Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: A Good Alternative for ReCaptcha?

news.ycombinator.com

Post reply on HN
Print view View original

161–170 of 207 posts

Re: Ask HN: A Good Alternative for ReCaptcha?

#161

Post by jm4 »

jermaustin1 wrote: post #125

The best solution I've ever come to that didn't negatively impact my clients was generating a UUID on the server via an ajax call 100ms after page load. That UUID was stored in a cookie, and returned via AJAX and stuck it in a hidden field on the form. Server checks cookie != null and cookie == hidden field, and returned a 200 OK regardless of if it failed (used the response text for success or failure indication), a…

That will work for low end drive by stuff. Anyone motivated will have a better bot. I was running one 10-12 years ago that was essentially a headless browser. It had a JavaScript runtime and a custom DOM. It could run jquery, prototype, ajax and just about everything else that was popular at the time. I even had a custom flash runtime in there for the jackass sites with the nav in flash.

These days you could just throw together a selenium script and call it a day.

This kind of stuff is fine for stopping comment spam because there are so many other opportunities out there that the spammers move on to an easier target. If you need to protect against a targeted attack then it’s a lot more difficult.

Re: Ask HN: A Good Alternative for ReCaptcha?

#162

Post by ChrisSD »

killahpriest wrote: post #155
ChrisSD wrote: post #69

Earlier quoted context omitted.

reCaptcha has a noscript alternative with iframes and checkboxes. Once completed you have to manually copy an authorisation string to a field and submit it.

I don't think the noscript alternative works anymore. I get this message "Please enable JavaScript to get a reCAPTCHA challenge." https://www.google.com/recaptcha/api2/demo

Huh, last time I hit a cloudflare website on Tor it directed me to https://www.google.com/recaptcha/api/fallback?k=...

Perhaps that's just a cloudflare thing.

Re: Ask HN: A Good Alternative for ReCaptcha?

#163

Post by QualityReboot »

jm4 wrote: post #161
jermaustin1 wrote: post #125

The best solution I've ever come to that didn't negatively impact my clients was generating a UUID on the server via an ajax call 100ms after page load. That UUID was stored in a cookie, and returned via AJAX and stuck it in a hidden field on the form. Server checks cookie != null and cookie == hidden field, and returned a 200 OK regardless of if it failed (used the response text for success or failure indication), a…

That will work for low end drive by stuff. Anyone motivated will have a better bot. I was running one 10-12 years ago that was essentially a headless browser. It had a JavaScript runtime and a custom DOM. It could run jquery, prototype, ajax and just about everything else that was popular at the time. I even had a custom flash runtime in there for the jackass sites with the nav in flash. These days you could just thr…

Even easier now with https://github.com/GoogleChrome/puppeteer

Re: Ask HN: A Good Alternative for ReCaptcha?

#164

Post by kiliankoe »

kqr wrote: post #150
y4mi wrote: post #102

Earlier quoted context omitted.

uh, there are a lot of services that do automated scans. These obviously arent completely failsafe, but still give an indicator. just google relevant keywords https://www.google.com/search?q=accessibility+scan+website and if you want the full experience: just enable the screen reader and try to use your website with it. /edit: and i almost forgot: chromes build-in Audit tool in the Developer Panel includes some Acces…

These scans are in my experience always just that: they read the source and match it against a set of common anti-patterns. I was talking about something that would tell me how common commercial screen readers interpret an arbitrary new construct. If you have a specific reference to something else, please send me a link! Screen readers often cost significant amounts of money, and are not trivial to "just turn on".

I believe y4mi was referring to screen reading software, not a physical device. Like VoiceOver on macOS.

Re: Ask HN: A Good Alternative for ReCaptcha?

#165

Post by aendruk »

For the use case of blocking general web form spam, we've had good results with relying solely on IP reputation crowdsourced via AbuseIPDB:

https://www.abuseipdb.com/about

Occasionally we're an early target of a fresh IP, but we report it back to the database to help later victims. The more people contribute to such a system, the better it gets.

Re: Ask HN: A Good Alternative for ReCaptcha?

#166

Post by ilikehurdles »

mrighele wrote: post #96
ghusbands wrote: post #79

Earlier quoted context omitted.

Be very careful how you do this, unless you want to exclude blind users. I've seen a blind user have an online form silently fail at them because they filled in a field that wasn't visible. Using display:none applied indirectly via CSS is probably reasonably effective against bots and won't interfere with screen-readers.

Are there tools or guides to help test how websites "appear" to people with disabilities ? It is difficult to design something if you don't have an idea of what will be the outcome, but I wouldn't know which software is used by (e.g.) a blind user, let alone how I would use it.

Surprised no one has mentioned this yet, but pa11y was what a large enterprisey company I used to work at tried to adhere to. http://pa11y.org/

Re: Ask HN: A Good Alternative for ReCaptcha?

#167

Post by CM30 »

Risse wrote: post #3

In my personal blog I am using "Riddler" Drupal module, and have had good experience: https://www.drupal.org/project/riddler You can create your own Captcha questions / answers. I feel like this is the preferred way of handling spam posts, creating your own custom Captcha implementation.

This is what I do on my own sites too.

Of course, given some bots relay the captchas to humans, this arguably works best for a site with a specific niche in mind, since they can ask a significantly more difficult question that only someone interested in the topic would know.

Like say, how a PhD maths related community or blog might ask a university level maths question, a chess forum may ask a chess related one and one about a certain gaming franchise might ask questions about said franchise. Bonus points for keeping out people with no genuine interest in the topic.

Re: Ask HN: A Good Alternative for ReCaptcha?

#168

Post by MarkyC4 »

benburleson wrote: post #106
ghusbands wrote: post #84

Earlier quoted context omitted.

Note that that library is not accessible and is hence illegal to use for most websites in the US. I've raised an issue on the project [1]. [1] https://github.com/markets/invisible_captcha/issues/52

Whoa, it is actually illegal to make "not accessible" websites?

Ontario, Canada has a similar (maybe a bit more relaxed) law: https://www.ontario.ca/page/how-make-websites-accessible

Re: Ask HN: A Good Alternative for ReCaptcha?

#169

Post by ufmace »

sjamaan wrote: post #66
jedberg wrote: post #19

There was a good podcast about this [0] just a couple weeks ago. They interviewed the guy who invented CAPTCHA as well as the head engineer on ReCaptcha v3. The gist of it was that in a few years, all Captchas will be useless because machine learning is too easy and cheap. The only way to defeat spam will be to use reCaptcha v3 or something like it, because those services will use what they know about you to determin…

> those services will use what they know about you This is inherently user-hostile, as it presupposes tracking and identification. I don't want them to know anything about me!

Which is kind of the trick - there may be a point not to far in the future where it is nearly impossible to tell the difference between hostile bots and users who are just really into privacy and not being tracked.

Re: Ask HN: A Good Alternative for ReCaptcha?

#170

Post by r00fus »

benburleson wrote: post #106
ghusbands wrote: post #84

Earlier quoted context omitted.

Note that that library is not accessible and is hence illegal to use for most websites in the US. I've raised an issue on the project [1]. [1] https://github.com/markets/invisible_captcha/issues/52

Whoa, it is actually illegal to make "not accessible" websites?

https://www.section508.gov/manage/laws-and-policies

They even have a compliance tester.

Post reply on HN