Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: A Good Alternative for ReCaptcha?

news.ycombinator.com

Post reply on HN
Print view View original

141–150 of 207 posts

Re: Ask HN: A Good Alternative for ReCaptcha?

#141

Post by pdimitar »

gradschool wrote: post #137

A commenter on HN some years ago claimed a 100% success rate at blocking spam by requiring all web form submissions to be cryptographically signed. This solution struck me as stunningly elegant both by raising the standard for constructive feedback and promoting public awareness of secure communication.

Cryptographically signed where and how? Do you mean to say that you get a full string like "a=1&b=something&c=[1,2,3]" and hash/encrypt that? Or do you encrypt each individual field? Or something else?

Re: Ask HN: A Good Alternative for ReCaptcha?

#142

Post by dbjorge »

mrighele wrote: post #96
ghusbands wrote: post #79

Earlier quoted context omitted.

Be very careful how you do this, unless you want to exclude blind users. I've seen a blind user have an online form silently fail at them because they filled in a field that wasn't visible. Using display:none applied indirectly via CSS is probably reasonably effective against bots and won't interfere with screen-readers.

Are there tools or guides to help test how websites "appear" to people with disabilities ? It is difficult to design something if you don't have an idea of what will be the outcome, but I wouldn't know which software is used by (e.g.) a blind user, let alone how I would use it.

There are lots of options for automated accessibility scans, but there are many common accessibility issues that aren't feasible to test for with automation.

My team at Microsoft recently open sourced a tool called Accessibility Insights (https://accessibilityinsights.io). The web version is a chromium extension that includes both automated scans and also a guided assessment option that leads you through how to test for and fix the stuff that has to be found manually. This is the tool Microsoft pushes its own teams to use as part of their release processes.

Re: Ask HN: A Good Alternative for ReCaptcha?

#143

Post by pdimitar »

bjoli wrote: post #92

I have a mail server with a new address generated per post (or per comment for thread functionality) on a blog i run. People then get to mail their comments. For all reputable mail sites I let things directly through, for everything else I use a spam filter turned to 11 together with a mail-back link for post verification. I have had zero spam the last 8 years. The code is ancient and runs on an even older version of…

Have you considered open-sourcing that and posting it on HN? I'd use it.

Re: Ask HN: A Good Alternative for ReCaptcha?

#144

Post by ww520 »

lucb1e wrote: post #25
temp99990 wrote: post #4

I’m a fan of the Chinese-style captchas where you just move a puzzle piece with a slider. I have no idea how defeatable it is vs reCaptcha but it’s far far less painful.

I don't know these, do you have an example?

A picture with a missing piece as a hole is presented to the user. The missing piece is floating in front of the picture that can be dragged with the mouse (or via touch). A slider let the missing piece to be dragged left or right, to make it easier than 2D free movement. The user has to drag the missing piece on top of the hole on the picture to prove he's a human. The location of the missing piece is randomized for each interaction.

Re: Ask HN: A Good Alternative for ReCaptcha?

#145

Post by NetToolKit »

For those who are interested in an alternative CAPTCHA service, we at NetToolKit are putting the finishing touches on a service that we hope to launch at the end of next month (June). The CAPTCHAs are interactive and meant to be fun for the user -- no machine learning training involved. We'd be thrilled to get some early feedback before launch, so if anyone is interested, please reach out via email or via our website (both in profile).

Re: Ask HN: A Good Alternative for ReCaptcha?

#146

Post by dbjorge »

no_gravity wrote: post #17

I think it is best to design your own captcha around your use case. All you need to do is make the amount of work for spammers too high for targeting your site. Just recently, I added the idea of a captcha that might actually be enjoyable for users to my list of "things that should exist": http://www.gibney.de/things_that_should_exist The idea is to show the user a random image and ask what is on it. If the image is…

Rolling your own CAPTCHA is very, very likely to introduce accessibility issues for your site. It is the accessibility equivalent of "rolling your own cryptography" for security. Among surveys of screen reader users, CAPTCHAs are regularly listed as the single most frustrating part of trying to use web sites via assistive technology.

