41–50 of 81 posts
Honest question. What’s wrong with Google Recaptcha V3? No need to select 25 traffic lights. Gives you a score from 0 to 1 so you can decide whether you let them in easily or not.
Two weeks ago my website [0] got hit by a botnet attack. These bots were submitting 2 POST requests to /login, followed by 2 POST requests to /signup, and since there were no checks in place, they were getting in quite easily. All their requests originated from residential IP addresses (probably hacked IoT devices) so IP blocking seemed impossible. I knew I needed to do something, but didn't want to send my users' da…
Very interesting idea (the invisible captcha approach)! Since you are a contributer, can you tell us how efficient this strategy is? I mean, do you still experience advanced bots being able to still act as humans?
Earlier quoted context omitted.
If Google doesn't like a client (e.g. Firefox users) they can just set their score to 0 and break half the internet.
You could say that for any captcha library though.
To the extent that you'd consider non-Google alternatives, there are multiple different CAPTCHA services, and we at NetToolKit recently launched our own version called Shibboleth: https://www.nettoolkit.com/shibboleth/about You can try out demos at https://www.nettoolkit.com/shibboleth/demo While not open-source, the service is very affordable ($10 for 100,000 CAPTCHAs), and clients get to review user submissions to…
Clicking on the buttons with a laptop trackpad was tedious and unintuitive.
It would be nice if I could use the arrow keys (or even WASD) on my keyboard.
Other than that it seems preferable to Google's new image captchas.
> The difficulty of captchas can be so out of balance, that sometimes they seem friendlier to bots than they are to humans. The goal of this project is to improve our experience with captchas, by giving us easy access to solutions already utilized by automated systems.
Earlier quoted context omitted.
Very interesting idea (the invisible captcha approach)! Since you are a contributer, can you tell us how efficient this strategy is? I mean, do you still experience advanced bots being able to still act as humans?
They still try to sign up, but none of them can actually bypass the captcha. I implemented a custom callback that returns a HEAD response with 404 to fool them (because I noticed that attacks intensified when I returned 2xx or 3xx responses).
Earlier quoted context omitted.
> any CAPTCHA custom to a site will be broken very easily if your business takes off. For me, this is an interesting and open question. I've taken the view that as long as it's easier to come up with new types of challenges than it is to create an automated means to solve those challenges, CAPTCHAs offer some protection. If you're ok with requiring JavaScript, mouse input, and images (e.g. you don't require your site…
The problem is coming up with challenges that are not trivial to automate and not annoyingly hard for users. Botters aren't just making passive income, they can fix their bot every day as long as it's making them money. Many sites try "random" questions which are really easy to pattern match with a little regex. The amount of effort that goes into botting generally scales linearly with userbase size (not always). But…
> I think trying to come up with challenges to beat botters would be prohibitively time consuming.
I agree that is challenging, and I think this question will need to be settled empirically. Sub-questions include:
a) What is the threshold for bot operators to engineer custom CAPTCHA solutions? (e.g. for a large website, how much can a bot network make?)
b) Even if it were not possible to conclusively beat the bots, what is the threshold at which bot operators decide that they would rather make their money off of other sites instead?
How do you do this in a world with decent spam filters? By using the victim's email to sign up for real services so they get hit with a welcome email. Because these are real services, spam filter won't catch it. This can only be done with services that have sign up forms that are easily automated.
The most evil thing here is your email is crippled even after the attack is over because these real companies will keep sending you newsletter and it's impossible to unsubscribe to them all.
To the extent that you'd consider non-Google alternatives, there are multiple different CAPTCHA services, and we at NetToolKit recently launched our own version called Shibboleth: https://www.nettoolkit.com/shibboleth/about You can try out demos at https://www.nettoolkit.com/shibboleth/demo While not open-source, the service is very affordable ($10 for 100,000 CAPTCHAs), and clients get to review user submissions to…
Just tried it out. Clicking on the buttons with a laptop trackpad was tedious and unintuitive. It would be nice if I could use the arrow keys (or even WASD) on my keyboard. Other than that it seems preferable to Google's new image captchas.
Honest question. What’s wrong with Google Recaptcha V3? No need to select 25 traffic lights. Gives you a score from 0 to 1 so you can decide whether you let them in easily or not.