I upgraded to hashcash 3.2. I hope that will stop the new wave of spam I had on this blog. When you’re upgrading yourself, note that now wp-hashcash resides in its own subdirectory in the plugins folder, I didn’t notice that and couldn’t find what was wrong until I noticed the ‘/wp-hashcash/’ bit in the source.
By the way, happy new year!
Spam, again on this blog.
It seems those nasty spammers are now using actual people (or an automated browser) to post spam comments, subverting the protection wp-hashcash delivers.
Luckily it are only about two per day, which is very managable, but still annoying.
Like DRM and most other copyright protections, SPAM protection is inherently insecure, for the original openess required to allow a not-spammer to use them is, well, too open.
One interesting thing is that we can fight back now that they are using full javascript VM’s. Matching the spam-ip and letting it execute a rather ‘memory inefficient’ little program would certainly make me smile.
A new anti-wordpress-spam release of Elliott Back: HashCash 3.0.
Basicly it uses md5, javascript and a bit of AJAX, which is very hard to force except when a spam bot executes the actual javascript.Basicaly it just keeps an “undecipherable†secret which in theory you’d need javascript to decode. The problem with that is that it takes some time to execute the javascript and hopefully will scare the spambot away.
The method isn’t intrusive (although it does require javascript to be turned on), and pretty effective.
Good work Elliot!
I noticed I had an enourmous amount of spam in my moderation queue.
The plugin I used to protect myself from spam wp-hashcash, seemed to have been mastered by spammers.
A download of the newest version did the trick.
If anyone experiences problems with posting comments, please mail me.
Update I: Seems some spam prevailed even over this version. I’d better get to making my own custom changes to wp-hashcsah.
Update II: I changed the secret codes in the plugin. And I broke it for a while. Either one of those could have resulted in the fortunate (hopefully not temporarilly) stop of spam.
Update III: According to Elliot Back, the creator of hashcash, the spammers bruteforce the secret value. Changing it usually is efficient enough to keep them at bay for a while. He’s working on a newer version which features bigger, thus harder to bruteforce values. I just hope they won’t suck my bandwidth too much.
Update IV: Unfortunately there seems to be a lot of computing power or a hack behind the breaking of the hashcash security -_-, I keep getting spam :-/
I just installed Hash Cash, which is an anti spam plugin for WordPress.
Hash Cash protects this blog from spam by requiring the client to execute javascript which calculates a checksum of the content from a seed which is very hard to extract.
Since I installed it I haven’t got any spam comments :-).
The downside is that it disallows anyone who hasn’t got a javascript enabled browser to post a comment.
Now I still need to get some good means to combat trackback spam. Just putting them under moderation isn’t good enough for they keep coming