Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Do we need Google captcha?

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 81 posts

Re: Ask HN: Do we need Google captcha?

#71

Post by jazoom »

zawerf wrote: post #48

CAPTCHA isn't just a matter of protecting your site. One of the most evil attacks nowadays is "Distributed Spam Distraction", where you spam your victim with thousands of emails per second so an important email (e.g., fraudulent purchases) gets lost in the noise. How do you do this in a world with decent spam filters? By using the victim's email to sign up for real services so they get hit with a welcome email. Becau…

You've just reminded me I really need to use unique email addresses for each service.

Re: Ask HN: Do we need Google captcha?

#72

Post by shakna »

Master_Odin wrote: post #67
jmstfv wrote: post #54

Earlier quoted context omitted.

The easiest way to start would be introducing an invisible form field [0] and on submission, checking if it is not empty. Give this form field a random name so that it wouldn't be populated by password managers. You can take it one step further and check how fast the form was submitted. If it is below the predefined threshold, it is probably a bot. [0] To hide the form field, you can use one of these snippets, interc…

It should be stated that you should either use the first approach (display none) or give a 0 height/width, so that screen readers don't pick up these fake fields and ruin accessibility on your form.

There's also aria-hidden to prevent screen readers from touching the honeypot field.

Re: Ask HN: Do we need Google captcha?

#73

Post by majewsky »

fractalf wrote: post #40
Kaveren wrote: post #29

Earlier quoted context omitted.

The problem is coming up with challenges that are not trivial to automate and not annoyingly hard for users. Botters aren't just making passive income, they can fix their bot every day as long as it's making them money. Many sites try "random" questions which are really easy to pattern match with a little regex. The amount of effort that goes into botting generally scales linearly with userbase size (not always). But…

What if you had a community helping out, somehow gamify making new challenges? I dunno, just have the feeling if there was a proper project with enough bright minds behind it, it should work

This sounds like a recipe for disaster when 4chan and friends find out about it.

Re: Ask HN: Do we need Google captcha?

#74

Post by thawaway1837 »

castis wrote: post #10

Over the past 2 years or so I've become incredibly skilled at identifying crosswalks, fire hydrants, traffic lights, and bicycles. I don't necessarily mind contributing to googles car-driving AI, but the services that I've put this captcha infront of have seen a dramatic increase in spam. I unfortunately don't know what the solution to this problem is but I would gladly contribute to whatever someone smarter than me…

I believe what the spammers have started doing is presenting these captchas to human users on more illegitimate sights, such as those to watch free sports broadcasts, etc to gain access.

The user solves the captcha for the site which then uses that solution to fool the actual Google captcha.

Re: Ask HN: Do we need Google captcha?

#75

Post by ryankrage77 »

jazoom wrote: post #71
zawerf wrote: post #48

CAPTCHA isn't just a matter of protecting your site. One of the most evil attacks nowadays is "Distributed Spam Distraction", where you spam your victim with thousands of emails per second so an important email (e.g., fraudulent purchases) gets lost in the noise. How do you do this in a world with decent spam filters? By using the victim's email to sign up for real services so they get hit with a welcome email. Becau…

You've just reminded me I really need to use unique email addresses for each service.

If you use gmail, you can add a + followed by anything and it goes to the same mailbox.

For example, if signing up to drop, I might use myemail+drop@gmail.com

Makes it very easy to see which services are selling the address you provide to advertisers

Re: Ask HN: Do we need Google captcha?

#76

Post by jazoom »

ryankrage77 wrote: post #75
jazoom wrote: post #71

Earlier quoted context omitted.

You've just reminded me I really need to use unique email addresses for each service.

If you use gmail, you can add a + followed by anything and it goes to the same mailbox. For example, if signing up to drop, I might use myemail+drop@gmail.com Makes it very easy to see which services are selling the address you provide to advertisers

Yeah I know, and you're unfortunately correct that I use Gmail, but it's something I'm planning to change soon.

Also, if someone was targeting you with spam that won't help. They'll just remove the "+..." and you're back to the same problem.

Re: Ask HN: Do we need Google captcha?

#77

Post by mcv »

I like captchas that ask a question relevant to the topic of the site. For example, a forum about D&D might ask: "Who created D&D?" and accept all answers that contain "gygax", "arneson", "TSR" or "WotC". Trivial for your target demographic, but at least it requires a very different kind of bot.

Though I suppose if this becomes common, bots might just google that question and try some of the zero-click results as answers.

Re: Ask HN: Do we need Google captcha?

#78

Post by NetToolKit »

brokensegue wrote: post #70
NetToolKit wrote: post #39

Earlier quoted context omitted.

I understand why it might seem that way. I personally don't think it would be trivial to wire up a working solution (including generating the correct solution strings); if you do, I certainly would welcome you to post your solution.

if 3 hours is too much I'll crack the naval command captcha for 1 hour of work.

Adversarial testing -- I like it. Contact me via email (see my profile) and let's see if we can agree on the terms (again, it's more than just solving the puzzle). We would want to set up a proper test bed, and I'll be travelling next week, so it might take a couple of weeks to get everything ready.

Re: Ask HN: Do we need Google captcha?

#79

Post by godot »

fractalf wrote: post #36
maxwellito wrote: post #25

From a user point of view on Firefox, Google captcha is a an absolute hell. Every single time I have to pass few batches of captchas. I'm not on a private window and I'm logged in to Google. So I started to blacklist websites that use Google captcha. and forced myself to change reading habits.

Exactly what I was thinking when writing this question. Seems to me there really is a big demand for something proper, secure and open source. Kind of like how letsencrypt help secure the net

There were a few factors making letsencrypt successful: alternatives were not free, and mainstream browsers were all making attempts to surface unsecured http clearly on address bars.

A free open source alternative for captcha will have a harder time getting traction, mainly since the popular option (Google) is already free; and neither business not customers (who are not privacy sensitive) care about the end result unlike the browser and http case.

Re: Ask HN: Do we need Google captcha?

#80

Post by louiz »

pythonaut_16 wrote: post #44
NetToolKit wrote: post #3

To the extent that you'd consider non-Google alternatives, there are multiple different CAPTCHA services, and we at NetToolKit recently launched our own version called Shibboleth: https://www.nettoolkit.com/shibboleth/about You can try out demos at https://www.nettoolkit.com/shibboleth/demo While not open-source, the service is very affordable ($10 for 100,000 CAPTCHAs), and clients get to review user submissions to…

Just tried it out. Clicking on the buttons with a laptop trackpad was tedious and unintuitive. It would be nice if I could use the arrow keys (or even WASD) on my keyboard. Other than that it seems preferable to Google's new image captchas.

> WASD

Please don't, not everyone is american, not everyone uses a qwerty keyboard.

Post reply on HN