use image verification for private messaging?

[jeremycs]

I would like to be able to have users pass image verification if they wish to send a private message. Is option included in Vbulletin somewhere?

[Andy Huang]

Unfortunetly not, is someone doing mass PM spam on your forum? You can restrict how long the users must wait before sending new PM via Admin CP > vBulletin Options > Private Messaging Options, which typically slows the spammer down a whole lot. You can also limit how many persons at a time they can send PM to via Admin CP > Usergroups > Usergroup Manager > Edit the group you want > Private Message Permissions, so they cannot send spam to multiple people at once.

[jeremycs]

That wouldn't do anything.

That would just force them to do a drawn out time delayed spam.

They could still spam everyone on your board, pretty easily in fact.


The easiest solution would be to require image verification for private messaging.


I wonder why the VB team hasn't made this as an option yet.

[Andy Huang]

Image Verification:
Enter 5 receipiants names (default value?) - 30 seconds
Copy + Paste message (spam body) - 5 seconds
Recognization + type image verification - 10 seconds
Total: 45 seconds per 5 message

Delay + Limit:
Enter 1 receipiant - 6 seconds (estimate)
Copy + Paste message (spam body) - 5 seconds
Delay n duration, typically 30 seconds is a good value - you decide
Total: 11 + n seconds per 1 receipiant (for arguments sake, 30 seconds)

45 seconds per 5 receipiants VS 41 seconds per 1 receipiant.

My 2 cents? It is a whole lot more efficient than image verification.

Also, if you had image verification on register, there wouldn't be a need for the pm part to be checked again. This does not goes to say that image verification is secure though... In fact, there's already at least one bot that we're aware of that can bypass image verification. This was brought to our attention in a very recent thread. To date, there is no method that I am aware of to prevent this. The delay will -- at lest -- massively slow the bot down, where as verification won't do anything to stop it...

Best practice that I've seen is to use the throttled registration process. Enable image verification for registration and enable email verification to weed out bots; edit registered user group to be something limitive (IE: no PM, all posts moderated etc.); setup promotion to promote user to a more unrestricted group after a fixed small amount of posts that you approve (promotions are done automatically, you just need to approve their posts). This way they cannot spam anyone via any channel until they're deemed 'useful'

The way I personally see it, it'd be too troublesom to have to do image verification for each PM... and I'm sure same goes for a lot of people. But, I suppose we could be wrong. Perhaps you can request a hack for this on vbulletin.org or file a feature request under the suggestion's forum