Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: A Good Alternative for ReCaptcha?

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 207 posts

Re: Ask HN: A Good Alternative for ReCaptcha?

#71

Post by bo1024 »

realcr wrote: post #21

I had a strange idea about solving this problem: How about a micro-payment, something like $0.01, instead of solving a puzzle? In that case maybe you won't care if many bots login to your website. I think that I by this time I have the technology to make something like this work, I was wondering if this is a good solution though. What do you think?

You could use JavaScript cryptocurrency mining instead. User clicks a button to activate miner script, it runs in their browser for 10-30 seconds or whatever, then reports back to your server that they are good to go.

Re: Ask HN: A Good Alternative for ReCaptcha?

#73

Post by enobrev »

willio58 wrote: post #57
tpetry wrote: post #32

For bots which are not specifically targeted at your page i simply add an invisible form element named url. Bots _LOVE_ to share their viagra urls. Any request which submitted an url is discarded. This trick is simple stupid and should not work but somehow the simple spam bots have not improved. This does not work for sophisticated bots (never met one) or the ones programmed specifically for your site (happens very r…

This is simple form of a honeypot but it is really ineffective. Any bot with even minimal sophistication will know to leave the hidden field empty.

I agree that it's possible - potentially trivial - for a bot to figure out if a field is hidden from view, but "really ineffective" seems a bit extreme for something I've seen work well multiple times.

It's not a definitive solution, but it's an easy and practically free first line of defense for a young project, and depending on the project, can stand for years.

Overall, it depends on the sophistication of the bots your project attracts.

Re: Ask HN: A Good Alternative for ReCaptcha?

#74

Post by mpol »

ChrisSD wrote: post #69
mpol wrote: post #52

Earlier quoted context omitted.

In the context of the question, that is not relevant. reCAPTCHA requires JavaScript as well. The question is about an alternative to reCAPTCHA. Both methods use JavaScript. I do understand where you are coming from though. And I also think this alternative is better in this regard. reCAPTCHA loads JavaScript from a third-party domain. With JavaScript spamfilters you are loading them from the first-party domain.

reCaptcha has a noscript alternative with iframes and checkboxes. Once completed you have to manually copy an authorisation string to a field and submit it.

That I didn't know. I don't remember ever seeing it, I suppose it is not used much?

Re: Ask HN: A Good Alternative for ReCaptcha?

#75

Post by IshKebab »

bo1024 wrote: post #71
realcr wrote: post #21

I had a strange idea about solving this problem: How about a micro-payment, something like $0.01, instead of solving a puzzle? In that case maybe you won't care if many bots login to your website. I think that I by this time I have the technology to make something like this work, I was wondering if this is a good solution though. What do you think?

You could use JavaScript cryptocurrency mining instead. User clicks a button to activate miner script, it runs in their browser for 10-30 seconds or whatever, then reports back to your server that they are good to go.

There are torrent sites that do this already (not as spam prevention, just to generate money). It's pretty annoying but I guess for spam prevention you could make the length of time shorter.

Re: Ask HN: A Good Alternative for ReCaptcha?

#76

Post by icebraining »

mikojan wrote: post #65
corobo wrote: post #58

Earlier quoted context omitted.

You hide it with CSS, not type='hidden'

So now you're filtering out bots and people with disabilities?

Nope, screen readers (usually?) ignore elements with "display: none".

To be sure, you could add aria-hidden="true", which I'd guess most bots don't recognize.

http://alistapart.com/article/now-you-see-me/

Re: Ask HN: A Good Alternative for ReCaptcha?

#77

Post by corobo »

mikojan wrote: post #65
corobo wrote: post #58

Earlier quoted context omitted.

You hide it with CSS, not type='hidden'

So now you're filtering out bots and people with disabilities?

Unfortunately I've not given thought to people with disabilities in this case. It's an oversight and that's on me.

I wonder if bots are smart enough to figure out aria-hidden="true". Possibly empty it out using javascript on submit. I would guess a bot not using CSS would also not be using javascript? Unsure, would need testing.

Re: Ask HN: A Good Alternative for ReCaptcha?

#78

Post by wongarsu »

tylerhou wrote: post #37
turshija wrote: post #29

Earlier quoted context omitted.

You can make that checkbox visible by default and put label "I'm not a bot" and uncheck + hide it using JS, that way noscript users will still see the checkbox and uncheck it manually.

Bots might be smart enough to uncheck that from the label; maybe text near the top of the form that says “please uncheck the checkbox near the submit button”?

You could use CSS to place label and checkbox visually close but completely unrelated in the DOM. Not great for accessibility, but better than the current situation.

Re: Ask HN: A Good Alternative for ReCaptcha?

#79

Post by ghusbands »

tpetry wrote: post #32

For bots which are not specifically targeted at your page i simply add an invisible form element named url. Bots _LOVE_ to share their viagra urls. Any request which submitted an url is discarded. This trick is simple stupid and should not work but somehow the simple spam bots have not improved. This does not work for sophisticated bots (never met one) or the ones programmed specifically for your site (happens very r…

Be very careful how you do this, unless you want to exclude blind users. I've seen a blind user have an online form silently fail at them because they filled in a field that wasn't visible. Using display:none applied indirectly via CSS is probably reasonably effective against bots and won't interfere with screen-readers.

Re: Ask HN: A Good Alternative for ReCaptcha?

#80

Post by SquareWheel »

corobo wrote: post #70
SquareWheel wrote: post #62

Earlier quoted context omitted.

It really doesn't matter. display:none or position:absolute;left:-1000px makes little difference. Honey pots only catch a small number of bots.

I only have anecdata of course but so far I've had a 100% success rate. I imagine this will come down eventually but for the past ~year or so it's been working fine to just hide the honeypot field with CSS

I'm glad it's worked for one of us at least.
Post reply on HN