Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: A Good Alternative for ReCaptcha?

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 207 posts

Re: Ask HN: A Good Alternative for ReCaptcha?

#61

Post by colinbartlett »

tpetry wrote: post #32

For bots which are not specifically targeted at your page i simply add an invisible form element named url. Bots _LOVE_ to share their viagra urls. Any request which submitted an url is discarded. This trick is simple stupid and should not work but somehow the simple spam bots have not improved. This does not work for sophisticated bots (never met one) or the ones programmed specifically for your site (happens very r…

If you work in the Ruby ecosystem at all, there is a gem called invisible_captcha that does just this. It beat back most of the bot signups we were getting, though some still slip through occasionally.

https://github.com/markets/invisible_captcha

Re: Ask HN: A Good Alternative for ReCaptcha?

#62

Post by SquareWheel »

corobo wrote: post #58
willio58 wrote: post #57

Earlier quoted context omitted.

This is simple form of a honeypot but it is really ineffective. Any bot with even minimal sophistication will know to leave the hidden field empty.

You hide it with CSS, not type='hidden'

It really doesn't matter. display:none or position:absolute;left:-1000px makes little difference. Honey pots only catch a small number of bots.

Re: Ask HN: A Good Alternative for ReCaptcha?

#63

Post by alexpapworth »

colinbartlett wrote: post #61
tpetry wrote: post #32

For bots which are not specifically targeted at your page i simply add an invisible form element named url. Bots _LOVE_ to share their viagra urls. Any request which submitted an url is discarded. This trick is simple stupid and should not work but somehow the simple spam bots have not improved. This does not work for sophisticated bots (never met one) or the ones programmed specifically for your site (happens very r…

If you work in the Ruby ecosystem at all, there is a gem called invisible_captcha that does just this. It beat back most of the bot signups we were getting, though some still slip through occasionally. https://github.com/markets/invisible_captcha

Awesome! Love a good Ruby solution. Please keep these coming :)

Re: Ask HN: A Good Alternative for ReCaptcha?

#64

Post by zbaylin »

no_gravity wrote: post #17

I think it is best to design your own captcha around your use case. All you need to do is make the amount of work for spammers too high for targeting your site. Just recently, I added the idea of a captcha that might actually be enjoyable for users to my list of "things that should exist": http://www.gibney.de/things_that_should_exist The idea is to show the user a random image and ask what is on it. If the image is…

PassThePopcorn has a similar CAPTCHA-like implementation to the Pexels one you mentioned in your article. It has a repository of movie posters (which I think are user submitted to the movies themselves), one of which is chosen and the user is asked what movie the poster is for. I've always thought of that as an "enjoyable" CAPTCHA.

Re: Ask HN: A Good Alternative for ReCaptcha?

#65

Post by mikojan »

corobo wrote: post #58
willio58 wrote: post #57

Earlier quoted context omitted.

This is simple form of a honeypot but it is really ineffective. Any bot with even minimal sophistication will know to leave the hidden field empty.

You hide it with CSS, not type='hidden'

So now you're filtering out bots and people with disabilities?

Re: Ask HN: A Good Alternative for ReCaptcha?

#66

Post by sjamaan »

jedberg wrote: post #19

There was a good podcast about this [0] just a couple weeks ago. They interviewed the guy who invented CAPTCHA as well as the head engineer on ReCaptcha v3. The gist of it was that in a few years, all Captchas will be useless because machine learning is too easy and cheap. The only way to defeat spam will be to use reCaptcha v3 or something like it, because those services will use what they know about you to determin…

> those services will use what they know about you

This is inherently user-hostile, as it presupposes tracking and identification. I don't want them to know anything about me!

Re: Ask HN: A Good Alternative for ReCaptcha?

#69

Post by ChrisSD »

mpol wrote: post #52
avian wrote: post #43

Earlier quoted context omitted.

> The only "risk" is that in the future spammers might start using more sophisticated spambots You’re also making your website unusable for people with Javascript blocked or disabled in their browsers.

In the context of the question, that is not relevant. reCAPTCHA requires JavaScript as well. The question is about an alternative to reCAPTCHA. Both methods use JavaScript. I do understand where you are coming from though. And I also think this alternative is better in this regard. reCAPTCHA loads JavaScript from a third-party domain. With JavaScript spamfilters you are loading them from the first-party domain.

reCaptcha has a noscript alternative with iframes and checkboxes. Once completed you have to manually copy an authorisation string to a field and submit it.

Re: Ask HN: A Good Alternative for ReCaptcha?

#70

Post by corobo »

SquareWheel wrote: post #62
corobo wrote: post #58

Earlier quoted context omitted.

You hide it with CSS, not type='hidden'

It really doesn't matter. display:none or position:absolute;left:-1000px makes little difference. Honey pots only catch a small number of bots.

I only have anecdata of course but so far I've had a 100% success rate. I imagine this will come down eventually but for the past ~year or so it's been working fine to just hide the honeypot field with CSS
Post reply on HN