Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: A Good Alternative for ReCaptcha?

news.ycombinator.com

Post reply on HN
Print view View original

171–180 of 207 posts

Re: Ask HN: A Good Alternative for ReCaptcha?

#171

Post by bo1024 »

quickthrower2 wrote: post #134
bo1024 wrote: post #71

Earlier quoted context omitted.

You could use JavaScript cryptocurrency mining instead. User clicks a button to activate miner script, it runs in their browser for 10-30 seconds or whatever, then reports back to your server that they are good to go.

You’ll lose people who are blocking this kind of shit. Also you might end up on a Firefox blacklist.

Don't know how the blacklist works. As someone who blocks javascript by default, if I were asked to enable this to submit a login, I would probably be okay doing so if I could be confident a script was only mining and not fingerprinting me. (Big if)

Re: Ask HN: A Good Alternative for ReCaptcha?

#172

Post by bjoli »

pdimitar wrote: post #143
bjoli wrote: post #92

I have a mail server with a new address generated per post (or per comment for thread functionality) on a blog i run. People then get to mail their comments. For all reputable mail sites I let things directly through, for everything else I use a spam filter turned to 11 together with a mail-back link for post verification. I have had zero spam the last 8 years. The code is ancient and runs on an even older version of…

Have you considered open-sourcing that and posting it on HN? I'd use it.

I have been asked to many times, but it is part of a largish website written in Common Lisp. The codebase is written by me over 3 years with no consideration for modularity. It would be a considerable effort to break it out.

There is nothing technically novel about it. Heck, python even includes an SMTP server in the stdlib. You could.probably write a PoC in a couple of hours.

Re: Ask HN: A Good Alternative for ReCaptcha?

#173

Post by snowwrestler »

jm4 wrote: post #161
jermaustin1 wrote: post #125

The best solution I've ever come to that didn't negatively impact my clients was generating a UUID on the server via an ajax call 100ms after page load. That UUID was stored in a cookie, and returned via AJAX and stuck it in a hidden field on the form. Server checks cookie != null and cookie == hidden field, and returned a 200 OK regardless of if it failed (used the response text for success or failure indication), a…

That will work for low end drive by stuff. Anyone motivated will have a better bot. I was running one 10-12 years ago that was essentially a headless browser. It had a JavaScript runtime and a custom DOM. It could run jquery, prototype, ajax and just about everything else that was popular at the time. I even had a custom flash runtime in there for the jackass sites with the nav in flash. These days you could just thr…

Does any kind of captcha stop a targeted attack? I don't think that's what captchas are for.

Re: Ask HN: A Good Alternative for ReCaptcha?

#175

Post by xofer »

ghusbands wrote: post #79
tpetry wrote: post #32

For bots which are not specifically targeted at your page i simply add an invisible form element named url. Bots _LOVE_ to share their viagra urls. Any request which submitted an url is discarded. This trick is simple stupid and should not work but somehow the simple spam bots have not improved. This does not work for sophisticated bots (never met one) or the ones programmed specifically for your site (happens very r…

Be very careful how you do this, unless you want to exclude blind users. I've seen a blind user have an online form silently fail at them because they filled in a field that wasn't visible. Using display:none applied indirectly via CSS is probably reasonably effective against bots and won't interfere with screen-readers.

I've used this technique with a label that said "Leave Blank", also hidden with CSS. Seemed to work great, but now I wonder.

Re: Ask HN: A Good Alternative for ReCaptcha?

#176

Post by packet_nerd »

aendruk wrote: post #165

For the use case of blocking general web form spam, we've had good results with relying solely on IP reputation crowdsourced via AbuseIPDB: https://www.abuseipdb.com/about Occasionally we're an early target of a fresh IP, but we report it back to the database to help later victims. The more people contribute to such a system, the better it gets.

Many IPs are shared by more than one endpoint, and hundreds or thousands of endpoints sometimes share a single IP. Say a home router is compromised on an ISP using CGNAT and you block by IP, you could potentially be blocking an entire neighborhood of innocent users.

Having parts of the Internet blocked for huge numbers of their customers puts pressure on ISPs to monitor and censor users traffic, which is not the direction I want to see the Internet go.

IPs do not have a one-to-one relationship with users, and I feel strongly that they shouldn't be treated as if they do.

Re: Ask HN: A Good Alternative for ReCaptcha?

#177

Post by rahuldottech »

dageshi wrote: post #100
avian wrote: post #43

Earlier quoted context omitted.

> The only "risk" is that in the future spammers might start using more sophisticated spambots You’re also making your website unusable for people with Javascript blocked or disabled in their browsers.

I can't think of any reason why js would be disabled in a browser other than by personal choice? In which case you're making the website unusuable for yourself.

It's often disabled by people who use screen readers, or by users who care about their privacy.

If your regular website (not a webapp) doesn't work without JS, then you're failing as a dev.

Re: Ask HN: A Good Alternative for ReCaptcha?

#178

Post by packet_nerd »

realcr wrote: post #21

I had a strange idea about solving this problem: How about a micro-payment, something like $0.01, instead of solving a puzzle? In that case maybe you won't care if many bots login to your website. I think that I by this time I have the technology to make something like this work, I was wondering if this is a good solution though. What do you think?

I and I think most people would be happy to pay a small amount to each site we visit, but payments system to make the idea practical just doesn't exist. I for sure am not going to hand out my CC number everywhere; it's inconvenient, it's intrusive (full legal name, address, phone number), and I have no idea how securely and for how long they store that information.

I would really love to see a way to make small payments to sites that I visit simply and all managed in one place.

Re: Ask HN: A Good Alternative for ReCaptcha?

#179

Post by tongo »

ghusbands wrote: post #79
tpetry wrote: post #32

For bots which are not specifically targeted at your page i simply add an invisible form element named url. Bots _LOVE_ to share their viagra urls. Any request which submitted an url is discarded. This trick is simple stupid and should not work but somehow the simple spam bots have not improved. This does not work for sophisticated bots (never met one) or the ones programmed specifically for your site (happens very r…

Be very careful how you do this, unless you want to exclude blind users. I've seen a blind user have an online form silently fail at them because they filled in a field that wasn't visible. Using display:none applied indirectly via CSS is probably reasonably effective against bots and won't interfere with screen-readers.

We do this, but we've labeled our field very explicitly with something along the lines of "Please leave this field blank, it is for SPAM control.". We also provide a hidden error message if it is filled in to alert the user that it really should be blank.

It's also always place this field after the Submit button with the idea that a user with a screen reader would never make it that far. Bots still see it and add it to the post request since I don't think they care about the order of the form fields.

Re: Ask HN: A Good Alternative for ReCaptcha?

#180

Post by jm4 »

snowwrestler wrote: post #173
jm4 wrote: post #161

Earlier quoted context omitted.

That will work for low end drive by stuff. Anyone motivated will have a better bot. I was running one 10-12 years ago that was essentially a headless browser. It had a JavaScript runtime and a custom DOM. It could run jquery, prototype, ajax and just about everything else that was popular at the time. I even had a custom flash runtime in there for the jackass sites with the nav in flash. These days you could just thr…

Does any kind of captcha stop a targeted attack? I don't think that's what captchas are for.

Maybe. Maybe not. They are pretty darn difficult. I’ve seen a few that are fairly straightforward to break. For the good ones, you’d need some quality CV tech and if what you have is that good then you’re probably better off using it for something other than breaking captchas in order to post comment spam for penis pills or whatever they are peddling these days.
Post reply on HN