« Beware of Spam from the Armed Forces Bank | Main | Trackback Spammers Have a New Trick »

January 19, 2006

Blogging Hell - Using TypeKey for Movable Type Authentication

by Ferdinand T Cat

Comment spam continues to be a problem in the blogosphere. Many of us hope for the day when there's a reliable way to tell the difference between a real person and a zombie computer trying to publicize a site that sells fake watches of the sort you'd use to impress people while buying prescription drugs at an online casino. Several years ago, Movable Type came up with the TypeKey system. TypeKey enables you to maintain an identity on the Movable Type servers. Registration is free, and Movable Type works tirelessly in the background to keep spammers off the service. The interface for TypeKey is an open standard so that other blog providers can use it.

Unfortunately, TypeKey never caught on, and only Movable Type software supports it. Nonetheless, if you have a Movable Type blog, turning on TypeKey is one way to stem the flow of spam. If you decide to do that, then you will have an idea as to why nobody else uses TypeKey: it's a pain in the neck to install.

In order to use TypeKey, you need to get an TypeKey token, which means you have to have a TypeKey account. The token is displayed on your TypeKey Account Preferences page. A single token will work on up to five blogs. Just list the top-level URL of each of your blogs on the TypeKey Account Preferences page, then put the TypeKey token in the Authentication Key slot of the Feedback Settings page of the blog settings. This forges the link between TypeKey and your blog, but it does not actually make TypeKey work.

Every new release of Movable Type has changed the way TypeKey works. If you got TypeKey working with your 6.1 system, it will still work with your 6.2 system, but your 6.1 templates will not integrate fully with the anti-spam features of 6.2, and if you try to do something clever or nonstandard (like using a CAPTCHA code) it will fail mysteriously.

If TypeKey is correctly installed in your 6.2 templates, then a user who comments using TypeKey will completely bypass all of the anti-spam code. Bruce found this out the hard way when he was testing our custom anti-spam system.

The easiest way yo get TypeKey to integrate into the comment system is to use the absolute vanilla Individual Archive and Site JavaScript templates. If you started blogging before 6.2, chances are you don't even have a Site JavaScript template, and an attempt to use the vanilla Individual Archive template will lead to chaos. To create the Site JavaScript template or get back the original Individual Archive template, you need to use the Template Backup and Refresh plugin. This plugin comes standard with 6.2. To access it, go to the Templates page, check the templates you want to refresh, select Refresh Templates in the More Actions dropdown box and click Go. You will then probably need some time to fix the look and feel of your Individual Archive template. Fortunately, Movable Type makes a backup of the old template you can use to copy and paste.

Now, here's the real tricky part: even if you've got vanilla templates and everything is standard issue, the key files that manage TypeKey are templates. The templates are full of all sorts of if-then-else logic. That if-then-else logic is not written in JavaScript or PHP: it's written in the Movable Type template language. What all this means is that the TypeKey stuff will not work until all of your Individual Archive and Index pages are rebuilt. This includes the Site JavaScript template! The JavaScript code changes depending on whether TypeKey is required or optional and whether or not a comment that is not authenticated is moderated or junked.

Finally, I've noticed that when Bruce is working on this stuff he spends a lot of time petting me and feeding me snacks. Of course, it's not practical for any of you to feed me snacks while you're updating your blog templates, but just in case you should consider mailing me some bags of those Cheetos Curls things, or a grocery coupon for any of Sargento's Shredded Cheese products. If it makes a difference for Bruce, then it makes sense it would help you, too.

Respectfully submitted,

Ferdinand T. Cat


# At Thu 8:28 PM | Permalink | Trackback URI | Comments (3) | More Blogging Hell

Trackback Pings

Comments

I've also noticed frequent "hangs" posting comments with MT blogs using Typekey authentication. It's browser-independant and pretty consistent.

I do like your "anti-spammer codes" since, so far, they've all been words I use a lot, and so very easy to type, like the one for this comment, "ijaazpi". Why, I was just soaking in my ijaazpi last night!


Posted by: David at January 20, 2006 9:08 AM

This has been an issue for the yaks as well, and is one of the reasons we don't permit comments (the other being some of the weirdos who frequent our site and the knowledge that children may be watching). We operate with a .php system and the comment plugins don't work all that well with it. Figures we'd use an odd system, doesn't it?

Incidentally: tag. Ferdy or Bruce - Adam meme'd us, so we thought we'd return the favor. It's at the Yak.


Posted by: The Random Yak at January 20, 2006 12:28 PM

I can honestly say that I have not really had any problems with my blog (MT 3.2) and TypeKey... Granted, I do not have very many commenters besides myself, but my test runs did not really indicate any problems. Of course, it is probably just that my site is un-complex enough that it does not break things :).


Posted by: Linoge at January 21, 2006 4:53 PM

HTML is not allowed in comments; however, if you put in a raw URL (http://www.somewhere.com/page.html) it will automatically be converted to a link.. Also, it is likely your comment will not appear unless you refresh the page manually after posting it.

Post a comment