You probably don’t need ReCAPTCHA • Hacker News Board

Re: You probably don’t need ReCAPTCHA

#111

Post by luckylion » Wed, Jun 12, 2019, 5:11 AM UTC

hombre_fatal wrote: post #52

WillPostForFood wrote: post #44

Earlier quoted context omitted.

Rotate through several thousand to several hundred thousand noncontiguous, geographically distributed, residential IP addresses How are they getting residential IP addresses, compromised PCs?

https://luminati.io/#pricing

Sounds like the answer is to increase the response size for failed login requests. At $12.5/G, if you blow up your response to a mega byte, they'll spend about a cent per try - close to the rate they'll need to pay to have recaptchas solved by humans.

Re: You probably don’t need ReCAPTCHA

#112

Post by donatj » Wed, Jun 12, 2019, 5:12 AM UTC

In my experience, the vast majority of spam bots don’t run JavaScript, so simply setting a hidden input to a specific value on key down and checking for said value server side has prevented 99%.

Re: You probably don’t need ReCAPTCHA

#113

Post by aventrix » Wed, Jun 12, 2019, 5:16 AM UTC

donatj wrote: post #112

In my experience, the vast majority of spam bots don’t run JavaScript, so simply setting a hidden input to a specific value on key down and checking for said value server side has prevented 99%.

Seems to me this would interfere with the accessibility of the website for those that use screen readers.

Re: You probably don’t need ReCAPTCHA

#114

Post by meruru » Wed, Jun 12, 2019, 5:17 AM UTC

ve55 wrote: post #41

shakna wrote: post #36

Earlier quoted context omitted.

From a French IP that usually gets flagged by everybody as potentially a robot, I see exactly 0 JS on the HN login form. Are you sure it is HN that uses ReCAPTCHA?

I've seen multiple comments suggesting HN uses ReCAPTCHA, but I have never encountered it myself, and I even have Javascript disabled and login through 'anonymous' IPs such as tor, so I'm unsure what these users could be doing that is 'worse' to trigger ReCAPTCHAs. If most users don't even know that ReCAPTCHA is used, that's a good sign that it is being used as little as possible, though.

Same here. I only log in through Tor and I'd never have imagined HN uses ReCAPTCHA if it wasn't for people suggesting that.

Re: You probably don’t need ReCAPTCHA

#115

Post by meruru » Wed, Jun 12, 2019, 5:18 AM UTC

hombre_fatal wrote: post #56

shakna wrote: post #36

Earlier quoted context omitted.

From a French IP that usually gets flagged by everybody as potentially a robot, I see exactly 0 JS on the HN login form. Are you sure it is HN that uses ReCAPTCHA?

I've seen it before. In fact, I'd double checked last time I brought it up and it was there on /login in an incognito tab. Either HN has changed or they now conditionally load it. For example, I encountered it every time I used Tor on HN, though I haven't hit /login in months.

I only login through Tor and I never encounter it.

Re: You probably don’t need ReCAPTCHA

#116

Post by luckylion » Wed, Jun 12, 2019, 5:23 AM UTC

gbear605 wrote: post #102

feikname wrote: post #19

Earlier quoted context omitted.

ReCAPTCHA doesn't prevent the kind of spam that makes internet services completely unusable (i.e. DDoS botnets), it prevents form submition spam.

To be fair, spamming a user-submitted content site (for example, a blog with comments) is just as bad as a DDoS; either one makes the site unusable.

Most forum or blog comment spam I've seen was trivial to detect, even without access to the server. Isn't written in the right language? Very likely spam. Contains a link and little text? Very likely spam.

If you have access to the server's information, it gets even better. Origin makes it much easier to identify likely spam, previous interactions with the site and their speed ("hits the page and 1s later submits a comment") provide more info.

Sure, all of that can be worked around, but that makes it more complicated and increases the cost for the attacker. If they spend money on faking actual user interaction with your blog, routing all requests through a residential IP in your country etc pp, they are likely spending as much or more than they would on a recaptcha solving service.

Re: You probably don’t need ReCAPTCHA

#117

Post by dearrifling » Wed, Jun 12, 2019, 5:34 AM UTC

Although the Badge pattern makes it flexible to add functions with different badges, this one doesn't have the awkward interface:

https://godbolt.org/z/25k1DG

It just makes use of the non-transitiveness of friend.

Re: You probably don’t need ReCAPTCHA

#118

Post by dangbang2 » Wed, Jun 12, 2019, 5:39 AM UTC

jmpeax wrote: post #71

x = exp(-i)

The rhs is exp(ix), the numerator of the lhs is 2pi^2, and the lhs is some constant C. so the solution should look like x = i*log(C), not exp(-i)

Re: You probably don’t need ReCAPTCHA

#119

Post by jknz » Wed, Jun 12, 2019, 5:39 AM UTC

Requiring to solve ReCapcha after may be more sensible than the usual use case where ReCapcha is required before any interaction.

Let the user create account, let the user create first comment/post, save it somewhere but hide it, then require ReCapcha to make the post visible and activate the account.

The issue with requiring ReCapcha before is that the website owner will never know whether a legitimate user was turned away or whether it was spam.

Re: You probably don’t need ReCAPTCHA

#120

Post by dorgo » Wed, Jun 12, 2019, 5:50 AM UTC

nitrogen wrote: post #107

luckylion wrote: post #103

Earlier quoted context omitted.

> Even with bypass services, cheap is not the same as free, especially at the scale spam runs at. Spam doesn't scale on a small site. Say you can absolutely fill a small site with spam comments to the point that 99% of comments are spam. Very few people visit the site (it's small after all). Fewer still read the comments. Virtually none of those will click on the (usually obvious) spam links. And still fewer will buy…

The spam I see is trying to add little bits of pagerank all over the place.

What about the wikipedia solution for this: rel="nofollow" ?