Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: reCaptcha isn't stopping spam, what should I do?

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 24 posts

Ask HN: reCaptcha isn't stopping spam, what should I do?

#1

Post by Prefinem »

Hey guys, I recently built a small posting site and put it up on a previously used url that I had to test it. Within a few hours I had dozens of spam posts. So I installed reCaptcha and tested it (to make sure it was working) and then cleaned all the spam out.

But even with reCaptcha installed, I am still getting dozens of spam posts a day still. Is there a better solution? I have looked into akismet and mollom but I am not wanting to subject post content to third parties. Is there a better captcha system?

I also have included a form field hidden from the user to catch bots but I do not think it is very effective.

Thanks for the help

Re: Ask HN: reCaptcha isn't stopping spam, what should I do?

#3

Post by Prefinem »

roadg33k wrote: post #2

Would you be willing to share the link? Also, was there any significant reduction in the spam posts after installing reCaptcha?

There was reduction. Like I said, I had several dozen in a few hours, and then it went to about several dozen in a day...

The link is http://wtpaf.com

FYI, I have cleared out everything just a few minutes ago while working on the site.

Re: Ask HN: reCaptcha isn't stopping spam, what should I do?

#4

Post by roadg33k »

Prefinem wrote: post #3
roadg33k wrote: post #2

Would you be willing to share the link? Also, was there any significant reduction in the spam posts after installing reCaptcha?

There was reduction. Like I said, I had several dozen in a few hours, and then it went to about several dozen in a day... The link is http://wtpaf.com FYI, I have cleared out everything just a few minutes ago while working on the site.

Captcha seems to be working fine. Normally, you don't see bot bypassing it that easily. Can you record the user-agent for each submission?

Re: Ask HN: reCaptcha isn't stopping spam, what should I do?

#5

Post by computer »

Is the spam very specifically targeted at your site? If not, just implement your own very simple captcha system and see if they can handle that.

Spammers generally use captcha solving APIs which map to humans in low-wage countries. They pay ~$2/1000 solved captchas (a few years ago, not sure what it's like now.)

If you're not a specific target, changing your captcha might be enough to no longer easily be a victim of such a service without changes to the spammer software.

Re: Ask HN: reCaptcha isn't stopping spam, what should I do?

#6

Post by Prefinem »

roadg33k wrote: post #4
Prefinem wrote: post #3

Earlier quoted context omitted.

There was reduction. Like I said, I had several dozen in a few hours, and then it went to about several dozen in a day... The link is http://wtpaf.com FYI, I have cleared out everything just a few minutes ago while working on the site.

Captcha seems to be working fine. Normally, you don't see bot bypassing it that easily. Can you record the user-agent for each submission?

I can... I will start doing that and let you know what I see

Re: Ask HN: reCaptcha isn't stopping spam, what should I do?

#7

Post by Prefinem »

computer wrote: post #5

Is the spam very specifically targeted at your site? If not, just implement your own very simple captcha system and see if they can handle that. Spammers generally use captcha solving APIs which map to humans in low-wage countries. They pay ~$2/1000 solved captchas (a few years ago, not sure what it's like now.) If you're not a specific target, changing your captcha might be enough to no longer easily be a victim of…

I am not sure how to tell if it targeting the site. I will look into creating another captcha to see if that will help

Re: Ask HN: reCaptcha isn't stopping spam, what should I do?

#8

Post by computer »

Prefinem wrote: post #7
computer wrote: post #5

Is the spam very specifically targeted at your site? If not, just implement your own very simple captcha system and see if they can handle that. Spammers generally use captcha solving APIs which map to humans in low-wage countries. They pay ~$2/1000 solved captchas (a few years ago, not sure what it's like now.) If you're not a specific target, changing your captcha might be enough to no longer easily be a victim of…

I am not sure how to tell if it targeting the site. I will look into creating another captcha to see if that will help

Perhaps as an experiment try "enter the first character of your post/comment". That would kill any remote human captcha solvers (since they don't actually know the post content), and likely require some rewriting of the spamming software, assuming that is automated.

Of course, this is not a long term perfect solution against motivated adversaries, but it's a way to see how the current spammers work.

Another: Add a keydown handler to your message-textarea and log (to a hidden form field) how many key presses are being used per post. If the spam software is setting the content field programmatically, you then know how to detect them.

Re: Ask HN: reCaptcha isn't stopping spam, what should I do?

#9

Post by Prefinem »

computer wrote: post #8
Prefinem wrote: post #7

Earlier quoted context omitted.

I am not sure how to tell if it targeting the site. I will look into creating another captcha to see if that will help

Perhaps as an experiment try "enter the first character of your post/comment". That would kill any remote human captcha solvers (since they don't actually know the post content), and likely require some rewriting of the spamming software, assuming that is automated. Of course, this is not a long term perfect solution against motivated adversaries, but it's a way to see how the current spammers work. Another: Add a ke…

That is a great idea... much simpler than I had imagined. I will implement this tomorrow to base off results from today

Re: Ask HN: reCaptcha isn't stopping spam, what should I do?

#10

Post by nekitamo »

Hi Prefinem,

Include a small piece of Javascript that sets a hidden field in your form to some password when the page loads.

Then, when the form is posted, verify on the server that that field has been set to the password.

This should get rid of most of your spam. The reason it works is that you are being hit with spam from a program called "Xrumer", which doesn't emulate the Javascript of the pages it interacts with. It simple brute forces the forms on every single page it finds, and solves their captchas too. However, even the simplest Javascript will stop it from working.

Post reply on HN