Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You probably don’t need ReCAPTCHA

kevv.net

Post reply on HN
Print view View original

11–20 of 246 posts

Re: You probably don’t need ReCAPTCHA

#11

Post by cardine »

In my experience, the biggest issue I run into is targeted botnet brute force attacks.

In cases like these, someone loads up a huge botnet, a downloaded list of hacked usernames and passwords, and tries every single combination hoping to find a reused username/password combination.

In these cases, it is almost always extremely targeted. Log correlation has helped quite a bit, but it is still very painful since they alternate IPs with every request.

Automatically adding a blanket ReCAPTCHA on all login pages during a distributed brute force attempt is one of the few things that actually stops an attacker like this with minimal negative consequences.

I'm sure it is frustrating to users, but I think service disruption from what is effectively a DDoS is a worse user experience.

Re: You probably don’t need ReCAPTCHA

#12

Post by tgsovlerkhgsel »

gsich wrote: post #5
scarface74 wrote: post #2

Microsoft’s implementation is the worse. I sometimes have a hard time deciphering the captcha. Why do they need that in an iOS app? Are robots emulating people from an iPhone?

User agent is quickly changed.

Doesn't iPhone have some sort of device attestation?

Re: You probably don’t need ReCAPTCHA

#13

Post by blakesterz »

"Many developers vastly over-estimate the likelihood of customized spam."

I run 100s of small random low traffic low priority sites. Without some form of form control, the ALL get hit with customized and random other crap spam. I don't have decent experience with many things in life, but I can say this is one topic I have YEARS of experience with. I've never over-estimated the amount of any type of spam any form can get after being on the web for just a few months. Doesn't matter how big they are or what they do.

I'm not saying ReCAPTCHA is the only thing out there or even the best, but having an open form is just asking for trouble.

Re: You probably don’t need ReCAPTCHA

#14

Post by [deleted] »

hawaiian wrote: post #8

ReCAPTCHA has crossed into the domain of cattle-corralling users and thus should be considered harmful. If the system decides it doesn't like you (most likely because you're "too anonymous," but you don't really know) you will be presented with slower-loading images to click and more click-all-the-things rounds. To pretend this is about slowing down bots is disingenuous as best. On top of that, usage of ReCAPTCHA per…

[deleted]

Re: You probably don’t need ReCAPTCHA

#15

Post by vkou »

hawaiian wrote: post #8

ReCAPTCHA has crossed into the domain of cattle-corralling users and thus should be considered harmful. If the system decides it doesn't like you (most likely because you're "too anonymous," but you don't really know) you will be presented with slower-loading images to click and more click-all-the-things rounds. To pretend this is about slowing down bots is disingenuous as best. On top of that, usage of ReCAPTCHA per…

Because when you don't annoy 'too anonymous' users with obnoxious captchas, your service gets flooded with spam, which annoys every single other user.

> To pretend this is about slowing down bots is disingenuous as best.

I'm not sure you have a good understanding of what happens to internet services when they don't throttle spam. They become completely unusable.

Re: You probably don’t need ReCAPTCHA

#16

Post by sbov »

blakesterz wrote: post #13

"Many developers vastly over-estimate the likelihood of customized spam." I run 100s of small random low traffic low priority sites. Without some form of form control, the ALL get hit with customized and random other crap spam. I don't have decent experience with many things in life, but I can say this is one topic I have YEARS of experience with. I've never over-estimated the amount of any type of spam any form can…

Have an input element that can't be seen. If it has something in it, ignore the submit. Works for all my sites so far.

Re: You probably don’t need ReCAPTCHA

#17

Post by charrondev »

sbov wrote: post #16
blakesterz wrote: post #13

"Many developers vastly over-estimate the likelihood of customized spam." I run 100s of small random low traffic low priority sites. Without some form of form control, the ALL get hit with customized and random other crap spam. I don't have decent experience with many things in life, but I can say this is one topic I have YEARS of experience with. I've never over-estimated the amount of any type of spam any form can…

Have an input element that can't be seen. If it has something in it, ignore the submit. Works for all my sites so far.

Doesn’t work as soon as you’re big enough to target.

The company I work for makes a SaSS forum product, and while we do have multiple spam prevention methods (akismet, stopforumspam, honeypot, a hidden input), there’s enough stuff out there that has targeted our platform that a Recaptcha on the registration form is needed.

We haven’t need it on any other forms yet though. After registration it’s all handled by the other methods and various moderation tools.

Re: You probably don’t need ReCAPTCHA

#18

Post by applecrazy »

hawaiian wrote: post #8

ReCAPTCHA has crossed into the domain of cattle-corralling users and thus should be considered harmful. If the system decides it doesn't like you (most likely because you're "too anonymous," but you don't really know) you will be presented with slower-loading images to click and more click-all-the-things rounds. To pretend this is about slowing down bots is disingenuous as best. On top of that, usage of ReCAPTCHA per…

There should be an open source captcha solution where all the labeled images can be used to develop a model available freely to the public.

Re: You probably don’t need ReCAPTCHA

#19

Post by feikname »

vkou wrote: post #15
hawaiian wrote: post #8

ReCAPTCHA has crossed into the domain of cattle-corralling users and thus should be considered harmful. If the system decides it doesn't like you (most likely because you're "too anonymous," but you don't really know) you will be presented with slower-loading images to click and more click-all-the-things rounds. To pretend this is about slowing down bots is disingenuous as best. On top of that, usage of ReCAPTCHA per…

Because when you don't annoy 'too anonymous' users with obnoxious captchas, your service gets flooded with spam, which annoys every single other user. > To pretend this is about slowing down bots is disingenuous as best. I'm not sure you have a good understanding of what happens to internet services when they don't throttle spam. They become completely unusable.

ReCAPTCHA doesn't prevent the kind of spam that makes internet services completely unusable (i.e. DDoS botnets), it prevents form submition spam.

Re: You probably don’t need ReCAPTCHA

#20

Post by chii »

cardine wrote: post #11

In my experience, the biggest issue I run into is targeted botnet brute force attacks. In cases like these, someone loads up a huge botnet, a downloaded list of hacked usernames and passwords, and tries every single combination hoping to find a reused username/password combination. In these cases, it is almost always extremely targeted. Log correlation has helped quite a bit, but it is still very painful since they a…

and you can easily count the number of failed attempts from a particular IP, and just show captcha for those over X failures, rather than every login. Normal users don't fail _that_ many times, and so are non-the-wiser.
Post reply on HN