s9y/additional_plugins — pull request #17 by Manko10 (2012-08-15 23:13:52+00:00)
Title: Next update for SpamBee plugin: answer scrambling and code obfuscation

Hi there,

I spent some time on giving bots a hard time again and wrote yet another feature to the SpamBee plugin. :-)

There is now an option to scramble the answer text. This option is turned off by default, but when you turn it on, the answer won't be displayed in plain text anymore. Instead it will be scrambled with a simple XOR cipher which is then decrypted again in JS with the provided key. This should make it impossible to scan the JS code with regular expressions. The bot would either have to extract the scrambled answer and the key and then decrypt it or it has to execute JavaScript.

And in case you are even more paranoid, you can also obfuscate the generated JS code (provided you use the "Default" method).
This would then generate JS code like this:

var spamBeeData = function() { var RthwS = {};var VBxDN = unescape('%25%45%38%25%38%43%25%41%37');var esrxE = unescape('%31%31%31%30%39%39%39%38%32%39');var xLzft = unescape('%64%65%66%61%75%6c%74');RthwS['answer'] = VBxDN;RthwS['scrambleKey'] = esrxE;RthwS['method'] = xLzft;return RthwS; }();

which is obviously nearly impossible to parse unless you're really using a JS engine. The variable names are completely random, the order in which they occur is random as well and all strings are completely URL encoded, so one would have to decode all of them first in order to be able to distinguish them.

With these additions made there should be no way Bots could pass the Captcha unless they can either execute JS or understand the question. I consider the scrambled answer in combination with the code obfuscation the safest variant of all, even safer than the JSON method (which can of course also deliver a scrambled answer but doesn't have any code obfuscation because the URL is always the same anyway).

The JS for the "Default" and "JSON" method has been tested in all major browsers and IE back to version 5.5. Works fine with all answer retrieval methods and levels of obfuscation.

But if you are like me and prefer not to have any magic JS in your web page, you can of course also use the Smarty method with encryption. You only need to remember to ASCII armor the scrambled answer using something like URL encoding or base64 (for which there is unfortunately no native cross-browser compatible JS method).
The code I currently have in my commentform.tpl is as follows:

{* --- Comment form here… --- *}

Simple yet effective. :-)