Why Captchas have gotten so difficult • Hacker News Board

Re: Why Captchas have gotten so difficult

#121

Post by zzo38computer » Sun, Feb 03, 2019, 9:14 PM UTC

If you need CAPTCHA I may suggest plain text CAPTCHA (preferably ASCII only) with entirely server side computation, meaning anyone can read it and has maximum compatibility. If necessary, make your own rather than using an existing package, since that makes it less likely that automated spam will get through if you use a different one for each thing.

However, you should never need CAPTCHA to login (except possibly anonymously; Fossil requires a CAPTCHA to login anonymously), or to do stuff while logged in. You should not require CAPTCHA to read public information either, or to download (since you may wish to use external download management; for example, I prefer to use curl to download files rather than using the web browser, and it seems that I may not be the only one).

Of course manually entered spam will still get through even if you do use CAPTCHA.

Re: Why Captchas have gotten so difficult

#122

Post by EvanAnderson » Sun, Feb 03, 2019, 9:15 PM UTC

Each time I'm faced with a Google reCAPTCHA I think about how how I, and so many people like me, are unwittingly helping to train our eventual robot overlords.

Re: Why Captchas have gotten so difficult

#123

Post by [deleted] » Sun, Feb 03, 2019, 9:18 PM UTC

hombre_fatal wrote: post #120

dessant wrote: post #103

I've made a browser extension that solves CAPTCHAs using the audio challenge. Native user input simulation will come with the next release. https://github.com/dessant/buster On my part it is a direct reaction to developers and their employers cutting corners and adding these challenges to login forms and anything else you can imagine. It's entirely reasonable to show a challenge after a couple of failed login attempt…

>It's entirely reasonable to show a challenge after a couple of failed login attempts, but they should never be part of the default login flow. Nope, that only works if there weren't botnets that just multiplex millions of requests over thousands of websites. Anyone who has tried IP-blocking bots has run into this where 50k+ IP addresses just need to send you one request per couple minutes. Your posts in this thread…

[deleted]

Re: Why Captchas have gotten so difficult

#124

Post by dessant » Sun, Feb 03, 2019, 9:24 PM UTC

hombre_fatal wrote: post #120

dessant wrote: post #103

I've made a browser extension that solves CAPTCHAs using the audio challenge. Native user input simulation will come with the next release. https://github.com/dessant/buster On my part it is a direct reaction to developers and their employers cutting corners and adding these challenges to login forms and anything else you can imagine. It's entirely reasonable to show a challenge after a couple of failed login attempt…

>It's entirely reasonable to show a challenge after a couple of failed login attempts, but they should never be part of the default login flow. Nope, that only works if there weren't botnets that just multiplex millions of requests over thousands of websites. Anyone who has tried IP-blocking bots has run into this where 50k+ IP addresses just need to send you one request per couple minutes. Your posts in this thread…

I would have appreciated if your post would not have been a personal attack. I was suggesting limiting login attempts based on a particular user account, not an IP address, and I have never talked about a pending message system for forums.

Re: Why Captchas have gotten so difficult

#125

Post by rabidrat » Sun, Feb 03, 2019, 9:31 PM UTC

dessant wrote: post #124

hombre_fatal wrote: post #120

Earlier quoted context omitted.

>It's entirely reasonable to show a challenge after a couple of failed login attempts, but they should never be part of the default login flow. Nope, that only works if there weren't botnets that just multiplex millions of requests over thousands of websites. Anyone who has tried IP-blocking bots has run into this where 50k+ IP addresses just need to send you one request per couple minutes. Your posts in this thread…

I would have appreciated if your post would not have been a personal attack. I was suggesting limiting login attempts based on a particular user account, not an IP address, and I have never talked about a pending message system for forums.

> limiting login attempts based on a particular user account, not an IP address.

How do you do this on account creation?

