Live data from Hacker News

Ask HN: A Good Alternative for ReCaptcha?

news.ycombinator.com

131–140 of 207 posts

Re: Ask HN: A Good Alternative for ReCaptcha?

#131
Unfortunately, there aren't many good captcha systems that don't do the equivalent of what ReCaptcha does, because we're at a point where fingerprinting users is a strong signal to help identify contractors doing captchas on behalf of bots.

Even some silicon valley products use captcha-breaker services. These services present themselves as sophisticated APIs but in reality they're just dispatching work to humans who accept pennies an hour at internet cafes; a competition with Amazon's mechanical turk for digital sweatshops. They're common and cheap and the tech industry feeds them. Undercutting the workforce doing the captcha busting is the only viable way to stop that.

Your real alternative is to do the fingerprinting yourself.

Re: Ask HN: A Good Alternative for ReCaptcha?

#132
For automation I would recommend ratelimiting endpoints. I personally tend to use 5 requests per IP/second along with 100 requests/minute as default and then override specific endpoints to e.g. 1 request per IP/hour.

For user input I recommend keeping the first comment submitted by a new account/IP hidden until you/moderators have approved it, after which new comments from that user no longer needs to be approved before they become visible to other users.

Re: Ask HN: A Good Alternative for ReCaptcha?

#133
post #127

The best solution I've ever come to that didn't negatively impact my clients was generating a UUID on the server via an ajax call 100ms after page load. That UUID was stored in a cookie, and returned via AJAX and stuck it in a hidden field on the form. Server checks cookie != null and cookie == hidden field, and returned a 200 OK regardless of if it failed (used the response text for success or failure indication), a…

So this solution would work because most automated spam would not make AJAX calls? Something like Selenium posing as a real user would bypass this kind of protection wouldn't it ?

It works because most bots do not keep running the javascript after pageload like a real user's browser would.

Re: Ask HN: A Good Alternative for ReCaptcha?

#134
post #71
post #21

I had a strange idea about solving this problem: How about a micro-payment, something like $0.01, instead of solving a puzzle? In that case maybe you won't care if many bots login to your website. I think that I by this time I have the technology to make something like this work, I was wondering if this is a good solution though. What do you think?

You could use JavaScript cryptocurrency mining instead. User clicks a button to activate miner script, it runs in their browser for 10-30 seconds or whatever, then reports back to your server that they are good to go.

You’ll lose people who are blocking this kind of shit. Also you might end up on a Firefox blacklist.

Re: Ask HN: A Good Alternative for ReCaptcha?

#136

Earlier quoted context omitted.

Be very careful how you do this, unless you want to exclude blind users. I've seen a blind user have an online form silently fail at them because they filled in a field that wasn't visible. Using display:none applied indirectly via CSS is probably reasonably effective against bots and won't interfere with screen-readers.

Are there tools or guides to help test how websites "appear" to people with disabilities ? It is difficult to design something if you don't have an idea of what will be the outcome, but I wouldn't know which software is used by (e.g.) a blind user, let alone how I would use it.

You can switch any iPhone to accessibility mode. Those with vision impairments love their iPhone because generally "it just works"

Re: Ask HN: A Good Alternative for ReCaptcha?

#137
A commenter on HN some years ago claimed a 100% success rate at blocking spam by requiring all web form submissions to be cryptographically signed. This solution struck me as stunningly elegant both by raising the standard for constructive feedback and promoting public awareness of secure communication.

Re: Ask HN: A Good Alternative for ReCaptcha?

#139

The best solution I've ever come to that didn't negatively impact my clients was generating a UUID on the server via an ajax call 100ms after page load. That UUID was stored in a cookie, and returned via AJAX and stuck it in a hidden field on the form. Server checks cookie != null and cookie == hidden field, and returned a 200 OK regardless of if it failed (used the response text for success or failure indication), a…

I was thinking to roll my own cookie solution as well, but this makes the form submissions impossible on multiple tabs.

Re: Ask HN: A Good Alternative for ReCaptcha?

#140

Simplest way is to use filtering. ``` (defparameter spam-words '("viagra" "cialis" "v1agra" "c1alis" "tamadol" "hydrocodome" "doxycyline" "prozac" "prozca" "prizac" "doxycyclins" "anx8ety" "amytriptylone" "poker" "laxative" "anatrim" "breast" "penis" "fiorinal" "sexy" "kaspersky" "hoodia" "thyroid" "coupon.com" "vuitton" "coupon" "fetish" "famotidine" "footwear" "sweetwater" "sunglasses" "ninja" "www" "http" "cheap3d…

If HN had this filter, you wouldn't be able to submit this comment.
Post reply on HN