Ask HN: A Good Alternative for ReCaptcha?

#1

Post by Ayesh » Fri, May 31, 2019, 6:39 AM UTC

Are there any good alternatives for reCaptcha? It has come to a point that traditional text/sound captcha challenges are trivial to bypass today, and the more distorted we make them, the more challenging they are for humans.

Google went Sparta with their reCaptcha be, and nobody in their right mind should add a script that fingerprints users, specially from an adtech company.

What solutions do you use to thwart bad boots from submitting your forms and automating things where it should not have been?

Re: Ask HN: A Good Alternative for ReCaptcha?

#2

Post by Nextgrid » Fri, May 31, 2019, 7:30 AM UTC

> It has come to a point that traditional text/sound captcha challenges are trivial to bypass today

I have yet to see a general-purpose tool to which you can throw any text captcha and it’ll solve it.

Just because there are academic papers that demonstrated it once doesn’t mean there’s still a huge barrier to entry in implementing this solution (which spammers won’t do as long as it’s easier to move onto another target).

There are paid captcha-solving services out there and even those are still powered by humans even though it’s in their commercial interests to automate the process. Them not doing so further suggests that AI is not there yet.

Re: Ask HN: A Good Alternative for ReCaptcha?

#3

Post by Risse » Fri, May 31, 2019, 7:30 AM UTC

In my personal blog I am using "Riddler" Drupal module, and have had good experience: https://www.drupal.org/project/riddler

You can create your own Captcha questions / answers. I feel like this is the preferred way of handling spam posts, creating your own custom Captcha implementation.

Re: Ask HN: A Good Alternative for ReCaptcha?

#4

Post by temp99990 » Fri, May 31, 2019, 7:46 AM UTC

I’m a fan of the Chinese-style captchas where you just move a puzzle piece with a slider. I have no idea how defeatable it is vs reCaptcha but it’s far far less painful.

Re: Ask HN: A Good Alternative for ReCaptcha?

#5

Post by Dolores12 » Fri, May 31, 2019, 7:52 AM UTC

Risse wrote: post #3

In my personal blog I am using "Riddler" Drupal module, and have had good experience: https://www.drupal.org/project/riddler You can create your own Captcha questions / answers. I feel like this is the preferred way of handling spam posts, creating your own custom Captcha implementation.

Eventually your questions will be answered by humans and added to database.

Re: Ask HN: A Good Alternative for ReCaptcha?

#6

Post by manojlds » Fri, May 31, 2019, 7:57 AM UTC

temp99990 wrote: post #4

I’m a fan of the Chinese-style captchas where you just move a puzzle piece with a slider. I have no idea how defeatable it is vs reCaptcha but it’s far far less painful.

Yeah, it's very widely used in the crypto world :)

Re: Ask HN: A Good Alternative for ReCaptcha?

#7

Post by anonymous5133 » Fri, May 31, 2019, 8:00 AM UTC

I had a serious problem with bots spamming my forum. I implemented all the usual captchas but none of it worked. What I found interesting was that I was able to defeat the bots simply by "tricking" them. I kept the old forum up but basically set this forum to auto delete the content on it. I then setup a brand new forum and for whatever reason bots don't spam it, at all. It is almost like the bot goes to the original forum, spams it, and then moves on thinking it has completed its mission. I even flat out disabled the captcha to see if anything changed and nothing did. The new forum never got spammed. I have no idea why that happened but it strangely did work. When I do get spam, I don't think that spam is from bots. It is from humans posting instead but that is at least manageable to clean up.

It kinda leads me to conclude that each developer has to create "out of the box" solutions instead of some plug and play solution. If a plug and play solution is developed then all the spam bot creators start figuring out ways to crack or simply create a service for human based cracking. If unconventional methods are used on each site then it gets more complicated for the spammers.

Re: Ask HN: A Good Alternative for ReCaptcha?

#8

Post by brylie » Fri, May 31, 2019, 8:09 AM UTC

It might be worth considering a honeypot approach. E.g. having a field in the form that isn't visible for users that, when filled in, indicates that it is likely a SPAM submission.

https://www.projecthoneypot.org/

Re: Ask HN: A Good Alternative for ReCaptcha?

#9

Post by dewey » Fri, May 31, 2019, 8:13 AM UTC

Nextgrid wrote: post #2

> It has come to a point that traditional text/sound captcha challenges are trivial to bypass today I have yet to see a general-purpose tool to which you can throw any text captcha and it’ll solve it. Just because there are academic papers that demonstrated it once doesn’t mean there’s still a huge barrier to entry in implementing this solution (which spammers won’t do as long as it’s easier to move onto another targ…

https://github.com/dessant/buster What about this one?

Re: Ask HN: A Good Alternative for ReCaptcha?

#10

Post by barking » Fri, May 31, 2019, 8:14 AM UTC

Dolores12 wrote: post #5

Risse wrote: post #3

In my personal blog I am using "Riddler" Drupal module, and have had good experience: https://www.drupal.org/project/riddler You can create your own Captcha questions / answers. I feel like this is the preferred way of handling spam posts, creating your own custom Captcha implementation.

Eventually your questions will be answered by humans and added to database.

If it takes a while, it wouldn't be too painful to update to a new question periodically, i suppose.