51–60 of 81 posts
> Isn't there a better way to fight bots? Don't? I mean, what are you trying to protect? If it's account registrations, shouldn't an email confirmation be enough?
To the extent that you'd consider non-Google alternatives, there are multiple different CAPTCHA services, and we at NetToolKit recently launched our own version called Shibboleth: https://www.nettoolkit.com/shibboleth/about You can try out demos at https://www.nettoolkit.com/shibboleth/demo While not open-source, the service is very affordable ($10 for 100,000 CAPTCHAs), and clients get to review user submissions to…
Just tried it out. Clicking on the buttons with a laptop trackpad was tedious and unintuitive. It would be nice if I could use the arrow keys (or even WASD) on my keyboard. Other than that it seems preferable to Google's new image captchas.
It's worse than that. It fingerprints the browser, the OS, and a ton of other stuff. I'd love to see a solution that's privacy-friendly.
There are three major categories of bots: 1) a combinatoric attack hoping to get lucky with an answer 2) employ some amount of smarts to fool the captcha (fetching lots of images without answering anything until they are sure of the answer, replay attacks to mimic human behavior, perceptual hashing of images etc) 3) Anti-Captcha (using people to solve captchas).
We can mostly recognize the first two kinds of attacks, but it is very difficult to stop the anti-captcha humans -- especially without tracking as many features as possible. One of the chief issues with most captchas is that they do not provide epidemic analysis and a webhook/endpoint to inform sites about a user after the initial sign-up. This also requires some amount of user tracking to recognize malicious behavior and retroactively tag and act upon it. Monetizing human activity can somewhat offset costs associated with dealing with these networks of bad accounts later and using privacypass gives the user a mechanism to bypass tracking their activity while also pricing out malicious account signup using anti-captcha.
A privacy-respecting captcha used for monetization also opens up an entirely different opportunity for publishers, offering a lower friction experience for users who want to support online content without privacy invasive advertisements and paywalls.
Earlier quoted context omitted.
They still try to sign up, but none of them can actually bypass the captcha. I implemented a custom callback that returns a HEAD response with 404 to fool them (because I noticed that attacks intensified when I returned 2xx or 3xx responses).
THIS is what I'm talking about :) Great work! Seems to me this is very centered on Rails apps. Would it be possible to do somethink like this for "everyone"? I have nothing agains Rails, but as a js/php/python develper myself, I wouldn't know where to begin with this..
You can take it one step further and check how fast the form was submitted. If it is below the predefined threshold, it is probably a bot.
[0] To hide the form field, you can use one of these snippets, interchangeably:
"display:none;"
"position:absolute!important;top:-9999px;left:-9999px;"
"position:absolute!important;height:1px;width:1px;overflow:hidden;"It's worse than that. It fingerprints the browser, the OS, and a ton of other stuff. I'd love to see a solution that's privacy-friendly.
I work on hCaptcha -- we pay websites for providing data labeling via our captcha. We also provide a mechanism to accept privacypass as a bypass. There are three major categories of bots: 1) a combinatoric attack hoping to get lucky with an answer 2) employ some amount of smarts to fool the captcha (fetching lots of images without answering anything until they are sure of the answer, replay attacks to mimic human beh…
> Isn't there a better way to fight bots? Don't? I mean, what are you trying to protect? If it's account registrations, shouldn't an email confirmation be enough?
Earlier quoted context omitted.
Just tried it out. Clicking on the buttons with a laptop trackpad was tedious and unintuitive. It would be nice if I could use the arrow keys (or even WASD) on my keyboard. Other than that it seems preferable to Google's new image captchas.
Thanks for the feedback! One thing that is not clear from the demo (and something we should fix) is that you can click on the path CAPTCHA to grant it focus. After that, you can use the arrow keys (although WASD currently does not work).
To the extent that you'd consider non-Google alternatives, there are multiple different CAPTCHA services, and we at NetToolKit recently launched our own version called Shibboleth: https://www.nettoolkit.com/shibboleth/about You can try out demos at https://www.nettoolkit.com/shibboleth/demo While not open-source, the service is very affordable ($10 for 100,000 CAPTCHAs), and clients get to review user submissions to…
A sophisticated attacker will simply use something like Mechanical Turk to get past Google captcha, and Google captcha is incredibly aggravating to a number of marginal users. But it's simple to implement, so that makes it popular.
I'd even say that most services don't need captcha in the first place. Captcha only affects relatively unsophisticated attacks, and if it's just an entry in your database, who cares? If it's sending you spam in an attempt to DDOS your email or customer service platform, use correlation between purchases and accounts to filter out the spam.
So, as with all security related matters, identify your threat model, and use that to figure out what you actually need, not what you think you need.
Earlier quoted context omitted.
I work on hCaptcha -- we pay websites for providing data labeling via our captcha. We also provide a mechanism to accept privacypass as a bypass. There are three major categories of bots: 1) a combinatoric attack hoping to get lucky with an answer 2) employ some amount of smarts to fool the captcha (fetching lots of images without answering anything until they are sure of the answer, replay attacks to mimic human beh…
Very interesting idea, thanks for sharing! Is this solution doing any form of tracking or is it purely just sending solutions to your puzzles?
In the case of Google tracking you, they have your personal information and they are using your activity to show you ads -- we don't have either of those aspects to our business model; so our tracking is essentially anonymous.