Comparaison of two open source captcha solutions

We have tested two open source captcha to protect web forms against spam, here are our findings.

Please note that we receive no remuneration for this article, which gives a technical analysis by our web consultants of two solutions that meet very specific criteria.

What was our problem ?

Web forms are targeted by (nasty) spammers who have two objectives:

• Broadcast ad contents and links
• Attempt a phishing approach 😱

These practices are harmful and there are two complementary approaches to protect against them:

• Filter forms at web page level by ensuring that it is indeed human beings who are behind the submission of the form: this is the role of captcha.
• Filtering the content sent by the form at server level using an algorithm to detect spam or phishing content: this is the role of an anti-spam tool.

These tools are effective, but have a number of drawback. First of all, most of them compromise the privacy of the data transmitted. Some captcha systems spy on the user’s behaviour to determine whether they are a robot or a human being by tracing their browsing on websites, which induce problems of compliance with user data privacy laws (GDPR). On the other hand, robot detection systems that require users to complete a challenge (such as decoding an illegible number or putting together a puzzle) are obstacles to the user experience, detrimental to site accessibility and sometimes blocking data collection via web forms.

To address this issue, we tested two innovative solutions that met the following criteria:

• did not degrade the user experience
• were accessible, including on mobile phones
• could be hosted on our servers and therefore complied with the RGPD
• open-source projects
• did not impact the speed of forms

Using these criteria, we have excluded tools like Google reCAPTCHA but also hCaptcha and Friendly Captcha because they send user data on their servers.

Comparison of two captcha solutions: Altcha and Mosparo

Altcha and Mosparo both offer a captcha solution that meets our criteria above. Here are the similarities and differences between the two solutions:

• In terms of user experience, accessibility and mobile compatibility, the two solutions are comparable: a simple tick box is used to validate the form.
• It is possible to activate automatic validation (when the form is loaded or when a field is clicked), but this validation mode is too easy for robots to bypass, so we advise against it.
• By playing with the options, you can get rid of the logo and modify the texts in the language of your choice. Altcha lets you adjust the complexity of the captcha resolution, which affects the form validation time and lets you adapt to the available power of your server and your customers.
• Both systems have an efficient and easy-to-use WordPress plugin.
• Both systems are open-source, but the anti-spam part offered by Altcha is not.
• The technical documentation is well done in both cases.

Respect for users’ private data

These two captchas ensure compliance with the RGPD, but in different ways:

• Altcha’s captcha works with a Proof of Work (PoW) system: the client terminal must solve a numerical challenge. It is easy to install on the server used by the site or on another server, because Altcha provides libraries for integrating it into any standard web system. The data does not leave the server and is not stored.
• Mosparo’s captcha is self-hosted on one of your servers. The data is stored in a SQL database on the server. It is encrypted and deleted after 14 days if a batch is run. Here too, the data remains on your servers, ensuring that you are fully compliant with the RGPD.

The differences

→ Robot filtering

Both solutions greatly reduce robot spam. However, both solutions are easy to circumvent, since a simple script enabled us to submit forms in a loop. We would point out that Altcha’s captcha is able to delay submissions considerably and is therefore of considerable interest compared with Mosparo’s captcha, which must work with a honeypot system in order to be effective.

→ The anti-spam filter Altcha offers a sophisticated anti-spam filter solution that can be plugged into your forms in addition to the captcha. However, this service is not open source and has to be paid for. It claims to be RGPD-compliant, but a priori we have no guarantee that it will handle private data.

On the contrary, Mosparo provides a relevant filtering system that goes further than robot moderation. In fact, with this filtering you can intercept a large proportion of phishing emails.

→ Setting up Altcha is very easy to install on the server where the site is hosted, for example via the WordPress plugin, or via the open-source libraries offered by Altcha in your PHP, JS or other project. So you don’t necessarily need an independent server, but you can use one if you want to offload the workload from the servers that power your websites. Altcha provides integration code and a sample server.

Mosparo requires the installation of a LAMP server. Installation is standard and requires fairly limited resources. The advantage is that it can be scaled up without impacting your websites.

→ Business logic Altcha publishes a complete anti-spam, statistics and forms solution, including captcha. The overall solution is presented as RGPD compatible, but only the captcha part is open-source. The server code is licensed under an MIT licence, as is the WordPress plugin, but the other services are chargeable. The business model is freemium.

For information, the anti-spam filter is subscription-based: 200 requests per day free, then €12/month (anti-spam not tested in this audit).

Mosparo, on the other hand, was created in 2021 by Matthias Zobrist, an open-source computer scientist based in Switzerland. The server and plugin code are under MIT licence and the model is definitely open-source, supported by an association (if you want to make a donation, click here). We’d also like to point out that their mosparo.io website doesn’t use any trackers, and we like that! 😻

Points to remember

Both solutions are relevant and it’s not a question of trying to decide which solution is better, but rather in which cases to use which one.

Mosparo is a truly open-source tool, whereas Altcha is a freemium model Altcha works well for small installations, particularly with its highly effective WordPress plugin, but when it comes to integrating Altcha’s captcha libraries into a project, you need to code a backoffice whereas Mosparo provide it. Also Mosparo provides an open source anti-spam filtering solution in addition to the captcha, whereas Altcha’s anti-spam solution is not free (only the captcha is free). Mosparo’s anti-spam filtering requires fairly heavy implementation and maintenance of rules.

Conclusions and outlook

Mosparo captcha is suitable for large-scale architectures. It is a powerful open-source tool includes anti-spam that requires a certain initial investment but can be extended to a whole network of sites to be protected.

Altcha captcha is a good solution for small sites, with its open-source captcha. Its paid-for anti-spam solution seems a good idea but is on the borderline of what is acceptable in terms of compliance with the RGPD. It can also be incorporated into a large-scale development project, with the same limitation as regards the RGPD on the anti-spam part only.

As both systems are open-source, we think it would be worth considering modifying them for your use. For example, introducing a bit of AI into Mosparo would enable better management of filtering rules. Or incorporating Altcha into Mosparo would be an idea worth exploring to combine the advantages of the two solutions.

This work is the result of an audit carried by qodop out for Secours populaire, which has agreed to make the results public and to which we would like to express our thanks.

To find out more about our website audit and web project management services, visit our website or contact us!

If you’d like to find out more about captcha on WordPress, we have a set of publications on captcha and spam on our WordPress blog (french).

The french version of this article is published on qodop’s blog.

Illustration : chatGPT