Even if a CAPTCHA does offer a non visual alternative, it is very common for it to be inaccessible for folks with cognitive disabilities (eg, dyslexia) or motor impairments. Another common issue is assuming that users all speak English fluently. In this example, "beauty" is likely to be sufficiently culture specific to cause localization challenges.

https://www.w3.org/TR/turingtest/ is a good resource for learning about the accessibility implications of many common types of CAPTCHA implementation.

Re: Ask HN: A Good Alternative for ReCaptcha?

#147

Post by realcr »

worble wrote: post #83
realcr wrote: post #21

I had a strange idea about solving this problem: How about a micro-payment, something like $0.01, instead of solving a puzzle? In that case maybe you won't care if many bots login to your website. I think that I by this time I have the technology to make something like this work, I was wondering if this is a good solution though. What do you think?

You have no idea how often I've shouted at my monitor that I would rather pay the site hoster a one-time fee than use google captcha ever again, and I really wish more sites offered this. Say what you want about the site, but 4chans pass method of payment, which just removes all the captcha's when posting and lowers the post timer, was a fantastic idea, and just works.

I think that there is a real opportunity here. I just went over all the comments about this idea. It seems like most of the objections relate to issues with the payment medium itself, and not with the actual idea of paying instead of solving a puzzle.

Some examples:

> It seems more likely they are trying to steal cc details by asking for such a small payment.

This relates to being afraid using a credit card online against a non credible seller.

> Payment processing is nontrivial to set up

This one is about the technical difficulty (And possibly also regulation) for setting up payment processing

> regions where it is uncommon to have means to interface with payment processors.

This one is about inaccessibility to payment means, which also relates to a problem with the payment medium.

> You could use JavaScript cryptocurrency mining instead

I assume that bo1024 suggested this because he implicitly believes that setting up a payment processor will be more difficult, and give bad experience to the user.

The only objection I have seen which is more specific to actually recognizing humans is this one (by Freak_NL)

> What would prevent the bots from using the same system?

First, I think that it should make operating bots on a wide scale much more expensive. Second, if you make money out of bots coming into your website, would you really care that they are bots? I assume that the reason someone would block bots from the first place is that bots harm their money making business. If you had a system to collect this money back, shouldn't this considered as a problem solved?

I am working these days on a decentralized payment system that supports micro-payments. (I promise there are no blockchains inside). Solving the captcha thing can be a very useful use case. I will be happy if anyone wants to join forces on this one (My email is real (at) freedomlayer (dot) org).

Re: Ask HN: A Good Alternative for ReCaptcha?

#148

Post by westondeboer »

Nextgrid wrote: post #103
dewey wrote: post #9

Earlier quoted context omitted.

https://github.com/dessant/buster What about this one?

Does it actually work? Speech recognition is often terrible enough in normal conditions, so I don't expect it working well on audio captchas which are often designed to counteract speech recognition.

Buster works great! I use it all the time.

Re: Ask HN: A Good Alternative for ReCaptcha?

#149

Post by josefresco »

Looking at these comments (141 at the time of this post) the answer looks to be: No.

I have small business clients, Google's reCAPTCHA is our best option. They aren't willing to pay for some obscure, and expensive one-off solution that might work. They just want the spam to stop. I fill out reCAPTCHAs every god damned day because I work on the web. Asking "normal" users to fill out a handful each year isn't asking that much.

Maybe for your startup "rolling your own" makes sense, but not for small biz.

Re: Ask HN: A Good Alternative for ReCaptcha?

#150

Post by kqr »

y4mi wrote: post #102
kqr wrote: post #98

Earlier quoted context omitted.

I couldn't find anything like it, which surprises me. It should be in the interest of companies selling screenreaders that the web is accessible with them. Creating a service where you can submit a link and it shows you a textual representation of how the screenreader sees the page would be immensely useful.

uh, there are a lot of services that do automated scans. These obviously arent completely failsafe, but still give an indicator. just google relevant keywords https://www.google.com/search?q=accessibility+scan+website and if you want the full experience: just enable the screen reader and try to use your website with it. /edit: and i almost forgot: chromes build-in Audit tool in the Developer Panel includes some Acces…

These scans are in my experience always just that: they read the source and match it against a set of common anti-patterns. I was talking about something that would tell me how common commercial screen readers interpret an arbitrary new construct. If you have a specific reference to something else, please send me a link!

Screen readers often cost significant amounts of money, and are not trivial to "just turn on".

Post reply on HN