Ask HN: A Good Alternative for ReCaptcha? • Hacker News Board

Re: Ask HN: A Good Alternative for ReCaptcha?

#91

Post by icebraining » Fri, May 31, 2019, 11:53 AM UTC

ghusbands wrote: post #85

icebraining wrote: post #76

Earlier quoted context omitted.

Nope, screen readers (usually?) ignore elements with "display: none". To be sure, you could add aria-hidden="true", which I'd guess most bots don't recognize. http://alistapart.com/article/now-you-see-me/

Many don't just use display:none but position text off-screen or make it tiny or use sizing and overflow:hidden. I've seen a blind user be tripped up by these, so yes, it often also filters out disabled users.

Many people use tools incorrectly, that doesn't mean you shouldn't use those tools, you just have to be aware of the problem, which everyone in this (sub)thread now is.

Re: Ask HN: A Good Alternative for ReCaptcha?

#92

Post by bjoli » Fri, May 31, 2019, 11:53 AM UTC

I have a mail server with a new address generated per post (or per comment for thread functionality) on a blog i run. People then get to mail their comments. For all reputable mail sites I let things directly through, for everything else I use a spam filter turned to 11 together with a mail-back link for post verification.

I have had zero spam the last 8 years.

The code is ancient and runs on an even older version of lispworks with Auth details hard coded all over the place, so I the time it would take for me to share it would be longer than to rewrite it in some hip language.

Had I been lazy and not as privacy conscious I would have let Gmail do the spam filtering for me.

Re: Ask HN: A Good Alternative for ReCaptcha?

#93

Post by Kenji » Fri, May 31, 2019, 11:54 AM UTC

It has come to a point that traditional text/sound captcha challenges are trivial to bypass today

Don't be fooled. Text-based CAPTCHAs are still very effective, unless you're a really large target on the scale of facebook or google. If you design your own text-based CAPTCHA, it's highly unlikely that someone is gonna pull out their ML skills to read your CAPTCHAS just to spam. Too much effort. I wrote my own PHP CAPTCHA more than a decade ago and have it used ever since with virtually no modifications, and not a single piece of spam has made it through on my websites (if you don't count my friends trolling me with silly messages once in a while).

Re: Ask HN: A Good Alternative for ReCaptcha?

#94

Post by IgorPartola » Fri, May 31, 2019, 11:56 AM UTC

avian wrote: post #43

mpol wrote: post #11

Akismet is a third party service that works really well. You send data there with a HTTP POST and it will reply with a yes or no, it is spam or not spam. It is not that hard to implement. You do have to be aware that you are sending user data to that service, which you have to mention in your privacy policy. Stop Forum Spam is a similar third party service. You send it an ip address and an email address. It will repl…

> The only "risk" is that in the future spammers might start using more sophisticated spambots You’re also making your website unusable for people with Javascript blocked or disabled in their browsers.

Why stop there? I block HTML on all websites. Can’t show me ads if HTML is blocked. I also usually browse the web through an Ethernet connection. Don’t trust WiFi. And to make it more secure, my cables only have three wires in them. Less wires means fewer places for hackerz to hide.

Re: Ask HN: A Good Alternative for ReCaptcha?

#95

Post by Kenji » Fri, May 31, 2019, 11:59 AM UTC

realcr wrote: post #21

I had a strange idea about solving this problem: How about a micro-payment, something like $0.01, instead of solving a puzzle? In that case maybe you won't care if many bots login to your website. I think that I by this time I have the technology to make something like this work, I was wondering if this is a good solution though. What do you think?

That's a very bad idea. Anonymity is lost. As soon as money starts flowing, you have to reveal your full real life identity. I do not want to do that with every website that has a CAPTCHA. And before you say "no you don't, there's bitcoin, etc.": Many governments force you to identify your customers.

Re: Ask HN: A Good Alternative for ReCaptcha?

