Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You probably don’t need ReCAPTCHA

kevv.net

Post reply on HN
Print view View original

131–140 of 246 posts

Re: You probably don’t need ReCAPTCHA

#131

Post by darkpuma »

meruru wrote: post #114
ve55 wrote: post #41

Earlier quoted context omitted.

I've seen multiple comments suggesting HN uses ReCAPTCHA, but I have never encountered it myself, and I even have Javascript disabled and login through 'anonymous' IPs such as tor, so I'm unsure what these users could be doing that is 'worse' to trigger ReCAPTCHAs. If most users don't even know that ReCAPTCHA is used, that's a good sign that it is being used as little as possible, though.

Same here. I only log in through Tor and I'd never have imagined HN uses ReCAPTCHA if it wasn't for people suggesting that.

Try creating a new account through Tor, there is a good chance you'll see it then.

Re: You probably don’t need ReCAPTCHA

#132

Post by beiller »

shaki-dora wrote: post #122
briandear wrote: post #70

Earlier quoted context omitted.

So you force your users to consent to sharing all of their data with Google? That’ll teach ‘em.

"all their data" is a bit much, isn't it? ReCAPTCHA gives Google exactly one datum, namely the user's visit to the one page it is on. And I would even hazard a guess that the TOS specify that Google will not retain/link that information, considering that's how Analytics is run.

I am fairly certain that ReCAPTCHA does many things behind the scenes. It probably is using webGL and many other browser features to "fingerprint" your browser, OS, graphics card, sound card, etc. This is simple by just for example drawing some polygons in the background then reading the frame buffer, because different graphics cards / drivers may output different buffers slightly. Then it can store that fingerprint to show you less ReCAPTCHA in the future if you successfully pass the first one. This will also link that fingerprint with all other websites which use google analytics and now they have your full browsing history. The TOS may specify they are not _sharing_ that information, but they can do whatever they want internally to fully mine that data.

Re: You probably don’t need ReCAPTCHA

#133

Post by ComputerGuru »

shaki-dora wrote: post #122
briandear wrote: post #70

Earlier quoted context omitted.

So you force your users to consent to sharing all of their data with Google? That’ll teach ‘em.

"all their data" is a bit much, isn't it? ReCAPTCHA gives Google exactly one datum, namely the user's visit to the one page it is on. And I would even hazard a guess that the TOS specify that Google will not retain/link that information, considering that's how Analytics is run.

No, that's how it used to be. Now with ReCaptcha v3 the recommend you load it on all your pages, not just the forms you are trying to protect, so they can predict friend vs foe more accurately.

Re: You probably don’t need ReCAPTCHA

#134

Post by cf498 »

cardine wrote: post #11

In my experience, the biggest issue I run into is targeted botnet brute force attacks. In cases like these, someone loads up a huge botnet, a downloaded list of hacked usernames and passwords, and tries every single combination hoping to find a reused username/password combination. In these cases, it is almost always extremely targeted. Log correlation has helped quite a bit, but it is still very painful since they a…

It doesnt have to be botnets. Proxylists are enough to enable that attack for almost anyone. Pornsites have had that problem for decades and their solution was captchas, which led to OCR on the attacker site which resulted in stuff like recaptcha. Since you are attacked by one guy who makes a focused effort you are just causing him more effort for the initial setup with the other solutions mentioned not actually stopping him. It sucks but it still beats the alternatives.

Re: You probably don’t need ReCAPTCHA

#135

Post by sroussey »

raverbashing wrote: post #129
throwawaymath wrote: post #31

Earlier quoted context omitted.

As the commenter said, they rotate IPs. It is not that easy. I've also been on the other side of a sophisticated attack like this. The really savvy adversaries do the following, at least: 1. Rotate through several thousand to several hundred thousand noncontiguous, geographically distributed, residential IP addresses, 2. Associate each IP address with a single user agent and suite of cookies, 3. Associate each IP add…

Sounds like big operations like that should have been putting people into jail

If only.

Re: You probably don’t need ReCAPTCHA

#137

Post by atoav »

sb8244 wrote: post #72
briandear wrote: post #70

Earlier quoted context omitted.

So you force your users to consent to sharing all of their data with Google? That’ll teach ‘em.

What's an alternative that works at scale, though? It's easy to say "this is bad for these reasons, don't use it" while ignoring that there's not really better options once you get targeted.

I used a bunch of randomized questions with single word answers (case insensitive and typo tolerant) and hidden fields for years now.

You can use common knowledge or simple ambiguity of language. You can use simple math arithmetic, written in properly obfuscated html. and randomly generated on each page load. You can use custom question about the content of the article (helps with informed answers).

On a small blog of mine just one question with one answer on the contact form prevented all spam for over 5 years already although it would be trivial to exploit in a targeted attack.

Targeted attacks are rare unless your captcha protects a juicy target that is worth a targeted attack at some point.

Re: You probably don’t need ReCAPTCHA

#138

Post by mac_was »

“It’s worth noting how much easier it is to successfully solve ReCAPTCHAs when the user is logged into their Google account”. Well to me it makes absolute sense as Google knows that the logged in user is a human. This article is just following the current trend all Google is bad.

Re: You probably don’t need ReCAPTCHA

#139

Post by lucb1e »

mac_was wrote: post #138

“It’s worth noting how much easier it is to successfully solve ReCAPTCHAs when the user is logged into their Google account”. Well to me it makes absolute sense as Google knows that the logged in user is a human. This article is just following the current trend all Google is bad.

Right, someone can't register a google account and make their spambots bypass CAPTCHAs with it. Just knowing that a human was present once doesn't mean they are always human. Googlen probably lets you pass easily once or twice in a certain amount of time but keeps track and starts giving you more difficult solves as time goes on. But then, someone might register a thousand google accounts and rotate through them to allow cool off time, so I'm not sure how this is handled. It is not a given that rewarding people with a google account is a good thing.

Re: You probably don’t need ReCAPTCHA

#140

Post by lifthrasiir »

Blackthorn wrote: post #50

Literally none of those alternative methods listed worked on my moderate traffic wiki. Recaptcha (and before it went away, identify the dogs or cats from Microsoft) is literally the only solution that stopped us from getting spammed. I wonder how much experience the author of this article really has in this domain. Recaptcha has saved the internet as far as I'm concerned.

I'm almost sure that the traditional (ha!) wiki model where everyone is free to edit is not meant to be functional under the modern internet anyway. A verified and/or interested user model (the OP mentions this possibility in the heading "Community-specific questions", too bad that the second example image is too ambiguous even for anime fans though) seems to work though; I've seen it being much effective on, for example, the Esolang wiki [1].

[1] https://esolangs.org/wiki/Special:CreateAccount "Which number does this Befunge code output: [...]"

Post reply on HN