Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You probably don’t need ReCAPTCHA

kevv.net

Post reply on HN
Print view View original

191–200 of 246 posts

Re: You probably don’t need ReCAPTCHA

#191

Post by inferiorhuman »

ComputerGuru wrote: post #133
shaki-dora wrote: post #122

Earlier quoted context omitted.

"all their data" is a bit much, isn't it? ReCAPTCHA gives Google exactly one datum, namely the user's visit to the one page it is on. And I would even hazard a guess that the TOS specify that Google will not retain/link that information, considering that's how Analytics is run.

No, that's how it used to be. Now with ReCaptcha v3 the recommend you load it on all your pages, not just the forms you are trying to protect, so they can predict friend vs foe more accurately.

So how does one block this?

Re: You probably don’t need ReCAPTCHA

#192

Post by mda »

imtringued wrote: post #152
shaki-dora wrote: post #122

Earlier quoted context omitted.

"all their data" is a bit much, isn't it? ReCAPTCHA gives Google exactly one datum, namely the user's visit to the one page it is on. And I would even hazard a guess that the TOS specify that Google will not retain/link that information, considering that's how Analytics is run.

ReCAPTCHA basically looks up your google account and checks your browsing history and if your IP looks "spammy" to determine if you are a bot. The actual challenge is just a data mining operation and isn't meant to actually prove if you are a human because if it has determined you are not a human it won't let you through even if you do 10 challenges correctly.

Theoretocally it might use signals when you are logged in, but Recaptcha also works when you are not logged into google. So, not really.

Re: You probably don’t need ReCAPTCHA

#193

Post by ackbar03 »

throwawaymath wrote: post #98
ALittleLight wrote: post #60

Earlier quoted context omitted.

Seems like a market problem. Why not auction the sneakers?

To be clear, I don’t have a horse in this particular race. I’m neither condemning nor condoning the market dynamics of sneaker arbitrage here. It’s just an example I’m very familiar with because I used to write scrapers and I’ve been offered silly amounts of money to make them for sneaker trading groups. Not as much as hedge funds will pay for writing crawlers for market research, but still more than you’d probably e…

Hedge fund paying for scrapers, is that a common thing these days? What kind of prices do they pay if I may ask?

Re: You probably don’t need ReCAPTCHA

#194

Post by KajMagnus »

luckylion wrote: post #111
hombre_fatal wrote: post #52

Earlier quoted context omitted.

https://luminati.io/#pricing

Sounds like the answer is to increase the response size for failed login requests. At $12.5/G, if you blow up your response to a mega byte, they'll spend about a cent per try - close to the rate they'll need to pay to have recaptchas solved by humans.

Then can't they run-out-of-money DDoS you fairly easily? Since you'd pay for the outgoing bandwidth and at Google Cloud and AWS that's expensive.

Re: You probably don’t need ReCAPTCHA

#195

Post by nroets »

Websites should use ReCAPTCHA, but set a cookie that includes sufficient (pseudo) random numbers. Keep a copy on your server.

As long as a browser provides a cookie that is present on your server, there is no need for another ReCAPTCHA.

If the user misbehaves, e.g. too many wrong guesses of password(s), remove the cookie from your server.

You can even email the user the cookie as a url e.g. example.com/?cookie=12345678901234567

Re: You probably don’t need ReCAPTCHA

#196

Post by michaelt »

Washuu wrote: post #95
frosted-flakes wrote: post #91

Earlier quoted context omitted.

I have to ask, why do people do this? What do they get out of it?

I assume SEO targeting and associating phrases with various products. For example, people on Reddit will name and shame by dropping people's names accused of crimes next to the thing they are accused of in a complete sentence. This is an attempt to promote the relevance of those two facts in Google Search to each other.

Doesn't the nofollow attribute [1] work to remove that incentive? IIRC that was the intended purpose of nofollow?

[1] https://en.wikipedia.org/wiki/Nofollow

Re: You probably don’t need ReCAPTCHA

#197

Post by fybe »

analogmemory wrote: post #186
fybe wrote: post #169

Earlier quoted context omitted.

'Autocomplete' doesn't work for Firefox (since version 38), Google Chrome (since 34), and Internet Explorer (since version 11 Huge pain

This totally works in latest Chrome/FF/Safari https://codesandbox.io/s/static-jkvzs https://jkvzs.codesandbox.io/ The other trick is to add a random string/number in from of the name attribute e.g. name="348349_name". This prevents autofill. Interestingly 1Password and LastPass are smart enough to infer that it's a name or email field. For the honeypot, random number + word makes it ignored by autofill/1password

My mistake,

looked into it again and it seems Chrome enabled it again in Chrome 68: https://stackoverflow.com/questions/25823448/ng-form-and-aut...

Firefox had it disabled too but enabled it back again: https://developer.mozilla.org/en-US/docs/Web/Security/Securi...

And IE is just a cluster f.

My point being, Autocomplete off is not a valid solution as it can break at an updates notice, and the code hacks, while may work, are a pain to deal with

Re: You probably don’t need ReCAPTCHA

#198

Post by anoncake »

imtringued wrote: post #157
stordoff wrote: post #99

Earlier quoted context omitted.

They encourage developers to include their SDK: > Monetize your mobile app or game with our SDK, without showing intrusive ads or requiring annoying subscriptions and in app purchases. https://luminati.io/sdk They approached nmap of all people: > Hi, > My name is Lior and I'd like to offer you a new way to make money off your software. The Luminati SDK provides your users the option to use your software for free by c…

$3000 USD for 100k users? If you can get five pennies from each you're better off than with this crap.

The equation changes if you actually care about your users' experience. Or if you don't and include both Luminati and ads.

Re: You probably don’t need ReCAPTCHA

#199

Post by darekkay »

sbov wrote: post #16
blakesterz wrote: post #13

"Many developers vastly over-estimate the likelihood of customized spam." I run 100s of small random low traffic low priority sites. Without some form of form control, the ALL get hit with customized and random other crap spam. I don't have decent experience with many things in life, but I can say this is one topic I have YEARS of experience with. I've never over-estimated the amount of any type of spam any form can…

Have an input element that can't be seen. If it has something in it, ignore the submit. Works for all my sites so far.

This field will also been available for all screen reader users. It's important to add an adequate label ("Please do not fill out this field" or similar).

Re: You probably don’t need ReCAPTCHA

#200

Post by mikro2nd »

jhabdas wrote: post #173
nsajko wrote: post #170

I understand when Recaptcha gets used before registration forms, but why, oh why, does Discord do it before any login? If I know my email address and password I should be able to login without being logged in to Google as well ...

On the plus side you've likely become fairly adept at identifying street signs, light posts, bicycles, storefronts, bridges and buses in order to access Discord, especially if you were trying to access via Tor to gain a little privacy.

Can't speak for OP, but personally I simply stopped using Discord.
Post reply on HN