In addition to working on potential solutions to referrer log spam, I’ve been investigating the problem of comment spam, with a view to producing a plugin for Textpattern when the inevitable happens.

My goal is to implement a comment spam blocker that is stand-alone and automated. That means it can’t rely on moderation, keyword lists or blacklists.

The plan was to use a series of hurdles designed to stop automated submission scripts, but allow real web browsers with human users to pass. The hurdles would include an extension of the nonce system already employed by Textpattern; a simple javascript-based proof of work; and (where javascript is unavailable) a visual CAPTCHA.

I’ve been aware of Captchas for a while. I studied AI at university, so I know first hand how difficult it can be for a machine to solve a turing test. Fraudsters have been using OCR-based crackers to break the Captchas used by large, rich targets like Ebay for some time now; but Captchas have been getting progressively better, and multi-word Captchas can probably be tailored to reduce automated exploits to a manageable level for most purposes.

Unfortunately, it turns out a very clever hacker discovered a virtually infallible way of breaking Captchas without resorting to an AI arms race: by copying the image and presenting it as a Captcha on a bogus ‘free porn’ web site. An unsuspecting human solves the problem for them, and the spammers return the answer to the original site. There are no shortage of people seeking free porn, so it’s done very quickly.

The “free porn” method can be used to break any Captcha, not just visual ones. It doesn’t matter how cleverly designed or how hard it is for a computer to solve; if a human can use it, it’s broken².

In fact, the attack isn’t limited only to Captchas. It could probably be used with any proof-of-work system, like the Hashcash-style methods that are starting to emerge. The spammers simply copy the problem, present it on their bogus porn site, let someone else do the work, then relay the results back to the original site.

A related problem is commonly considered in cryptography: the man in the middle attack, in which an adversary intercepts, modifies and relays messages between two systems. Most cryptographic solutions use some form of public-key authentication, which typically relies on a trusted third party or web of trust.

Secure proof-of-work systems like Hashcash for email use server authentication to eliminate MITM replay attacks. A Hashcash client ensures that the token it generates is valid only for the email host it intends to communicate with. That’s not possible in a web application, because the client doesn’t run trusted code. The bad guys can simply serve up their own Javascript that calculates a token for their target, and the user won’t know any different.

Back in the blogosphere, the trusted third party approach is exactly the one used by Sixapart to tackle MovableType comment spam: Typekey. A proof-of-identity authentication system may in fact be the only other alternative to proof-of-work challenges.

Now comes the disheartening realisation.

If I’m right, and proof-of-work challenges are ultimately unworkable for comment spam, then authentication systems (centralized or otherwise) are also broken. After all, spammers can simply sign up for a throwaway account, use it until it gets blacklisted, then sign up for another. So how does an authentication system like Typekey prevent spammers from automatically signing up for multiple accounts?

Captchas.

Any authentication system that attempts to prevent spam based on comment authors’ identity will suffer the same problem. The only way to slow spammers from signing up for many throwaway accounts is to use a proof-of-work challenge, a method that we already know is broken, or at least doomed. Indeed, concentrating the point of attack in a single place (the registration page) probably makes the spammers job easier, since they don’t need to worry about different kinds of captcha and proof-of-work challenges in use on different blogs.

It doesn’t really make any difference whether the authentication system is centralized, like Typekey, or distributed, like Identity Commons. That’s just an implementation detail that determines where the database of identities is stored. The problem is that the only thing an identity authentication scheme proves is that someone registered using that particular login name or email address. And knowing someone’s name or pseudonym doesn’t solve the security problem we have, because we don’t know who the spammers are. Proof of identity doesn’t help us determine someone’s intentions, which is exactly what we need to know in order to decide whether or not to allow them to post a comment.

The only solution I can see at present¹ is an authentication system based not on the idea of identity, but on reputation. A web of trust: I know the user who authenticates herself as so-and-so is an acceptable risk, because 27 other people I trust vouch for her. It reduces to a different kind of proof-of-work; one that can’t be delegated to an unsuspecting porn seeker, because it involves convincing a bunch of people that you are trustworthy.

Unlike Ebay’s reputation system, which is based on the notion of an absolute, global measure of trustworthiness for each person, a Web of Trust uses a relative measure of trust. Creating a bunch of bogus identities in order to artificially inflate someone’s score won’t work, because what matters is not how many people vouch for them, but who endorses them. Ebay (and Google’s Pagerank) answers the question, “what is this person’s relationship to the population in general?”. A web of trust is quite different; it answers the question, “what is this person’s relationship to me?”.

Fortunately, the blogosphere already has its own web of trust mechanism. It’s called a blogroll.
—-

¹ Other than a centralized system that charges a fee for registering identities, or attempts to use “official” ID papers to map online identities to meatspace persons – both of which have been tried unsuccessfully in the past, and both of which create all sorts of privacy and security problems.

² As several people have pointed out in comments, there’s another reason to consider Captchas broken: accessibility problems. I haven’t covered those issues here because they’re well documented elsewhere.