Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You probably don’t need ReCAPTCHA

kevv.net

Post reply on HN
Print view View original

171–180 of 246 posts

Re: You probably don’t need ReCAPTCHA

#171

Post by dillonmckay »

mirimir wrote: post #34
throwawaymath wrote: post #31

Earlier quoted context omitted.

As the commenter said, they rotate IPs. It is not that easy. I've also been on the other side of a sophisticated attack like this. The really savvy adversaries do the following, at least: 1. Rotate through several thousand to several hundred thousand noncontiguous, geographically distributed, residential IP addresses, 2. Associate each IP address with a single user agent and suite of cookies, 3. Associate each IP add…

> automated sneaker buying ??? Please ELI5. I mean, why are sales bad, even if automated? Are they using stolen cards?

The rapper Post Malone released a custom collaboration with Crocs and the shoe sold out in 24 hours, reselling on eBay for several hundred dollars.

https://www.digitalmusicnews.com/2018/11/02/post-malone-croc...

Re: You probably don’t need ReCAPTCHA

#172

Post by cf141q5325 »

throwawaymath wrote: post #31
chii wrote: post #20

Earlier quoted context omitted.

and you can easily count the number of failed attempts from a particular IP, and just show captcha for those over X failures, rather than every login. Normal users don't fail _that_ many times, and so are non-the-wiser.

As the commenter said, they rotate IPs. It is not that easy. I've also been on the other side of a sophisticated attack like this. The really savvy adversaries do the following, at least: 1. Rotate through several thousand to several hundred thousand noncontiguous, geographically distributed, residential IP addresses, 2. Associate each IP address with a single user agent and suite of cookies, 3. Associate each IP add…

>The most sophisticated attackers will still lease reputable Google accounts and mechanical turk time to bypass Recaptcha challenges, but it will be expensive for them.

You can also just pay people to solve recaptchas all day.

Re: You probably don’t need ReCAPTCHA

#173

Post by jhabdas »

nsajko wrote: post #170

I understand when Recaptcha gets used before registration forms, but why, oh why, does Discord do it before any login? If I know my email address and password I should be able to login without being logged in to Google as well ...

On the plus side you've likely become fairly adept at identifying street signs, light posts, bicycles, storefronts, bridges and buses in order to access Discord, especially if you were trying to access via Tor to gain a little privacy.

Re: You probably don’t need ReCAPTCHA

#174

Post by mcv »

mobjack wrote: post #46
mattigames wrote: post #22

Earlier quoted context omitted.

Did you try randomizing the 'name' and 'ids' of the inputs? (including the invisible one)

I really dont know how well that will work against a dedicated attacker. I am much more confident in ReCAPTCHA of stopping bots compared to any roll your own solution. I dont want to hope that an alternative is good enough for my needs. I want the best when it comes to protecting my site. Any alternative needs to have a proven track record and support to make consider replacing ReCAPTCHA.

> I am much more confident in ReCAPTCHA of stopping bots compared to any roll your own solution.

I'm much more afraid of ReCaptcha blocking bonafide users. It's a harmful obstacle that punishes legitimate users for not sharing as much data as possible with Google.

Even if you really need a captcha, there are better solutions out there.

Re: You probably don’t need ReCAPTCHA

#175

Post by amelius »

I think we have to take a step back, and consider why we want to separate humans from computers in the first place.

Humans can do a lot of bad things that computers can do. Think of armies of low-wage people in Asia, that are paid to click on ads, spread spam, or write reviews.

And also consider that computers can actually do good things, for example, allowing humans to automate their work on certain websites, or providing better accessibility for certain users.

Therefore, instead of introducing CAPTCHAs, why not focus on the actual threats. If you want to protect against spam, then build a spam filter. If you want to prevent bots from bulk-downloading your data, then build a rate-limiter, etc.

Re: You probably don’t need ReCAPTCHA

#176

Post by hadrien01 »

Ntrails wrote: post #167
blakesterz wrote: post #13

"Many developers vastly over-estimate the likelihood of customized spam." I run 100s of small random low traffic low priority sites. Without some form of form control, the ALL get hit with customized and random other crap spam. I don't have decent experience with many things in life, but I can say this is one topic I have YEARS of experience with. I've never over-estimated the amount of any type of spam any form can…

A forum I post on has zero restrictions on sign up. No recaptchas, nothing. Couple of times a month we see some (usually Cyrillic) bot post some thread with a link that (probably) no one clicks and we all have a laugh and tell it to post more (it never does). It's a small site, footfall in the 10s, so maybe that's the reason.

We've blocked cyrillic characters on a contact form, and we went from hundreds of spam messages every day to less than one a month.

Re: You probably don’t need ReCAPTCHA

#177

Post by mnw21cam »

norrius wrote: post #156
beiller wrote: post #141

Here is an idea I thought of for a captcha. Render your webpage and form and include a hidden "password" field. Use a javascript hashing algorithm to hash the password on the client browser (preferably a very slow one that uses a lot of CPU). When you submit the form check the calculated hash the client did with a pre-calculated hash on the server. If they don't match reject the form. You can pre-generate a list of p…

It could work... If you want to set minimal system requirements to visit your website. It will also annoy users of password managers with auto-filling capabilities. "password" is normally used for actual passwords. Besides, nothing stops the attacker from replacing your code with a faster implementation.

There are password hashing algorithms out there (like bcrypt) that specifically take a long time to compute using the fastest method that we can think of.

Re: You probably don’t need ReCAPTCHA

#178

Post by dillonmckay »

beiller wrote: post #141

Here is an idea I thought of for a captcha. Render your webpage and form and include a hidden "password" field. Use a javascript hashing algorithm to hash the password on the client browser (preferably a very slow one that uses a lot of CPU). When you submit the form check the calculated hash the client did with a pre-calculated hash on the server. If they don't match reject the form. You can pre-generate a list of p…

This sounds similar to the blockchain email spam prevention Hashcash.

https://en.m.wikipedia.org/wiki/Hashcash

Re: You probably don’t need ReCAPTCHA

#179

Post by mcv »

luckylion wrote: post #116
gbear605 wrote: post #102

Earlier quoted context omitted.

To be fair, spamming a user-submitted content site (for example, a blog with comments) is just as bad as a DDoS; either one makes the site unusable.

Most forum or blog comment spam I've seen was trivial to detect, even without access to the server. Isn't written in the right language? Very likely spam. Contains a link and little text? Very likely spam. If you have access to the server's information, it gets even better. Origin makes it much easier to identify likely spam, previous interactions with the site and their speed ("hits the page and 1s later submits a c…

I'd much rather have a service where I can submit a comment to check if it's meaningful or likely spam, than to force my users to waste time and share data with Google that they don't want to.

If clearly spam, block it, if clearly okay, allow it. If unsure, leave it for a moderator. It might even train users to write better comments if badly written ones need to wait for moderation.

Re: You probably don’t need ReCAPTCHA

#180

Post by buboard »

charrondev wrote: post #17
sbov wrote: post #16

Earlier quoted context omitted.

Have an input element that can't be seen. If it has something in it, ignore the submit. Works for all my sites so far.

Doesn’t work as soon as you’re big enough to target. The company I work for makes a SaSS forum product, and while we do have multiple spam prevention methods (akismet, stopforumspam, honeypot, a hidden input), there’s enough stuff out there that has targeted our platform that a Recaptcha on the registration form is needed. We haven’t need it on any other forms yet though. After registration it’s all handled by the ot…

do you eliminate all spam that way? i get signup SEO spam even with recaptcha & stopforumspam.
Post reply on HN