Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: A Good Alternative for ReCaptcha?

news.ycombinator.com

Post reply on HN
Print view View original

151–160 of 207 posts

Re: Ask HN: A Good Alternative for ReCaptcha?

#151

Post by throwawaymath »

tpetry wrote: post #32

For bots which are not specifically targeted at your page i simply add an invisible form element named url. Bots _LOVE_ to share their viagra urls. Any request which submitted an url is discarded. This trick is simple stupid and should not work but somehow the simple spam bots have not improved. This does not work for sophisticated bots (never met one) or the ones programmed specifically for your site (happens very r…

> This does not work for sophisticated bots (never met one)

The basic prerogative of a sophisticated bot is to ensure you believe that.

Having written a variety of sophisticated bots - some from pre-existing libraries, others from scratch; for specific websites and for general purpose - I'm reasonably confident most people who think they've never seen a sophisticated bot are mistaken.

I agree with you that anything more sophisticated or bespoke than a mass-spam bot is rare. But rare things happen often to most websites with nontrivial traffic. The types of bots with the most funding and skill behind them are the ones which don't try to spam anything on a website at all.

Re: Ask HN: A Good Alternative for ReCaptcha?

#152

Post by Zimahl »

tmlee wrote: post #135

Recaptcha is also blocked in China. Users there wont be able to bypass it at all to accomplish a protected task. Anyone knows of a good alternative that works there?

Yup, this is a huge problem on my company's website. We really like reCaptcha but, alas, have to fall back to our home-rolled version because reCaptcha completely fails for our Chinese users.

Re: Ask HN: A Good Alternative for ReCaptcha?

#153

Post by terminous »

benburleson wrote: post #106
ghusbands wrote: post #84

Earlier quoted context omitted.

Note that that library is not accessible and is hence illegal to use for most websites in the US. I've raised an issue on the project [1]. [1] https://github.com/markets/invisible_captcha/issues/52

Whoa, it is actually illegal to make "not accessible" websites?

In the US, it is if you're an incorporated business serving as a "public accommodation" as defined in the Americans with Disabilities Act, which includes hotels, restaurants, theaters, storefronts. If it is just your personal blog, it doesn't apply. It is the same law that requires storefronts to have wheelchair ramps, but not homes. See Gil v. Winn-Dixie: https://scholar.google.com/scholar_case?case=674450226911160...

Re: Ask HN: A Good Alternative for ReCaptcha?

#154

Post by nine_k »

tpetry wrote: post #32

For bots which are not specifically targeted at your page i simply add an invisible form element named url. Bots _LOVE_ to share their viagra urls. Any request which submitted an url is discarded. This trick is simple stupid and should not work but somehow the simple spam bots have not improved. This does not work for sophisticated bots (never met one) or the ones programmed specifically for your site (happens very r…

Another interesting approach is to include an input which is not visible: due to `visibility:hidden`, due to being positioned well off-screen (`left: -10000px`), read-only, set unfocusable by keyboard (`tabindex="-1"`), etc.

Ideally it would have a varying id / name and a varying ARIA attribute for blind users, saying something like "human users, please ignore this".

It would not stop a really sophisticated bot that runs an actual browser and uses machine vision to detect page elements. But unless your site is very high-profile, running such a sophisticated bot to defeat its protections likely won't be profitable.

Re: Ask HN: A Good Alternative for ReCaptcha?

#155

Post by killahpriest »

ChrisSD wrote: post #69
mpol wrote: post #52

Earlier quoted context omitted.

In the context of the question, that is not relevant. reCAPTCHA requires JavaScript as well. The question is about an alternative to reCAPTCHA. Both methods use JavaScript. I do understand where you are coming from though. And I also think this alternative is better in this regard. reCAPTCHA loads JavaScript from a third-party domain. With JavaScript spamfilters you are loading them from the first-party domain.

reCaptcha has a noscript alternative with iframes and checkboxes. Once completed you have to manually copy an authorisation string to a field and submit it.

I don't think the noscript alternative works anymore. I get this message "Please enable JavaScript to get a reCAPTCHA challenge."

https://www.google.com/recaptcha/api2/demo

Re: Ask HN: A Good Alternative for ReCaptcha?

