Image CAPTCHA not effective anymore #5886

New Issue

GiteaMirror · 2025-11-02T06:39:21-06:00

GiteaMirror commented

2025-11-02 06:39:21 -06:00

Originally created by @skylarmt on GitHub (Aug 23, 2020).

Gitea version (or commit ref): 1.12.3

Description

I have the signup form image CAPTCHA enabled on my Gitea server but in the past few days there have been many bots registering accounts (and failing to get the confirmation emails, which bounce or are flagged as spam by random idiots, hurting my mail server's reputation). It seems that either the bots are able to solve the CAPTCHA or there's some way around it. I did notice that requesting the CAPTCHA image over and over with the same URL (i.e. right-click image, open in new tab, F5) will produce dozens of new images with the same correct answer, so they might be using that to figure out the correct answer. Or it's just too easy to begin with.

Originally created by @skylarmt on GitHub (Aug 23, 2020). - Gitea version (or commit ref): 1.12.3 ## Description I have the signup form image CAPTCHA enabled on my Gitea server but in the past few days there have been many bots registering accounts (and failing to get the confirmation emails, which bounce or are flagged as spam by random idiots, hurting my mail server's reputation). It seems that either the bots are able to solve the CAPTCHA or there's some way around it. I did notice that requesting the CAPTCHA image over and over with the same URL (i.e. right-click image, open in new tab, F5) will produce dozens of new images with the same correct answer, so they might be using that to figure out the correct answer. Or it's just too easy to begin with.

GiteaMirror closed this issue

2025-11-02 06:39:21 -06:00

GiteaMirror commented

2025-11-02 06:39:21 -06:00

@skylarmt commented on GitHub (Aug 23, 2020):

Here's an alternative CAPTCHA library with more options for difficulty and different types (numbers, letters, math problems):

https://github.com/mojocn/base64Captcha
demo

@skylarmt commented on GitHub (Aug 23, 2020): Here's an alternative CAPTCHA library with more options for difficulty and different types (numbers, letters, math problems): https://github.com/mojocn/base64Captcha [demo](https://captcha.mojotv.cn)

GiteaMirror commented

2025-11-02 06:39:22 -06:00

@skylarmt commented on GitHub (Aug 23, 2020):

Another option is to add alternative CAPTCHA options such as hCaptcha or Captcheck. I don't use Google's reCAPTCHA because I believe forcing users to run spyware on their devices in order to use my websites is wrong.

@skylarmt commented on GitHub (Aug 23, 2020): Another option is to add alternative CAPTCHA options such as [hCaptcha](https://www.hcaptcha.com/) or [Captcheck](https://captcheck.netsyms.com/). I don't use Google's reCAPTCHA because I believe forcing users to run spyware on their devices in order to use my websites is wrong.

GiteaMirror commented

2025-11-02 06:39:22 -06:00

@skylarmt commented on GitHub (Aug 26, 2020):

FYI: Since opening this issue, bots have created 169 new accounts that were never activated and I've received over a dozen abuse reports from people who flagged the confirmation emails as spam.

@skylarmt commented on GitHub (Aug 26, 2020): FYI: Since opening this issue, bots have created 169 new accounts that were never activated and I've received over a dozen abuse reports from people who flagged the confirmation emails as spam.

GiteaMirror commented

2025-11-02 06:39:22 -06:00

@Schoumi commented on GitHub (May 19, 2021):

Instead of doing captcha for human, I remember, I've read something about showing captcha only for bots in some hidden fields in the page. If the captcha is complete it's obviously a bot because human people hasn't been able to see it throught their browser.

@Schoumi commented on GitHub (May 19, 2021): Instead of doing captcha for human, I remember, I've read something about showing captcha only for bots in some hidden fields in the page. If the captcha is complete it's obviously a bot because human people hasn't been able to see it throught their browser.

GiteaMirror commented

2025-11-02 06:39:22 -06:00

@lunny commented on GitHub (Jun 3, 2021):

Since #12594 merged, I will close this one. Please feel free to reopen it.

@lunny commented on GitHub (Jun 3, 2021): Since #12594 merged, I will close this one. Please feel free to reopen it.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#5886