Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: A Good Alternative for ReCaptcha?

news.ycombinator.com

Post reply on HN
Print view View original

121–130 of 207 posts

Re: Ask HN: A Good Alternative for ReCaptcha?

#121

Post by chronogram »

corobo wrote: post #101
kaybe wrote: post #90

Earlier quoted context omitted.

Could we just tell the people with screen readers to ignore it?

As a fallback I imagine so yeah. I'm trying to think about what would be going on at the time, wondering if unexpected instructions inside a form would be confusing. Disclaimer: I don't know how a screenreader would present this, example only "Form entry. Input name. Input email. Ignore this field it's for spambots. Input url. Submit" -- In this case does the message more naturally apply to email or url? I'd imagine…

And then hide the warning using CSS too, so it gets picked up by screen readers just like the hidden input!

Re: Ask HN: A Good Alternative for ReCaptcha?

#122

Post by eli »

tpetry wrote: post #32

For bots which are not specifically targeted at your page i simply add an invisible form element named url. Bots _LOVE_ to share their viagra urls. Any request which submitted an url is discarded. This trick is simple stupid and should not work but somehow the simple spam bots have not improved. This does not work for sophisticated bots (never met one) or the ones programmed specifically for your site (happens very r…

A similar tactic I have is to just require JS to submit a form. Sorry noscript users.

That said, we encounter many sophisticated bots and also a decent number of what I'm pretty sure are real people in low-wage countries pasting data into forms. That last one is tough.

Re: Ask HN: A Good Alternative for ReCaptcha?

#123

Post by phereford »

tpetry wrote: post #32

For bots which are not specifically targeted at your page i simply add an invisible form element named url. Bots _LOVE_ to share their viagra urls. Any request which submitted an url is discarded. This trick is simple stupid and should not work but somehow the simple spam bots have not improved. This does not work for sophisticated bots (never met one) or the ones programmed specifically for your site (happens very r…

Honeypots are the best. It will filter out at least 90% of the spam (or so I have experienced everywhere I have implemented them).

Re: Ask HN: A Good Alternative for ReCaptcha?

#124

Post by rcdwealth »

Simplest way is to use filtering.

``` (defparameter spam-words '("viagra" "cialis" "v1agra" "c1alis" "tamadol" "hydrocodome" "doxycyline" "prozac" "prozca" "prizac" "doxycyclins" "anx8ety" "amytriptylone" "poker" "laxative" "anatrim" "breast" "penis" "fiorinal" "sexy" "kaspersky" "hoodia" "thyroid" "coupon.com" "vuitton" "coupon" "fetish" "famotidine" "footwear" "sweetwater" "sunglasses" "ninja" "www" "http" "cheap3ddigitalcameras.com" "aquadivingaccessories.com" "tastyarabicacoffee.com" "yourmail@gmail.com" "bit.ly" "cottonsleepingbags.com" "italiancarairbags.com" "newpopularwatches.com" "glasslightbulbs.com" "browndecorationlights.com" "fx-brokers.review" "ceramicsouvenirs.com" "xevil" "senuke" "captcha" "xrumer" "vkontakte" "апрап" "erectile" "spellingscan" "lialda" "lamborghini" "doubles your bitcoin" "pro-expert.online" "specified wallet" "selected wallet" "online casino" "multimillionaire" "win-win lottery" "lottery" "Перезвоните пожалуйста" "yuguhun88@hotmail.com" "meeting-club.online" "from2325214cv" "did you receive my offer" "Domain zone .de" "all your photos" "Pay 1 BTC" "to our bitcoin wallet" "you will be sued" "police will be interested" "hacked")) ```

Re: Ask HN: A Good Alternative for ReCaptcha?

#125

Post by jermaustin1 »

The best solution I've ever come to that didn't negatively impact my clients was generating a UUID on the server via an ajax call 100ms after page load. That UUID was stored in a cookie, and returned via AJAX and stuck it in a hidden field on the form.

Server checks cookie != null and cookie == hidden field, and returned a 200 OK regardless of if it failed (used the response text for success or failure indication), and deleted the cookie.

Implemented it across a network of sites ~10 years ago, and only a handful of spam had gotten through when I quit that job 4 years ago. They had been getting 10-20 spam comments per day per site.

Re: Ask HN: A Good Alternative for ReCaptcha?

#127

Post by sireat »

jermaustin1 wrote: post #125

The best solution I've ever come to that didn't negatively impact my clients was generating a UUID on the server via an ajax call 100ms after page load. That UUID was stored in a cookie, and returned via AJAX and stuck it in a hidden field on the form. Server checks cookie != null and cookie == hidden field, and returned a 200 OK regardless of if it failed (used the response text for success or failure indication), a…

So this solution would work because most automated spam would not make AJAX calls?

Something like Selenium posing as a real user would bypass this kind of protection wouldn't it ?

Re: Ask HN: A Good Alternative for ReCaptcha?

#129

Post by [deleted] »

enobrev wrote: post #73
willio58 wrote: post #57

Earlier quoted context omitted.

This is simple form of a honeypot but it is really ineffective. Any bot with even minimal sophistication will know to leave the hidden field empty.

I agree that it's possible - potentially trivial - for a bot to figure out if a field is hidden from view, but "really ineffective" seems a bit extreme for something I've seen work well multiple times. It's not a definitive solution, but it's an easy and practically free first line of defense for a young project, and depending on the project, can stand for years. Overall, it depends on the sophistication of the bots…

[deleted]

Re: Ask HN: A Good Alternative for ReCaptcha?

#130

Post by julianlam »

mattigames wrote: post #13
Dolores12 wrote: post #5

Earlier quoted context omitted.

Eventually your questions will be answered by humans and added to database.

Might be good idea to extend the plug-in so adding questions is as easy as sending an SMS, then you can spend less than a minute daily to add a question/answer combo: Color of the sky at night? Black

#000000
Post reply on HN