You probably don’t need ReCAPTCHA • Hacker News Board

Re: You probably don’t need ReCAPTCHA

#81

Post by seancoleman » Wed, Jun 12, 2019, 3:02 AM UTC

I fought an interesting implementation of customized spam on a web app registration form a few months back. Suddenly, every 2-3 seconds, we would get a sign up from a random email address @qq.com (it really clogged our sign up Slack channel). I didn’t want to go full CAPTCHA so I dropped in a simple honeypot and the spam stopped for a good 4-5 hours. Then it picked right back up like normal. I then implemented a randomized honeypot, e.g. and again, it ceased immediately and picked up a few hours later. Finally I just blocked all submissions with emails @qq.com and it stopped completely and hasn’t returned months later.

Sometimes I wonder if there was a real person on the other end writing code to combat the code I was writing at the same time, and finally gave up on the 3rd iteration.

Re: You probably don’t need ReCAPTCHA

#82

Post by partlyFluked » Wed, Jun 12, 2019, 3:12 AM UTC

I've noticed a number of major cryptocurrency exchanges using this slide puzzle as a form of captcha [1]. I dont exactly know how it works but I assume the jittery nature of a human sliding a mouse is enough to discern the bots from the nots. Are there any major downsides to this form of captcha that I may be missing? [1] https://www.geetest.com/en/

EDIT: I now see the article does actually mention this, though I still do wonder how far the fingerprinting goes.

Re: You probably don’t need ReCAPTCHA

#83

Post by ShamelessC » Wed, Jun 12, 2019, 3:18 AM UTC

Wowfunhappy wrote: post #40

dylanz wrote: post #39

Earlier quoted context omitted.

They are definitely an issue for accessibility. I make sure to put "Hey! Don't put anything in this field!" as a placeholder.

That sounds like something bots could easily adapt to if the practice become widespread.

It's already widespread. But, it requires customization to overcome for many spammers. Depending on the popularity of your site, your threat model may require you to do more. But it is still a useful tool.

Re: You probably don’t need ReCAPTCHA

#84

Post by [deleted] » Wed, Jun 12, 2019, 3:19 AM UTC

blakesterz wrote: post #13

"Many developers vastly over-estimate the likelihood of customized spam." I run 100s of small random low traffic low priority sites. Without some form of form control, the ALL get hit with customized and random other crap spam. I don't have decent experience with many things in life, but I can say this is one topic I have YEARS of experience with. I've never over-estimated the amount of any type of spam any form can…

[deleted]

Re: You probably don’t need ReCAPTCHA

#85

Post by saltyhiker » Wed, Jun 12, 2019, 3:24 AM UTC

I had this same thought in 2013 and created this library which uses a few simple tests to protect from comment spam. It definitely could be improved/tuned (and oof this code I wrote is baaaad), but for many sites it is good enough. https://github.com/mccarthy/phpFormProtect

Re: You probably don’t need ReCAPTCHA

#86

Post by dev_dull » Wed, Jun 12, 2019, 3:35 AM UTC

charrondev wrote: post #61

mattigames wrote: post #22

Earlier quoted context omitted.

Did you try randomizing the 'name' and 'ids' of the inputs? (including the invisible one)

I was preparing a response here, but many of the other commenters have covered it. I recently spent time ensuring our Auth pages’ HTML could be easily cached outside of our application servers. They were a common target of DDOS attacks because we were generating a unique nonce for CSRF protection. Randomizing form field names does not defeat a targeted attacker (and we have definitely been a target), prevents HTML ca…

> and will prevent auto filling fields by browsers and password managers.

I would MUCH prefer the recaptcha over this!

Re: You probably don’t need ReCAPTCHA

#87

Post by Washuu » Wed, Jun 12, 2019, 3:38 AM UTC

seancoleman wrote: post #81

I fought an interesting implementation of customized spam on a web app registration form a few months back. Suddenly, every 2-3 seconds, we would get a sign up from a random email address @qq.com (it really clogged our sign up Slack channel). I didn’t want to go full CAPTCHA so I dropped in a simple honeypot and the spam stopped for a good 4-5 hours. Then it picked right back up like normal. I then implemented a rand…

There is someone else on the other end. I had one of them previously get on the forums I worked on and complain about how quick I was to blocked them. I wrote an entire system for learning the patterns and automatically blocking them as they occurred. Eventually I determined that the vast majority of the IP addresses originated from Bangladesh so I just banned the entire country from accessing the web sites. That was the only solution, unfortunately for those legitimate users there, that made the spam stop for good.

Re: You probably don’t need ReCAPTCHA

#88

Post by smt88 » Wed, Jun 12, 2019, 3:46 AM UTC

mattigames wrote: post #43

netok wrote: post #38

Earlier quoted context omitted.

It will also ignore people who use browser's autofill form function. Realized this after receiving a dozen complaints.

You can randomly generate the "name" of the fields and autofill will never fill them, another option to disable autocomplete is to leave them without "name" and handling the submit using JavaScript.

Disabling autocomplete is user-hostile and additionally should be considered a security flaw. It makes it harder to use password managers.

Re: You probably don’t need ReCAPTCHA

#89

Post by techslave » Wed, Jun 12, 2019, 3:52 AM UTC

i had to give up after the 10 or 12 anti google paragraphs. after reading that, this website certainly doesn’t need recaptcha because i’m going away!

there were a couple of feints as if he were about to get to the content, then ha! back to diatribe.

Re: You probably don’t need ReCAPTCHA

#90

Post by DCoder » Wed, Jun 12, 2019, 3:57 AM UTC

charrondev wrote: post #61

mattigames wrote: post #22

Earlier quoted context omitted.

Did you try randomizing the 'name' and 'ids' of the inputs? (including the invisible one)

I was preparing a response here, but many of the other commenters have covered it. I recently spent time ensuring our Auth pages’ HTML could be easily cached outside of our application servers. They were a common target of DDOS attacks because we were generating a unique nonce for CSRF protection. Randomizing form field names does not defeat a targeted attacker (and we have definitely been a target), prevents HTML ca…

> Randomizing form field names […] will prevent auto filling fields by browsers and password managers.

I wholly agree that this would not help, but for the sake of completeness, I want to point out that [0] is designed to solve this, by decoupling input field names from their intent.

But Chrome is playing dumb about it [1]. And of course, the spambots will just adapt to parse the autocomplete info…

[0]: https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes...

[1]: https://www.reddit.com/r/programming/comments/ar1qj1/chromiu...