Re: Why Captchas have gotten so difficult

#126

Post by chrisparton1991 » Sun, Feb 03, 2019, 9:33 PM UTC

outime wrote: post #24

Google reCAPTCHA is the absolute worst. It makes me solve several puzzles very often, usually when I use a mobile network and I’m not logged in with any Google account. It’s so frustrating that most of the times I find a reCAPTCHA I give up before trying and just go elsewhere e.g. when a site uses reCAPTCHA for sign up or after the first failed login, I’ll most likely skip if I don’t absolutely need to access such we…

reCAPTCHA pushed me over to DuckDuckGo. I use a VPN, and a fair number of my Google searches are blocked by a reCAPTCHA with 5 or more challenges.

Now, I use DDG and fall back to Google search with !g if I can't find what I'm looking for.

Re: Why Captchas have gotten so difficult

#127

Post by dessant » Sun, Feb 03, 2019, 9:35 PM UTC

rabidrat wrote: post #125

dessant wrote: post #124

Earlier quoted context omitted.

I would have appreciated if your post would not have been a personal attack. I was suggesting limiting login attempts based on a particular user account, not an IP address, and I have never talked about a pending message system for forums.

> limiting login attempts based on a particular user account, not an IP address. How do you do this on account creation?

Account creation is different from a login attempt.

Re: Why Captchas have gotten so difficult

#128

Post by crankylinuxuser » Sun, Feb 03, 2019, 9:37 PM UTC

tyingq wrote: post #104

dessant wrote: post #103

I've made a browser extension that solves CAPTCHAs using the audio challenge. Native user input simulation will come with the next release. https://github.com/dessant/buster On my part it is a direct reaction to developers and their employers cutting corners and adding these challenges to login forms and anything else you can imagine. It's entirely reasonable to show a challenge after a couple of failed login attempt…

I do use a CAPTCHA, but not on a login form. It's solely for a "contact us" form. We do try to encourage just regular email with a mailto: href, but unfortunately, customers expect a form. And, if I don't use the captcha, we get flooded with spam. We are using Google's "nocaptcha", which is usually unintrusive, but is a pain for anyone not logged into some Google property.

Then I suggest a simple change away from Google:

Make some text asking a question "What is five plus 2?" And there's an empty text field next to it that on the backend looks for the trivial right answer.

That should reasonably stop spam, and still allow a field based html mail sender. And eliminates a dependency on Google.

Re: Why Captchas have gotten so difficult

#129

Post by dexterdog » Sun, Feb 03, 2019, 9:40 PM UTC

tyingq wrote: post #104

dessant wrote: post #103

I've made a browser extension that solves CAPTCHAs using the audio challenge. Native user input simulation will come with the next release. https://github.com/dessant/buster On my part it is a direct reaction to developers and their employers cutting corners and adding these challenges to login forms and anything else you can imagine. It's entirely reasonable to show a challenge after a couple of failed login attempt…

I do use a CAPTCHA, but not on a login form. It's solely for a "contact us" form. We do try to encourage just regular email with a mailto: href, but unfortunately, customers expect a form. And, if I don't use the captcha, we get flooded with spam. We are using Google's "nocaptcha", which is usually unintrusive, but is a pain for anyone not logged into some Google property.

Also a pain for anybody using tracking blocking. I get captchas all day on all kinds of sites and I'm always logged into anywhere from 3-12 google accounts.

Re: Why Captchas have gotten so difficult

#130

Post by tyingq » Sun, Feb 03, 2019, 9:46 PM UTC

dexterdog wrote: post #129

tyingq wrote: post #104

Earlier quoted context omitted.

I do use a CAPTCHA, but not on a login form. It's solely for a "contact us" form. We do try to encourage just regular email with a mailto: href, but unfortunately, customers expect a form. And, if I don't use the captcha, we get flooded with spam. We are using Google's "nocaptcha", which is usually unintrusive, but is a pain for anyone not logged into some Google property.

Also a pain for anybody using tracking blocking. I get captchas all day on all kinds of sites and I'm always logged into anywhere from 3-12 google accounts.

We do put a clickable mailto: url on the page as well. Unfortunately, unprotected forms get tons of automated spam. Emailing a verification doesn't work well...customers just don't pay attention to instructions :)