Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: A Good Alternative for ReCaptcha?

news.ycombinator.com

Post reply on HN
Print view View original

191–200 of 207 posts

Re: Ask HN: A Good Alternative for ReCaptcha?

#191

Post by contravariant »

snowwrestler wrote: post #173
jm4 wrote: post #161

Earlier quoted context omitted.

That will work for low end drive by stuff. Anyone motivated will have a better bot. I was running one 10-12 years ago that was essentially a headless browser. It had a JavaScript runtime and a custom DOM. It could run jquery, prototype, ajax and just about everything else that was popular at the time. I even had a custom flash runtime in there for the jackass sites with the nav in flash. These days you could just thr…

Does any kind of captcha stop a targeted attack? I don't think that's what captchas are for.

Some webpages seem to use captchas to stop (targeted) DDOSs, having a easily defeated (but unique) Captcha might not help in those scenarios.

Re: Ask HN: A Good Alternative for ReCaptcha?

#192

Post by maple3142 »

lucb1e wrote: post #25
temp99990 wrote: post #4

I’m a fan of the Chinese-style captchas where you just move a puzzle piece with a slider. I have no idea how defeatable it is vs reCaptcha but it’s far far less painful.

I don't know these, do you have an example?

QQ mail have this captcha: https://mail.qq.com/ This is how it looks: https://i.imgur.com/9Am4PWu.png

Re: Ask HN: A Good Alternative for ReCaptcha?

#194

Post by hakfoo »

unnouinceput wrote: post #193

I like those math questions captcha. Fun and I doubt a bot or even a real persona spammer will waste time on this. Make the question appear on an image instead of text and the bot will also have to do OCR on top of being wolframalpha to defeat your captcha.

TBH, I had decent results with the most trivial "3+4=" style CAPTCHAs. I know some sites where there's even only a single, hard-coded question/answer.

In the world where it's not about scaling to infinity, you're not getting targeted attacks, you're getting stupid bots that pummel every site thinking it's a WordPress install from 2007 and anything different is enough to scuttle it.

By the time your service is popular enough to justify building a focused bot or tossing low-wage workers at it, hopefully you have the revenue in to finance something more sophisticated.

Re: Ask HN: A Good Alternative for ReCaptcha?

#195

Post by hakfoo »

jedberg wrote: post #19

There was a good podcast about this [0] just a couple weeks ago. They interviewed the guy who invented CAPTCHA as well as the head engineer on ReCaptcha v3. The gist of it was that in a few years, all Captchas will be useless because machine learning is too easy and cheap. The only way to defeat spam will be to use reCaptcha v3 or something like it, because those services will use what they know about you to determin…

It's not about machine learning, it's about a spray and pray business model.

If your goal is to generate, say, 5,000 spammy backlinks you're going to have the choice of building smarter and smarter bots to bypass CAPTCHAs and filters, or just tossing the same dumb bots at a wider pool of target sites. The latter is always cheaper, if you're focused around your basic blog-spam sort of scenario.

I could see it different if you had a specific high-value service that was worth bot writers targeting-- think of registering email accounts en masse, or an ecommerce site getting thousands of test charges an hour on stolen cards. But even then it's still about just a matter of being "faster than the other guy the lion is chasing" -- you just need to be inconvenient enough that the malicious user finds a more accomodating service. That needs little in the way of an AI arms race, it can be something as simple as rate limiting.

Re: Ask HN: A Good Alternative for ReCaptcha?

#196

Post by dang »

IgorPartola wrote: post #94
avian wrote: post #43

Earlier quoted context omitted.

> The only "risk" is that in the future spammers might start using more sophisticated spambots You’re also making your website unusable for people with Javascript blocked or disabled in their browsers.

Why stop there? I block HTML on all websites. Can’t show me ads if HTML is blocked. I also usually browse the web through an Ethernet connection. Don’t trust WiFi. And to make it more secure, my cables only have three wires in them. Less wires means fewer places for hackerz to hide.

Please don't do this here.

Re: Ask HN: A Good Alternative for ReCaptcha?

#197

Post by zaarn »

clarry wrote: post #20
jedberg wrote: post #19

There was a good podcast about this [0] just a couple weeks ago. They interviewed the guy who invented CAPTCHA as well as the head engineer on ReCaptcha v3. The gist of it was that in a few years, all Captchas will be useless because machine learning is too easy and cheap. The only way to defeat spam will be to use reCaptcha v3 or something like it, because those services will use what they know about you to determin…

> The only way to defeat spam No, no, no. There are many ways to combat spam, and there is no silver bullet. "Determining whether you're a bot or not" is just one tool among many, and one that lets human spammers through, or gets too intrusive and starts blocking humans. IMO the best approach still is to focus on the content they post rather than trying to figure out who/what they are.

Google wants you to think reCaptcha is the ONLY tool. That way they can get more user data.

Re: Ask HN: A Good Alternative for ReCaptcha?

#198

Post by londons_explore »

ghusbands wrote: post #85
icebraining wrote: post #76

Earlier quoted context omitted.

Nope, screen readers (usually?) ignore elements with "display: none". To be sure, you could add aria-hidden="true", which I'd guess most bots don't recognize. http://alistapart.com/article/now-you-see-me/

Many don't just use display:none but position text off-screen or make it tiny or use sizing and overflow:hidden. I've seen a blind user be tripped up by these, so yes, it often also filters out disabled users.

A decent screen reader will look at the final rendered Dom and obviously cull items off-screen, the same colour as the background, or 1px high.

If it doesn't, its a bug in the screen reader.

Re: Ask HN: A Good Alternative for ReCaptcha?

#199

Post by ghusbands »

londons_explore wrote: post #198
ghusbands wrote: post #85

Earlier quoted context omitted.

Many don't just use display:none but position text off-screen or make it tiny or use sizing and overflow:hidden. I've seen a blind user be tripped up by these, so yes, it often also filters out disabled users.

A decent screen reader will look at the final rendered Dom and obviously cull items off-screen, the same colour as the background, or 1px high. If it doesn't, its a bug in the screen reader.

No such screen reader exists, so you could claim it's a bug in all of them, but it's not a useful position to take. Screen readers are tricky enough to write without having to second-guess people who are trying to hide-but-not-hide text.

Re: Ask HN: A Good Alternative for ReCaptcha?

#200

Post by detaro »

londons_explore wrote: post #198
ghusbands wrote: post #85

Earlier quoted context omitted.

Many don't just use display:none but position text off-screen or make it tiny or use sizing and overflow:hidden. I've seen a blind user be tripped up by these, so yes, it often also filters out disabled users.

A decent screen reader will look at the final rendered Dom and obviously cull items off-screen, the same colour as the background, or 1px high. If it doesn't, its a bug in the screen reader.

There's quite clear standards on how screen readers are expected to interact with the DOM. What you claim is in none of them, and the techniques you mention are explicitly mentioned as something authors of webpages should avoid/mark up correctly for screenreaders.
Post reply on HN