SPAM via OpenMage forms - The Cloudflare Turnstile solution

[toejam34]

Hello all,

I have seen there are few somewhat outdated prevent spam on contact forms.

Does anyone have, or know of any that might use a more modern approach such as turnstile?

Any pointers are appreciated!

Andy

[pquerner]

The methods havent changed.

• Honeypot
• Captcha (Google or anything else)
• Secure w/ something like visitor must be firewalled from Cloudflare (i.e. not on their blocklist)
• Blocklist by mail or domain, with false positive return

[ma4nn]

Also https://github.com/magento-hackathon/HoneySpam is working fine with OM.

[toejam34]

I think you are absolutely right here. My terminology was inaccurate.

[toejam34]

Thank you - investigating

[fballiano]

I've added HoneySpam to https://github.com/fballiano/awesome-openmage

[empiricompany]

Clean implementation of Google reCaptcha for OpenMage: https://github.com/empiricompany/reCaptcha/

[addison74]

I think I have discussed this topic in other posts. I use HoneySpam together with Fail2Ban. Around 120 IPs are captured daily on the contact form and newsletter. From time to time a few messages slip out, but we find the senders in the webserver log by date and block them with ipset. I created a command that quickly finds the IP in CLI. We can use reCaptcha, but I gave up. It seems that it is not so secured anymore, there are articles on the Internet related to this issue. Also, visitors no longer have the patience to solve puzzles or enter codes that are not legible.

[toejam34]

Noted - thank you

[addison74]

Check this post for reCaptcha

#1649

[addison74]

Cloudflare Turnstile could be a great addition for OpenMage.

https://www.cloudflare.com/products/turnstile/

Humans spend about 500 years each day solving CAPTCHAs - wasting time and creating frustration. This is why Cloudflare built a better alternative to CAPTCHAs with Managed Challenge and now Turnstile.

[f1-outsourcing]

What about this part1. I am going to try this soon in production, see if it is a quick and easy solution.

https://www.nfriedly.com/techblog/2009/11/how-to-build-a-spam-free-contact-forms-without-captchas/

[pquerner]

Thats a honeypot. If you are really spammed a lot, you can do this aswell. Doesnt hurt actual people.

[fballiano]

I started to work on a Cloudflare Turnstile module:
https://github.com/fballiano/openmage-cloudflare-turnstile

It already works although it supports only customer-registration, contact-form and newsletter-subscribe at the time of writing this comment.

It doesn't depend of Mage_Captcha for anything so Mage_Captcha could be disabled/removed (recaptha module depends on Mage_Captcha instead).

:-)

[fballiano]

@toejam34 great to know it's working fine!

[toejam34]

Never any doubt!

[addison74]

@toejam34 - What type of widget did you use? The invisible one?

[toejam34]

I left all options as default - literally just punched in the keys and off I went.

Protection on the admin / contact forms.

[fballiano]

2 more customers tell me that with turnstile (with my module) the spam problem vanished completely

[toejam34]

@fballiano I have found one issue.

If you try and reset your password I get a "invalid captcha"

I have validated that its the awesome plugin that you have written by disabling the reset password works.

Steps to reproduce :

OM20.6
PHP8.3
URL : https://www.seriouslylotus.com/
Click login OR my account
Click forgot your password , type in any email address and press submit
This results in a "incorrect CAPTCHA" error :

Edit : updated to the latest version and issue has gone!

[fballiano]

exactly, in 0.4.0 i've fixed it:
https://github.com/fballiano/openmage-cloudflare-turnstile/releases/tag/0.4.0