#96

Post by mrighele » Fri, May 31, 2019, 12:00 PM UTC

ghusbands wrote: post #79

tpetry wrote: post #32

For bots which are not specifically targeted at your page i simply add an invisible form element named url. Bots _LOVE_ to share their viagra urls. Any request which submitted an url is discarded. This trick is simple stupid and should not work but somehow the simple spam bots have not improved. This does not work for sophisticated bots (never met one) or the ones programmed specifically for your site (happens very r…

Be very careful how you do this, unless you want to exclude blind users. I've seen a blind user have an online form silently fail at them because they filled in a field that wasn't visible. Using display:none applied indirectly via CSS is probably reasonably effective against bots and won't interfere with screen-readers.

Are there tools or guides to help test how websites "appear" to people with disabilities ? It is difficult to design something if you don't have an idea of what will be the outcome, but I wouldn't know which software is used by (e.g.) a blind user, let alone how I would use it.

Re: Ask HN: A Good Alternative for ReCaptcha?

#97

Post by tragicpapercut » Fri, May 31, 2019, 12:08 PM UTC

ghusbands wrote: post #79

tpetry wrote: post #32

For bots which are not specifically targeted at your page i simply add an invisible form element named url. Bots _LOVE_ to share their viagra urls. Any request which submitted an url is discarded. This trick is simple stupid and should not work but somehow the simple spam bots have not improved. This does not work for sophisticated bots (never met one) or the ones programmed specifically for your site (happens very r…

Be very careful how you do this, unless you want to exclude blind users. I've seen a blind user have an online form silently fail at them because they filled in a field that wasn't visible. Using display:none applied indirectly via CSS is probably reasonably effective against bots and won't interfere with screen-readers.

Can confirm, formerly used a spin of this technique and had to stop to better support blind users.

Re: Ask HN: A Good Alternative for ReCaptcha?

#98

Post by kqr » Fri, May 31, 2019, 12:10 PM UTC

mrighele wrote: post #96

ghusbands wrote: post #79

Earlier quoted context omitted.

Be very careful how you do this, unless you want to exclude blind users. I've seen a blind user have an online form silently fail at them because they filled in a field that wasn't visible. Using display:none applied indirectly via CSS is probably reasonably effective against bots and won't interfere with screen-readers.

Are there tools or guides to help test how websites "appear" to people with disabilities ? It is difficult to design something if you don't have an idea of what will be the outcome, but I wouldn't know which software is used by (e.g.) a blind user, let alone how I would use it.

I couldn't find anything like it, which surprises me. It should be in the interest of companies selling screenreaders that the web is accessible with them. Creating a service where you can submit a link and it shows you a textual representation of how the screenreader sees the page would be immensely useful.

Re: Ask HN: A Good Alternative for ReCaptcha?

#99

Post by RegW » Fri, May 31, 2019, 12:11 PM UTC

mrighele wrote: post #96

ghusbands wrote: post #79

Earlier quoted context omitted.

Be very careful how you do this, unless you want to exclude blind users. I've seen a blind user have an online form silently fail at them because they filled in a field that wasn't visible. Using display:none applied indirectly via CSS is probably reasonably effective against bots and won't interfere with screen-readers.

Are there tools or guides to help test how websites "appear" to people with disabilities ? It is difficult to design something if you don't have an idea of what will be the outcome, but I wouldn't know which software is used by (e.g.) a blind user, let alone how I would use it.

You could start here: https://www.w3.org/standards/webdesign/accessibility

Re: Ask HN: A Good Alternative for ReCaptcha?

#100

Post by dageshi » Fri, May 31, 2019, 12:15 PM UTC

avian wrote: post #43

mpol wrote: post #11

Akismet is a third party service that works really well. You send data there with a HTTP POST and it will reply with a yes or no, it is spam or not spam. It is not that hard to implement. You do have to be aware that you are sending user data to that service, which you have to mention in your privacy policy. Stop Forum Spam is a similar third party service. You send it an ip address and an email address. It will repl…

> The only "risk" is that in the future spammers might start using more sophisticated spambots You’re also making your website unusable for people with Javascript blocked or disabled in their browsers.

I can't think of any reason why js would be disabled in a browser other than by personal choice? In which case you're making the website unusuable for yourself.