Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: A Good Alternative for ReCaptcha?

news.ycombinator.com

Post reply on HN
Print view View original

101–110 of 207 posts

Re: Ask HN: A Good Alternative for ReCaptcha?

#101

Post by corobo »

kaybe wrote: post #90
corobo wrote: post #77

Earlier quoted context omitted.

Unfortunately I've not given thought to people with disabilities in this case. It's an oversight and that's on me. I wonder if bots are smart enough to figure out aria-hidden="true". Possibly empty it out using javascript on submit. I would guess a bot not using CSS would also not be using javascript? Unsure, would need testing.

Could we just tell the people with screen readers to ignore it?

As a fallback I imagine so yeah. I'm trying to think about what would be going on at the time, wondering if unexpected instructions inside a form would be confusing.

Disclaimer: I don't know how a screenreader would present this, example only

"Form entry. Input name. Input email. Ignore this field it's for spambots. Input url. Submit" -- In this case does the message more naturally apply to email or url? I'd imagine there'd be a pause after input email (to wait for the input)? I need to set up a screen reader :)

Re: Ask HN: A Good Alternative for ReCaptcha?

#102

Post by y4mi »

kqr wrote: post #98
mrighele wrote: post #96

Earlier quoted context omitted.

Are there tools or guides to help test how websites "appear" to people with disabilities ? It is difficult to design something if you don't have an idea of what will be the outcome, but I wouldn't know which software is used by (e.g.) a blind user, let alone how I would use it.

I couldn't find anything like it, which surprises me. It should be in the interest of companies selling screenreaders that the web is accessible with them. Creating a service where you can submit a link and it shows you a textual representation of how the screenreader sees the page would be immensely useful.

uh, there are a lot of services that do automated scans. These obviously arent completely failsafe, but still give an indicator.

just google relevant keywords https://www.google.com/search?q=accessibility+scan+website

and if you want the full experience: just enable the screen reader and try to use your website with it.

/edit: and i almost forgot: chromes build-in Audit tool in the Developer Panel includes some Accessibility tests as well

Re: Ask HN: A Good Alternative for ReCaptcha?

#103

Post by Nextgrid »

dewey wrote: post #9
Nextgrid wrote: post #2

> It has come to a point that traditional text/sound captcha challenges are trivial to bypass today I have yet to see a general-purpose tool to which you can throw any text captcha and it’ll solve it. Just because there are academic papers that demonstrated it once doesn’t mean there’s still a huge barrier to entry in implementing this solution (which spammers won’t do as long as it’s easier to move onto another targ…

https://github.com/dessant/buster What about this one?

Does it actually work? Speech recognition is often terrible enough in normal conditions, so I don't expect it working well on audio captchas which are often designed to counteract speech recognition.

Re: Ask HN: A Good Alternative for ReCaptcha?

#105

Post by oauea »

ghusbands wrote: post #84
colinbartlett wrote: post #61

Earlier quoted context omitted.

If you work in the Ruby ecosystem at all, there is a gem called invisible_captcha that does just this. It beat back most of the bot signups we were getting, though some still slip through occasionally. https://github.com/markets/invisible_captcha

Note that that library is not accessible and is hence illegal to use for most websites in the US. I've raised an issue on the project [1]. [1] https://github.com/markets/invisible_captcha/issues/52

Blind people are basically bots. If they're not viewing and interacting with the screen it's hard to tell the difference.

Re: Ask HN: A Good Alternative for ReCaptcha?

#106

Post by benburleson »

ghusbands wrote: post #84
colinbartlett wrote: post #61

Earlier quoted context omitted.

If you work in the Ruby ecosystem at all, there is a gem called invisible_captcha that does just this. It beat back most of the bot signups we were getting, though some still slip through occasionally. https://github.com/markets/invisible_captcha

Note that that library is not accessible and is hence illegal to use for most websites in the US. I've raised an issue on the project [1]. [1] https://github.com/markets/invisible_captcha/issues/52

Whoa, it is actually illegal to make "not accessible" websites?

Re: Ask HN: A Good Alternative for ReCaptcha?

#107

Post by viceroyalbean »

zbaylin wrote: post #64
no_gravity wrote: post #17

I think it is best to design your own captcha around your use case. All you need to do is make the amount of work for spammers too high for targeting your site. Just recently, I added the idea of a captcha that might actually be enjoyable for users to my list of "things that should exist": http://www.gibney.de/things_that_should_exist The idea is to show the user a random image and ask what is on it. If the image is…

PassThePopcorn has a similar CAPTCHA-like implementation to the Pexels one you mentioned in your article. It has a repository of movie posters (which I think are user submitted to the movies themselves), one of which is chosen and the user is asked what movie the poster is for. I've always thought of that as an "enjoyable" CAPTCHA.

GazelleGames does that with game covers. Lichess has one where you need to find a checkmate in one move. It's usually pretty easy, but could in theory be frustrating for someone just starting with chess.

Re: Ask HN: A Good Alternative for ReCaptcha?

#108

Post by NotPaidToPost »

ghusbands wrote: post #79
tpetry wrote: post #32

For bots which are not specifically targeted at your page i simply add an invisible form element named url. Bots _LOVE_ to share their viagra urls. Any request which submitted an url is discarded. This trick is simple stupid and should not work but somehow the simple spam bots have not improved. This does not work for sophisticated bots (never met one) or the ones programmed specifically for your site (happens very r…

Be very careful how you do this, unless you want to exclude blind users. I've seen a blind user have an online form silently fail at them because they filled in a field that wasn't visible. Using display:none applied indirectly via CSS is probably reasonably effective against bots and won't interfere with screen-readers.

On the face of it this looks like an issue with screen-readers reading the page simplistically.

An element that is not displayed should not be 'displayed' by screen-readers either.

Re: Ask HN: A Good Alternative for ReCaptcha?

#109

Post by xioxox »

no_gravity wrote: post #17

I think it is best to design your own captcha around your use case. All you need to do is make the amount of work for spammers too high for targeting your site. Just recently, I added the idea of a captcha that might actually be enjoyable for users to my list of "things that should exist": http://www.gibney.de/things_that_should_exist The idea is to show the user a random image and ask what is on it. If the image is…

I had one of those answer a question boxes on my MoinMoin wiki. It was something like, "Enter an element which combines with oxygen to form CO2". The spammers worked their way round that pretty quickly. There must be humans who are working on helping the bots.

Re: Ask HN: A Good Alternative for ReCaptcha?

#110

Post by awinder »

> nobody in their right mind should add a script that fingerprints users

I helped vendor-select and lead implementation on a fraud solution that was an integration with SiftScience (yc-funded, https://sift.com/), which relies on fingerprinting. This was years ago but I still think about the project and how it plays with user privacy etc. I will say that -- fingerprinting as a component in fraud management is/can be highly effective.

The problem is, once you get into payments fraud through bots, I think the conversation becomes way more nuanced. If you're looking for a solution to bots spamming or throwing bad data into your app, maybe that's a little extreme. But if the choice between privacy and becoming a front for credit card fraud and chargebacks, you're in a choice between who the victims of your service are going to be, and how much ill is done.

Post reply on HN