Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You probably don’t need ReCAPTCHA

kevv.net

Post reply on HN
Print view View original

61–70 of 246 posts

Re: You probably don’t need ReCAPTCHA

#61

Post by charrondev »

mattigames wrote: post #22
charrondev wrote: post #17

Earlier quoted context omitted.

Doesn’t work as soon as you’re big enough to target. The company I work for makes a SaSS forum product, and while we do have multiple spam prevention methods (akismet, stopforumspam, honeypot, a hidden input), there’s enough stuff out there that has targeted our platform that a Recaptcha on the registration form is needed. We haven’t need it on any other forms yet though. After registration it’s all handled by the ot…

Did you try randomizing the 'name' and 'ids' of the inputs? (including the invisible one)

I was preparing a response here, but many of the other commenters have covered it.

I recently spent time ensuring our Auth pages’ HTML could be easily cached outside of our application servers. They were a common target of DDOS attacks because we were generating a unique nonce for CSRF protection.

Randomizing form field names does not defeat a targeted attacker (and we have definitely been a target), prevents HTML caching, and will prevent auto filling fields by browsers and password managers.

Additionally it will be terrible from a usability and accessibility standpoint.

It’s trivial to target a form field by the text/label around it so those would need to be randomized as well.

Re: You probably don’t need ReCAPTCHA

#62

Post by tjpnz »

I don't tend to have too many issues with ReCAPTCHA except when I'm travelling out of the country - then it makes my life really hellish. Given everything Google knows about my travel arrangements you would think they might be able to connect the dots.

Re: You probably don’t need ReCAPTCHA

#63

Post by mirimir »

mcpeepants wrote: post #54
mirimir wrote: post #34

Earlier quoted context omitted.

> automated sneaker buying ??? Please ELI5. I mean, why are sales bad, even if automated? Are they using stolen cards?

Most likely related to high-demand, limited run sneaker "drops", which people then resell on the secondary market. Sneaker-scalpers, if you will. It's a problem because it prevents legit buyers from getting in on the sale.

Why don't they just sell more of them?

Or as ALittleLight says, auction them?

Edit: OK, I know, limited editions. Like numbered and signed prints. But it's arguable that people who want them the most will get them. Even if it's just for resale. Doesn't seem like the seller's responsibility.

Re: You probably don’t need ReCAPTCHA

#64

Post by jachee »

mobjack wrote: post #46
mattigames wrote: post #22

Earlier quoted context omitted.

Did you try randomizing the 'name' and 'ids' of the inputs? (including the invisible one)

I really dont know how well that will work against a dedicated attacker. I am much more confident in ReCAPTCHA of stopping bots compared to any roll your own solution. I dont want to hope that an alternative is good enough for my needs. I want the best when it comes to protecting my site. Any alternative needs to have a proven track record and support to make consider replacing ReCAPTCHA.

How much does ReCAPTCHA's aggressively targeting non-Chrome and/or privacy-enabled browsers and making completing captchas exceedingly difficult factor in your decision?

Do you want your site "protected" from those users, too?

Re: You probably don’t need ReCAPTCHA

#65

Post by jachee »

Wowfunhappy wrote: post #37
applecrazy wrote: post #18

Earlier quoted context omitted.

There should be an open source captcha solution where all the labeled images can be used to develop a model available freely to the public.

Y'know, this would be a great project for Mozilla, if they have the resources for it. They're already doing that crowdsourced voice training data thing.

I bet CloudFlare has the bandwidth for it.

Re: You probably don’t need ReCAPTCHA

#66

Post by chii »

mirimir wrote: post #63
mcpeepants wrote: post #54

Earlier quoted context omitted.

Most likely related to high-demand, limited run sneaker "drops", which people then resell on the secondary market. Sneaker-scalpers, if you will. It's a problem because it prevents legit buyers from getting in on the sale.

Why don't they just sell more of them? Or as ALittleLight says, auction them? Edit: OK, I know, limited editions. Like numbered and signed prints. But it's arguable that people who want them the most will get them. Even if it's just for resale. Doesn't seem like the seller's responsibility.

> Doesn't seem like the seller's responsibility.

sounds like to me that the seller doesn't want the scalper to sell outside the official channels imho. It might dilute the brand as well.

Re: You probably don’t need ReCAPTCHA

#67

Post by kbenson »

T-hawk wrote: post #51
kbenson wrote: post #49

Earlier quoted context omitted.

The only way I see this being useful is if you do this for one or more elements as well as encrypt the name of every input element and also randomize the layout enough that they can't easily use CSS selectors or regular expressions to fine the relevant inputs by page location. I can and have defeated forms that tried to do all of those things very easily in the past. Keep in mind that if you randomize across a few va…

You're not trying to make your site absolutely bot-proof. Someone deliberately targeting your site can figure out any such measures. (You want legitimate users to do so.) You're just trying to throw in enough friction that most common drive-by scripts won't succeed. It's a "don't have to outrun the bear" situation, make yourself just difficult enough that some easier target gets snagged instead.

> It's a "don't have to outrun the bear" situation

If everyone else is incorporating recaptcha, they're all running faster than you. Even with bypass services, cheap is not the same as free, especially at the scale spam runs at. I imagine a mail form that obviously doesn't incorporate a CAPTCHA is going to garner some attention. It might work for weeks or months if it's not being paid attention to, so that's probably worth them spending a few minutes looking at.

Re: You probably don’t need ReCAPTCHA

#68

Post by chii »

hombre_fatal wrote: post #52
WillPostForFood wrote: post #44

Earlier quoted context omitted.

Rotate through several thousand to several hundred thousand noncontiguous, geographically distributed, residential IP addresses How are they getting residential IP addresses, compromised PCs?

https://luminati.io/#pricing

How the hell do they get people to open up their home computer to be used this way?

Re: You probably don’t need ReCAPTCHA

#69

Post by mirimir »

chii wrote: post #66
mirimir wrote: post #63

Earlier quoted context omitted.

Why don't they just sell more of them? Or as ALittleLight says, auction them? Edit: OK, I know, limited editions. Like numbered and signed prints. But it's arguable that people who want them the most will get them. Even if it's just for resale. Doesn't seem like the seller's responsibility.

> Doesn't seem like the seller's responsibility. sounds like to me that the seller doesn't want the scalper to sell outside the official channels imho. It might dilute the brand as well.

Why do "official channels" matter? They're just sneakers.

And why brand dilution? Scalpers sell at a premium, not discounted.

Re: You probably don’t need ReCAPTCHA

#70

Post by briandear »

mobjack wrote: post #46
mattigames wrote: post #22

Earlier quoted context omitted.

Did you try randomizing the 'name' and 'ids' of the inputs? (including the invisible one)

I really dont know how well that will work against a dedicated attacker. I am much more confident in ReCAPTCHA of stopping bots compared to any roll your own solution. I dont want to hope that an alternative is good enough for my needs. I want the best when it comes to protecting my site. Any alternative needs to have a proven track record and support to make consider replacing ReCAPTCHA.

So you force your users to consent to sharing all of their data with Google? That’ll teach ‘em.
Post reply on HN