Challenge-Response Anti-Spam Systems - They Have Issues

You send someone an email, and you immediately get an automated message back. It says you need to confirm that you are a human being by taking a simple test. It is usually fairly painless; you just have to type in a few numbers obscured in an image. This test is known as a CAPTCHA.

CAPTCHA is short for Completely Automated Public Turing test to tell Computers and Humans Apart. They do an excellent job of distinguishing email sent by a machine from email sent by a human willing to fill out a CAPTCHA test.

Unfortunately that's not always the same as distinguishing spam from wanted email.

Obviously, legitimate messages are sent by machines all the time. I deal with about 4 or 5 customers each week who use CAPTCHA systems. Usually the emails are inquiring why they never received serial numbers for their orders. I've got a theory.

Sometimes the person you're communicating may just not want to go through the hassle.

If this seems unlikely, consider the wary support person who just got a lengthy request from a "problem" customer. They spend 15 minutes typing up a response (which they know will be followed up by several more questions). They immediately get a CAPTCHA request back from your anti-spam service. They were looking for an excuse to just kind of "drop the customer" - they now have it.

"CAPTCHA request? I didn't see a CAPTCHA request. Outlook must've sorted it into my junk folder."

Now, all spam filtering systems make errors. However this is complicated by the fact that most CAPTCHA systems are server-based. That means that users don't always have ready access to messages that were blocked. This is in contrast to client-side products like SpamButcher which make viewing and recovering messages from the desktop easy.

But here's the beautiful irony of it. If someone using a challenge-response system to block junk messages sends someone email who's using a similar product - they may never be able to communicate.

System A sends a CAPTCHA request to System B, which if we're really lucky, sends another CAPTCHA request to System A (and on to infinity). Most systems have checks in place to prevent these kinds of self-destructive loops - but certainly a lot of email is missed.

I'm not claiming these systems are without value. In fact, SpamButcher's free anti-spam tool for webmasters - SpamFreeze makes use of the technology. As they are commonly implemented, they tend to pose some significant problems.

Back