTCHAs protect us only from the very simple hackers and spammers.

I don't use CAPTCHA screening - though I will moderate, here.

>> Top

CAPTCHA Verification Required For Excessive Posting Volume

Occasionally in Blogger Help Forum: Something Is Broken, we see a query from a confused blog owner.

I made a large number of posts today, and Blogger is now requiring me to solve a CAPTCHA, for every post. I tried to find the form to submit, so that my website could be reviewed, but I could not find it. What do I do, now?

This blog owner, like too many, does not understand the spam mitigation policy.

Long ago, we first became aware of the Blogger policy on excessive posting volume. At the time when the anti spam policy was first publicised, we were told that CAPTCHA screening would be required, for any new posts exceeding a count of 50 in any day - and that the counter would reset at the end of the day.

Recently, we have some blog owners explicitly state that they are publishing less than 50 posts, and still being subjected to CAPTCHA screening. There are two possibilities, here.

• The Blogger anti-spam policy is dynamic, and the threshold may vary, dynamically, depending upon details not being stated.
• The breaking time of the day may not coincide with the local clock observed by any blog owner. It's possible that some activity from the previous local day might contribute to a count of 50 posts, as observed by any given blog owner.

It may not be accurate, to advise any blog owner, reporting this problem, that exactly 50 posts, in any day, will consistently trigger CAPTCHA screening.

In complete accuracy, we can only note that excessive posting volume, approximating 50 new posts in any 24 hour period, will trigger CAPTCHA screening - and that sometime during the next 24 hours, the count would reset - and normal posting would then resume.

It's possible that the "24 hour" period is calculated according to a local clock - but the reset, following a period of acceptable activity, is a worldwide process for all blogs, simultaneously. This would make the reset period more like "48 hours", for some blog owners.

The exact time span of the "48 hour" period is not known. This is simply a reality of the 24 hour, worldwide, use of Blogger.

Other cases where high posting volume may be a problem include use of Mail-To-Blogger, and the Blogger app on smart phones. Mail-to-Blogger now produces Draft posts, which can be published from the Posts menu. We have reports that the Blogger app is also saving Draft posts - but we're not yet sure what options are provided for Publishing the Draft posts.

>> Top