Legacy Registration Timer

[CharlieDelta]

Fillip H. I know you and Cosmic have internal policies with regards to mod updating and feature additions but I am asking, no, I am pleading that you add this feature STAT if it is possible and easy.
For the last month I am having approximately 30 registrations per day from spam bots. Most of these do get caught by this mod Spambot Stopper - Prevent Spambots from Registering - vBulletin.org Forum which is not compatible with advanced registration. I say "most" because the odd one is a human.

I don't want to disable advanced registration not only because I paid for it but because I like all the features but I am at my whits end with having to go through 30 registrations every day.

So, I am hoping to not see your standard phrase

We'll take it into consideration for future versions

here. I beg of you.

 

[Fillip H.]

I would recommend you try out this mod: [GlowHost] Spam-O-Matic - Spam Firewall stops forum spam - vBulletin.org Forum - you can configure it to only verify email addresses against block lists (I would recommend avoiding the username and ip address filters, both because of performance and also because it's very prone to false positives.

This mod does a much better job of stopping spam bots than a registration timer, IMO:

13964 Spammers Denied Registration
130 Spammers Permanently Banned
131 Spammers submitted to StopForumSpam

We installed this mod on 17th May 2011, so in 2 years 4 months it has let 131 spammers through (0.92%). I'm decently certain this mod works with AdvReg or we'd be hearing about it.

 

[CharlieDelta]

I have been using that mod for several years now. A registration times is an excellent defense tool and can be argued better than Spam O Matic.

 

[Fillip H.]

I'd be interested in hearing the arguments for a registration timer, considering the fact that bots can simply code a delay into their form submission scripts, bypassing this protection entirely. You would then enter into a game of "how much of an inconvenience to my legitimate users is acceptable to deter spam bots" by being forced to increase delay to the point where you may very well hit legitimate users.

My current opinion of a registration timer is that it works in much the same way security on a brand new OS would work: It's not worth anybody's time to try to find exploits for it, because very few people use it. If it became popular, crackers would rip it to shreds the same way they do Windows.

In other words, if everybody started using a registration timer then we'd hit the problems mentioned earlier. The only thing that would then happen is that their rate of being able to register & spam forums would be reduced. It would do nothing to deter or indeed stop spam, while simultaneously running the risk of hitting legitimate users.

For that reason, I believe that - short of post scanning algorithms like Akismet - email detection is a superior form of spam detection. It forces spammers to either keep registering new emails (which would eventually trigger red flags with email providers) or re-use existing emails (which can then be blocked).


As I said, though, that's just my opinion. I am interested in hearing the arguments for a registration timer and why it's a superior form of spam detection.

 

[CharlieDelta]

Well I certainly will not stop using Spam O Matic for some of the very reasons you posted.

You know I am one of your biggest fans and respect your opinion greatly. I am no where near qualified to argue the mechanics as to why exactly a registration timer is better all I can do is simply tell you my results with using one.

With a registration timer I was getting piratically zero spam registrations. I say practically because the odd one was human. I was not getting any feedback that a legitimate user was unable to register. After removing the registration timer I began getting registrations who would directly head over to the blog and spam. I have dozens of soft deleted blog spam. Ozzy came out with a small mod that would prevent blogs being posted based on post count. This reduced my blog spam to zero but I still have dozens of registrations per day. All of which are not in the Spam O Matic database.

I am hoping that someone who is far more qualified than I am will jump in here and explain better than me why a timer is better.

 

[Fillip H.]

Fair enough

Can you try editing the Time Check - Add Form Hidden Fields plugin and change

$timezoneoptions .=

to

$sections .=

and let me know if that works?

 

[CharlieDelta]

You are the best.

I am able to register now with the changes you suggested above. I will let you know how it goes after a few days.
Cheers.

 

[CharlieDelta]

Sadly, after many days of testing this does not seem to be working.
I have not gotten any email confirmation of blocked registrations and I am still getting more spam registrations.

 

[Fillip H.]

Does the GlowHost mod not work with AdvReg then?

 

[CharlieDelta]

As far as I can tell it does. It seems most of the spammers that register are not in the GlowHost database.

 

[Fillip H.]

What settings do you use? Here's ours:

 

[CharlieDelta]

The only differences I see is that I am testing IP addresses against the database and my expiry is set to 90 days.

 

[CharlieDelta]

Is there anyway that this mod is not playing nice with Glow-Host?? Maybe that is my problem.

 

[Fillip H.]

I can't be certain, I haven't tested the two together. I'll see if I can get it to work with both those products over the course of the week, if I have time

 

[CharlieDelta]

I am going to disable this mod to test because I am starting to see registrations that are in the StopforumSpam database now that I am cross referencing in greater detail.

 

[CharlieDelta]

It has been almost two weeks now since I disabled this mod and I have NO spammer registrations and three legit registrations. Gone from 5-10 spammer registrations daily to zero. Almost too much of a coincidence.

I am reluctant to re-install the mod but will do so to confirm this testing.

 

[CharlieDelta]

Within a 24 hour period I had 12 spammer registrations. I would say that concludes the test. I have disabled this mod and will not be turning it back on as it is evident this is the hole.
Fillip H. I hope you will be able to plug it.