captcha bypassaed

Question

every day we receive about a dozen of spam comments by Anonymous user on our documentation website, that is powered by Confluence.

Our website settings require captcha before submitting a comment as Anonymous. Is it possible that the spammer is exploiting a bug that bypasses the captcha?

This problem is very annoying because it forces us to frequently remove unwanted comments. Is there a way to add a moderator or some sort of approval workflow on comments that are edited by an anonymous user?

Thank you in advance

Matteo Monfredini · Answer

Alex, I am totally with you.

IMHO, Atlassian should:
1- Implement comment moderation (it exist since a long time... why you don't have implemented?)
2- Implement a series of different captchas (based on words, images), or better again, let developers write plugins to use wathever captcha verifications available on the net (recaptcha, mollom, identipic...)

Alex Yasurek · Answer

We have just started going through the same thing. It started out slowly only getting 1 or 2 spam comments so we had our hosting company blacklist the IP addresses, but each new spam comment had a different IP address. It then exploded over night and we had like 30 new spam comments. It's very time consuming to go through and blacklist the IP address of every new comment since they are all different. We had to disable anonymous commenting for now but this is not a solution for us since we want legitamate comments from real users. I hope confluence comes up with some solution or replaces their captcha system for a better one.

Nic Brough -Adaptavist- · Answer

I'm afraid it's not a bug in Confluence, it's a general problem with the "Captcha" process.  First, Captcha is easily bypassed by brute force - you can hire teams of people who will read captchas for you for fractions of a penny, and I know several sites that are constantly being hit by these.  Secondly, last year, a security team demonstrated an AI that was capable of passing most schemes nearly as well as a human (but thousands of times faster).

So, your instinct to go for comment approval is probably the right one, but I'm not aware of any plugin that would do that for you.  (Atlassian have said they won't do it inside Confluence - https://jira.atlassian.com/browse/CONF-13202)