Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Botspam apocalypse

memex.marginalia.nu

Post reply on HN
Print view View original

121–130 of 358 posts

Re: Botspam apocalypse

#121

Post by realaravinth »

Aissen wrote: post #111
tmikaeld wrote: post #23

Earlier quoted context omitted.

"mCaptcha uses SHA256 based proof-of-work(PoW) to rate limit users." https://github.com/mCaptcha/mCaptcha

How does that work without becoming a SPOF for taking down the website ? Can't a user/botnet with more CPU power than the server simply send more captchas than can be processed ? In addition, using sha256 for this is IMHO a mistake, calling for ASIC abuse.

> How does that work without becoming a SPOF for taking down the website ? Can't a user/botnet with more CPU power than the server simply send more captchas than can be processed ?

Glad you asked! This is theoretically possible, but the adversary will have to be highly motivated with considerable resources to choke mCaptcha.

For instance, to generate Proof of Work(PoW), the client will have to generate 50k hashes(can be configured for higher difficulty) whereas the mCaptcha server will only have to generate 1 hash to validate the PoW. So a really powerful adversary can overwhelm mCaptcha, but at that point there's very little any service can do :D

> In addition, using sha256 for this is IMHO a mistake, calling for ASIC abuse.

Good point! Codeberg raised the same issue before they decided to try mCaptcha. There are protections against ASIC abuse: each captcha challenge has a lifetime and also, variable difficulty scaling implemented which increases difficulty when abuse is detected.

That said, the project is in alpha, I'm willing to wait and see if ASIC abuse is prevalent before moving to more resource-intensive hashing algorithms like Scrypt. Any algorithm that we choose will also impact legitimate visitors so it'll have to be done with care. :)

Re: Botspam apocalypse

#122

Post by tpoacher »

remram wrote: post #40
Nextgrid wrote: post #16

Earlier quoted context omitted.

There are (at least) 2 kinds of spam - "technical" spam such as bots hammering the web service with requests and consuming resources, and the commonly-accepted definition of spam where bots post promotional or other obnoxious content. I feel like the article here talks more about the first kind. I do agree with your solution for the second kind of spam though.

> bots hammering the web service with requests and consuming resources I've never seen this referred as "spam". Denial of service, botting, scraping, sure, but does anyone call that spam?

It's spam from a server owner's point of view in the broader sense, in that it is "junk requests" instead of legitimate requests, they can be sent as a flood at no cost or consequence to the senders, and it's up to you as the recipient to find a way to filter it all to separate the wheat from the chaff.

It's certainly not denial of service, that means something far more specific.

One could call it "scraping", but I'd argue the meaning / emphasis is different (it'd be like describing trolling as 'typing').

And "botting" is not a word. :)

Re: Botspam apocalypse

#123

Post by lloydatkinson »

I found that my netlify site attracts a lot of spam specifically from the same spammer/group. The messages always start with some variation of “Hi my name is Eric”.

Netlify seem to not really care after reporting it on their support forum. The spammer disables JS so no client side protection works. I’ve recently decided to (unfortunately) break the ability for JS disabled browsers to be able to submit the contact form. The form elements attributes are all wrong meaning the form won’t submit correctly. Instead, some JS on page load sets the attributes to the correct values. I will wait a while and see if this solves it.

While netlify does correctly mark all this as spam the fact is that legitimate messages sometimes can slip past these with false positives. So I have to check the vast amount of spam often.

Re: Botspam apocalypse

#124

Post by Zak »

sparkling wrote: post #47
BiteCode_dev wrote: post #31

It's not that bad. First, of course, you have cloudflare and recaptcha, which are free and very efficient, as the author say. But even if you don't want to use them (some of my services don't), most bots are very dumb: - require JS, and you lose half of the web ones - silly tricks like hidden input fields in forms that worked in 2000 still work in 2022. Use a bunch of them, and you can yet again halve the bot traffic…

Very nice list of countermeasures. I agree that doing these small things like hidden input fields really go a long way. I would add to that: - block signups/comments from known throwaway email domains - block known datacenter IP ranges, at least for POST requests. Honestly on our sites 50% of spam was coming from AWS EC2 IPs - use a proxy/vpn/bot detection service like https://focsec.com

Please don't make blocking VPNs plan A. Between snooping ISPs and public wifi networks that have indiscriminate content filters, I'm on a VPN about half the time. Many other legitimate users are as well.

Re: Botspam apocalypse

#125

Post by titaniczero »

realaravinth wrote: post #67
tmikaeld wrote: post #23

Earlier quoted context omitted.

