Ask HN: reCaptcha isn't stopping spam, what should I do? • Hacker News Board

Re: Ask HN: reCaptcha isn't stopping spam, what should I do?

#21

Post by Prefinem » Thu, Aug 29, 2013, 1:12 PM UTC

hashtree wrote: post #15

One time tested approach for me is to very precisely measure how long the fastest human could fill out a specific form in ms (must be done per form, and must consider browser autofilling). Then, include an encrypted timestamp value as a hidden field value on said form and check that: 1) The form was recently submitted (i.e. you cannot submit forms from two hours ago). Done well with another approach I take, this also…

I was thinking about this, but the form submission could honestly take less than a second by a person since all you have to do is type a comment. (Thinking of someone posting 'lol') to code. I have had users complain when they can't post fast enough (generally when two or more are in a vivid discussion) and always end up turning off the "wait between posts" check for forums like vB, xF, phpBB, etc..

Do bots submit instantly? Would just inserting a timestamp with javascript fix it?

Re: Ask HN: reCaptcha isn't stopping spam, what should I do?

#22

Post by Prefinem » Thu, Aug 29, 2013, 1:14 PM UTC

Misiek wrote: post #17

You can change an action of the form using Javascript (ie. http://stackoverflow.com/questions/2701041/how-to-set-form-a... ). Spam robots don't emulate Javascript. Users with no Javascript will see the message "This action requires Javascript".

The problem is you would lose the ability for users to post this way. Seems strange to cut out a percentage (albeit probably very small) of users to stop spam

Re: Ask HN: reCaptcha isn't stopping spam, what should I do?

#23

Post by hashtree » Thu, Aug 29, 2013, 3:19 PM UTC

Prefinem wrote: post #21

hashtree wrote: post #15

One time tested approach for me is to very precisely measure how long the fastest human could fill out a specific form in ms (must be done per form, and must consider browser autofilling). Then, include an encrypted timestamp value as a hidden field value on said form and check that: 1) The form was recently submitted (i.e. you cannot submit forms from two hours ago). Done well with another approach I take, this also…

I was thinking about this, but the form submission could honestly take less than a second by a person since all you have to do is type a comment. (Thinking of someone posting 'lol') to code. I have had users complain when they can't post fast enough (generally when two or more are in a vivid discussion) and always end up turning off the "wait between posts" check for forums like vB, xF, phpBB, etc.. Do bots submit in…

It has worked for me with forms that take less than 1000ms. For simple one field forms, they typically have a reasonable length requirement on my platforms (e.g. 32 characters). Things that fit in less than that length are typically things that should be tags (e.g. funny, insightful, etc). Trying this 32 char minimum myself just typing jibberish gets me over the minimum needed time to detect bots.

Re: Ask HN: reCaptcha isn't stopping spam, what should I do?

#24

Post by Prefinem » Fri, Aug 30, 2013, 12:22 AM UTC

hashtree wrote: post #23

Prefinem wrote: post #21

Earlier quoted context omitted.

I was thinking about this, but the form submission could honestly take less than a second by a person since all you have to do is type a comment. (Thinking of someone posting 'lol') to code. I have had users complain when they can't post fast enough (generally when two or more are in a vivid discussion) and always end up turning off the "wait between posts" check for forums like vB, xF, phpBB, etc.. Do bots submit in…

It has worked for me with forms that take less than 1000ms. For simple one field forms, they typically have a reasonable length requirement on my platforms (e.g. 32 characters). Things that fit in less than that length are typically things that should be tags (e.g. funny, insightful, etc). Trying this 32 char minimum myself just typing jibberish gets me over the minimum needed time to detect bots.

I see... that makes sense... I will have to check with some of my user base and see how they feel about this