#156

Post by singlow »

throwawaymath wrote: post #151
tpetry wrote: post #32

For bots which are not specifically targeted at your page i simply add an invisible form element named url. Bots _LOVE_ to share their viagra urls. Any request which submitted an url is discarded. This trick is simple stupid and should not work but somehow the simple spam bots have not improved. This does not work for sophisticated bots (never met one) or the ones programmed specifically for your site (happens very r…

> This does not work for sophisticated bots (never met one) The basic prerogative of a sophisticated bot is to ensure you believe that. Having written a variety of sophisticated bots - some from pre-existing libraries, others from scratch; for specific websites and for general purpose - I'm reasonably confident most people who think they've never seen a sophisticated bot are mistaken. I agree with you that anything m…

But this is good enough in many cases. It's intended to reduce the volume of input from a form in order to prevent overloading human resources at the next level of filtering. If one or two bots per week get through, it isn't a big deal. Not only are the more sophisticated bots less common, they also tend to not send a bunch of messages.

So if you have a contact form, this simple method may reduce the spam content to a low enough level that the effort to implement some type of third-party service is not necessary. There is not enough incentive for someone to target the form directly.

In addition, the captcha service may actually deter real submissions, whereas this is completely invisible to non-bots.

If you have a form that has a greater incentive for bots to abuse, then you need something more sophisticated.

Re: Ask HN: A Good Alternative for ReCaptcha?

#157

Post by NetToolKit »

josefresco wrote: post #149

Looking at these comments (141 at the time of this post) the answer looks to be: No. I have small business clients, Google's reCAPTCHA is our best option. They aren't willing to pay for some obscure, and expensive one-off solution that might work. They just want the spam to stop. I fill out reCAPTCHAs every god damned day because I work on the web. Asking "normal" users to fill out a handful each year isn't asking th…

There are definitely alternatives. For example, https://hcaptcha.com/ (I have not used or evaluated them).

If any of your small business clients might be interested in our new CAPTCHA service that should launch late next month, please let me know (see profile for contact information). Our pricing is projected to be $10 for 100,000 requests.

Re: Ask HN: A Good Alternative for ReCaptcha?

#158

Post by 0xffff2 »

sjamaan wrote: post #66
jedberg wrote: post #19

There was a good podcast about this [0] just a couple weeks ago. They interviewed the guy who invented CAPTCHA as well as the head engineer on ReCaptcha v3. The gist of it was that in a few years, all Captchas will be useless because machine learning is too easy and cheap. The only way to defeat spam will be to use reCaptcha v3 or something like it, because those services will use what they know about you to determin…

> those services will use what they know about you This is inherently user-hostile, as it presupposes tracking and identification. I don't want them to know anything about me!

I'm fairly certain that Google doesn't care.

Re: Ask HN: A Good Alternative for ReCaptcha?

#159

Post by anderspitman »

dmos62 wrote: post #59
dessant wrote: post #39

W3C has published an extensive list of reCAPTCHA alternatives: https://www.w3.org/TR/turingtest/ W3C is requesting feedback for the document, if you'd like to make suggestions, please open an issue: https://github.com/w3c/apa/issues

That's a very informative document. Privacy Pass caught my eye: https://privacypass.github.io/ It's an extension that is currently only supported by Cloudflare's CAPTCHA, that pretty much stores tokens after you complete a CAPTCHA, and the next time instead of requiring you to complete a CAPTCHA again, it will use those tokens. The point is that it does it in an anonymity preserving way. You can fork their server for…

These types of "blanket captchas" basically destroy browsing via something like Tor, right? I feel like I've seen people complain about Cloudflare's captchas when browsing ananymously.

Re: Ask HN: A Good Alternative for ReCaptcha?

#160

Post by cweagans »

pdimitar wrote: post #143
bjoli wrote: post #92

I have a mail server with a new address generated per post (or per comment for thread functionality) on a blog i run. People then get to mail their comments. For all reputable mail sites I let things directly through, for everything else I use a spam filter turned to 11 together with a mail-back link for post verification. I have had zero spam the last 8 years. The code is ancient and runs on an even older version of…

Have you considered open-sourcing that and posting it on HN? I'd use it.

> so I the time it would take for me to share it would be longer than to rewrite it in some hip language.

I'm reasonably sure the answer to your questions is yes.

Post reply on HN