Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Do we need Google captcha?

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 81 posts

Re: Ask HN: Do we need Google captcha?

#11

Post by Kaveren »

luizfzs wrote: post #2

It's worse than that. It fingerprints the browser, the OS, and a ton of other stuff. I'd love to see a solution that's privacy-friendly.

not possible because anything based off computation only wards off denial of service attacks, not bots which usually have too much profit.

the absolute best you could do is track on the site itself without google, but you still need to track user's data.

anything else you can think of can be beaten pretty easily or is going to really hurt your user experience to the point of severe loss of revenue

any CAPTCHA custom to a site will be broken very easily if your business takes off.

Re: Ask HN: Do we need Google captcha?

#13

Post by phyzome »

My general answer is "no". But the question also isn't meaningful unless you define what it is you're trying to protect.

(E.g. maybe it's reasonable to have a captcha of some sort for account creation, with fallback to a human-involved process. But if you're trying to prevent credential-stuffing on a login form, the correct approach is using the Pwned Passwords dataset and/or cooloffs.)

Re: Ask HN: Do we need Google captcha?

#14

Post by Kaveren »

floatboth wrote: post #8

> Isn't there a better way to fight bots? Don't? I mean, what are you trying to protect? If it's account registrations, shouldn't an email confirmation be enough?

why would an email confirmation be enough? playing whack-a-mole all day with different domains is unreasonable. whitelist only of domains is awful, and botters have tons of popular email accounts.

Re: Ask HN: Do we need Google captcha?

#15

Post by NetToolKit »

raverbashing wrote: post #5
NetToolKit wrote: post #3

To the extent that you'd consider non-Google alternatives, there are multiple different CAPTCHA services, and we at NetToolKit recently launched our own version called Shibboleth: https://www.nettoolkit.com/shibboleth/about You can try out demos at https://www.nettoolkit.com/shibboleth/demo While not open-source, the service is very affordable ($10 for 100,000 CAPTCHAs), and clients get to review user submissions to…

The maze one is interesting, but it seems it can be frustrating (because it didn't enforce walls when I tried, though I can see why it might do that)

Yes, the concern is that since browsers interpret the end-user code, if it has knowledge of the walls (required to enforce them), bot networks might be able to use the JavaScript code to figure out the correct solution in an automated fashion.

Re: Ask HN: Do we need Google captcha?

#16

Post by jmstfv »

Two weeks ago my website [0] got hit by a botnet attack. These bots were submitting 2 POST requests to /login, followed by 2 POST requests to /signup, and since there were no checks in place, they were getting in quite easily. All their requests originated from residential IP addresses (probably hacked IoT devices) so IP blocking seemed impossible. I knew I needed to do something, but didn't want to send my users' data to Google.

I settled on implementing a honeypot technique using invisible_captcha gem [1]. It uses multiple techniques to detect bot activity, such as checking if the form was submitted too fast, hidden form attribute only visible by bots but not humans, etc...

Luckily for me, these bots weren't quite sophisticated so I managed to clamp down on their activity. I still get a couple of bogus signup attempts every day.

Disclosure: I am a contributor to the invisible_captcha gem

[0] https://tryhexadecimal.com

[1] https://github.com/markets/invisible_captcha

EDIT: grammar and wording

Re: Ask HN: Do we need Google captcha?

#17

Post by peterangular »

floatboth wrote: post #8

> Isn't there a better way to fight bots? Don't? I mean, what are you trying to protect? If it's account registrations, shouldn't an email confirmation be enough?

> If it's account registrations, shouldn't an email confirmation be enough?

This won't stop someone with enough sophistication.

Re: Ask HN: Do we need Google captcha?

#19

Post by eyegor »

spiderfarmer wrote: post #9

My problem with Google Captcha is that I have to solve the "select all" window every time I check the checkbox, even when I'm logged in to Google. Maybe it's because I use Safari, but it's getting really annoying. What's the benefit of Google Captcha if you have to solve the captcha every time?

That's what they show if you're not on chrome, especially if you're blocking scripts or on a VPN.
Post reply on HN