Quote from: TheQuin on August 15, 2018, 10:15:57 AM

Quote from: hilariousetc on August 15, 2018, 10:07:33 AM

I don't think I've joined many websites or forums before that didn't require email verification and if captchas are so pointless then why does pretty much every other forum use them? They have their benefits and will stop some bots at least.

I've been doing a lot of antibot work recently and I'm not saying it is pointless because you want to put as many obstacles in the way as possible. I'm just trying to reduce any expectation that either of these will make a difference. Email verification just requires them to run an email server and a script to create the email accounts at the same time as the forum account and then acknowledge the link sent. You can buy software to solve reCAPTCHA for less than $100 a year subscription and the botnets I deal with have written their own solvers.

I found it best to completely avoid any of the established captcha providers. Back when I used to run a phpBB, I had a little-known visual captcha called KittenAuth. It basically gave you 9 pictures in a 3x3 grid and the default setting was to select only the kittens. But you could change the pictures to something more thematically appropriate for your site. I found that far more effective than any other captcha I've ever encountered. Only human beings got through after that.

The safest bet is to make a totally proprietary one. The more obscure, the better. But not text or numbers. Use pictures.

Quote from: hilariousetc on August 15, 2018, 08:14:04 AM

However about we remove the default merits completely and everyone starts from ground zero? That would really sort the wheat from the chaff and stop all the whingers about it not being fair.

That works too. Would certainly make it easier to spot bought accounts.