181–190 of 207 posts
I also recommend mailing the website owners who uses ReCaptcha about why it's a nuisance and stating that you and many others won't be using the site anytime soon.
Earlier quoted context omitted.
Be very careful how you do this, unless you want to exclude blind users. I've seen a blind user have an online form silently fail at them because they filled in a field that wasn't visible. Using display:none applied indirectly via CSS is probably reasonably effective against bots and won't interfere with screen-readers.
Are there tools or guides to help test how websites "appear" to people with disabilities ? It is difficult to design something if you don't have an idea of what will be the outcome, but I wouldn't know which software is used by (e.g.) a blind user, let alone how I would use it.
First, can you navigate your entire site without using a mouse (including any widgets, forms, embeded stuff)? You should also have a "Skip to main content" button that is the first element you hit when you tab into your page.
Next, download the NVDA screen reader, which is free, turn off your monitor (or close your eyes), and navigate your site using it. I recommend using FireFox for this.
Finally, use a color contrast analyzer plugin for your browser to ensure you have enough contrast between all of you elements.
From there, you can review the WCAG 2.0 spec to get into the fine details. If you have the budget, hire a consultant/contractor. What I described above doesn't make your site pleasent to use for a disable person, just usable.
For the use case of blocking general web form spam, we've had good results with relying solely on IP reputation crowdsourced via AbuseIPDB: https://www.abuseipdb.com/about Occasionally we're an early target of a fresh IP, but we report it back to the database to help later victims. The more people contribute to such a system, the better it gets.
Many IPs are shared by more than one endpoint, and hundreds or thousands of endpoints sometimes share a single IP. Say a home router is compromised on an ISP using CGNAT and you block by IP, you could potentially be blocking an entire neighborhood of innocent users. Having parts of the Internet blocked for huge numbers of their customers puts pressure on ISPs to monitor and censor users traffic, which is not the dire…
Another value that I hold is that the cost of bad actors shouldn't be externalized to innocent people, i.e. that it's unfair for me to pay the cost of completing a captcha just because somebody somewhere else is misbehaving.
I'm not sure how to reconcile those.
Earlier quoted context omitted.
Whoa, it is actually illegal to make "not accessible" websites?
In the US, it is if you're an incorporated business serving as a "public accommodation" as defined in the Americans with Disabilities Act, which includes hotels, restaurants, theaters, storefronts. If it is just your personal blog, it doesn't apply. It is the same law that requires storefronts to have wheelchair ramps, but not homes. See Gil v. Winn-Dixie: https://scholar.google.com/scholar_case?case=674450226911160.…
[1] https://www.businessnewsdaily.com/10900-ada-website-requirem...
Earlier quoted context omitted.
Does any kind of captcha stop a targeted attack? I don't think that's what captchas are for.
Maybe. Maybe not. They are pretty darn difficult. I’ve seen a few that are fairly straightforward to break. For the good ones, you’d need some quality CV tech and if what you have is that good then you’re probably better off using it for something other than breaking captchas in order to post comment spam for penis pills or whatever they are peddling these days.
For bots which are not specifically targeted at your page i simply add an invisible form element named url. Bots _LOVE_ to share their viagra urls. Any request which submitted an url is discarded. This trick is simple stupid and should not work but somehow the simple spam bots have not improved. This does not work for sophisticated bots (never met one) or the ones programmed specifically for your site (happens very r…
Be very careful how you do this, unless you want to exclude blind users. I've seen a blind user have an online form silently fail at them because they filled in a field that wasn't visible. Using display:none applied indirectly via CSS is probably reasonably effective against bots and won't interfere with screen-readers.
Elaborate?
Earlier quoted context omitted.
Are there tools or guides to help test how websites "appear" to people with disabilities ? It is difficult to design something if you don't have an idea of what will be the outcome, but I wouldn't know which software is used by (e.g.) a blind user, let alone how I would use it.
Simply try to browse the page without using mouse, just the tab key. The next step would be to use screen reader, NVDA[1] (Windows) or Apple VoiceOver (MacOS). There are automated testing tools, but they don't cover the whole spectrum of problems. Nevertheless you can try * WAVE (Chrome or FF plugin, https://wave.webaim.org/extension/ ) * AXE ( https://www.deque.com/axe/ ) * AChecker ( https://achecker.us/checker/ind…
I think it is best to design your own captcha around your use case. All you need to do is make the amount of work for spammers too high for targeting your site. Just recently, I added the idea of a captcha that might actually be enjoyable for users to my list of "things that should exist": http://www.gibney.de/things_that_should_exist The idea is to show the user a random image and ask what is on it. If the image is…
PassThePopcorn has a similar CAPTCHA-like implementation to the Pexels one you mentioned in your article. It has a repository of movie posters (which I think are user submitted to the movies themselves), one of which is chosen and the user is asked what movie the poster is for. I've always thought of that as an "enjoyable" CAPTCHA.
Earlier quoted context omitted.
It really doesn't matter. display:none or position:absolute;left:-1000px makes little difference. Honey pots only catch a small number of bots.
I just removed Google's ReCaptcha for a honeypot solution with an additional name and url field. But there's also a timer which checks how long it takes you to submit the form. If you can fill out everything in <2s, you're most likely not human. I have to figure out how people with disabilities can use the page though. Good to get a reminder here. So far it performs way better than ReCaptcha, I haven't received any s…
Do you anticipate any problems with form auto-filling tools?