"mCaptcha uses SHA256 based proof-of-work(PoW) to rate limit users." https://github.com/mCaptcha/mCaptcha

Hello! I'm the author of mCaptcha, I'd be happy to answer any questions that people might have :)

It looks great, as a suggestion: Instead of an easy mode and advanced one I would use a single mode with a calculator, that way it is more transparent to the user and it would make the process of learning the advance mode and concepts easier.

Also, here: https://mcaptcha.org/, under the "Defend like Castles" section, I think you meant "expensive", not "experience".

Keep up the good work!

Re: Botspam apocalypse

#126

Post by realaravinth »

luckylion wrote: post #100
realaravinth wrote: post #67

Earlier quoted context omitted.

Hello! I'm the author of mCaptcha, I'd be happy to answer any questions that people might have :)

The results of the PoW are just thrown away, right? I wonder if you could couple that with something useful, e.g. what SETI@home used to do, but the intentionally small size of the work probably makes it difficult to be useful.

I'd love to do something useful with the PoW result but like you say, the PoW should be able to work in browsers, so they are intentionally small.

The maximum advisable delay is ~10s but even then it might not be enough for it to be useful.

Re: Botspam apocalypse

#127

Post by 1vuio0pswjnm7 »

"The rest are forced to build web services with no interactivity, or seek shelter behind something like Cloudflare, which discriminates against specific browser configurations and uses IP reputation to selectively filter traffic."

Interactivity is not a must-have. The world's first general purpose computer, ENIAC, was not built for "interactivity". It was built to calculate ballistic trajectories, which were otherwise calculated manually. Computers exist to allow automation, to reduce manual labour.^1 "Tech" companies need interactivity to support collection of data about www users and paid services related to programmatic online advertising. Generally, users do not need interactivity. Generally, users do not need to spend excessive quantities of time "interacting" with networked computers.

As a user, I want _non-interactive_ www services, whether it is data/information retrieval or e-commerce. I want to use more automation, not less. Automation is not reserved for those providing "services". It also should be available to those using them.

Provide bulk data access. Let others mirror it. Take advantage of "open datasets" hosting if necessary. For example, Common Crawl is hosted for free with Amazon. Upload the data to internet Archive.

"The API gateway is another stab at this, you get to choose from either a public API with a common rate limit, or revealing your identity with an API key (and sacrificing anonymity)."

Publish the rate limit for the public API. Do not make users guess. Do not require "sign-in" to use an API to retrieve public data.

1. Some folks consider having to "interact" with a computer as labour, not fun.

Re: Botspam apocalypse

#128

Post by baisq »

nixcraft wrote: post #95

I run a popular blog and confirm that spam is a massive issue. I am trying to keep the independent web alive with an old-school commenting system because it helps readers and myself improve outdated posts. My domain is over 20+ years old and attracts all sorts of threats, including monthly DDoS and daily spam. Using Cloudflare solved all of these problems. Next, you need to add firewall rules inside Cloudflare WAF to…

People here like to say that BigCo has ruined the independent web and that everything is now siloed and blablabla but the truth is that running an independent website fucking sucks in many regards

Re: Botspam apocalypse

#129

Post by cmjs »

realaravinth wrote: post #117
cmjs wrote: post #104

Earlier quoted context omitted.

I'm curious whether this can actually be considered to be a "CAPTCHA" in the true sense of the term. It doesn't seem to be intended to "tell computers and humans apart", but rather to force the client computer (not the human user) to do some work in order to slow down DOS attacks. Of course slowing down DOS attacks is a great goal in itself, and it's very often what captchas have been (ab)used for, but it doesn't see…

Thanks for the ping! I used "captcha" to simplify mCaptcha's application, calling it a captcha is much simpler to say than calling it a PoW-powered rate limiter :D That said, yes it doesn't do spambot form-abuse detection. Bypassing captchas like hCaptcha and reCAPTCHA with computer vision is difficult but its is stupid easy to do it with services offered by CAPTCHA farms(employ humans to solve captchas; available vi…

Thanks for the reply! That's basically what I thought then – but as you say, traditional captchas are deeply flawed and ineffective anyway, and I totally agree that in many cases the cost to real users outweighs any benefit. So I'm excited to see alternatives such as mCaptcha popping up. It'll be interesting to see how it works out for people in real-world use.

Re: Botspam apocalypse

#130

Post by easrng »

s1k3s wrote: post #44
kazinator wrote: post #15

In the 1980's, we kept anklebyters off dial-up BBSses with a simple technique: voice validation. To join the forum, you had to fill an application first, which included your real name and phone number. The sysop would give you a call for a quick chat, and then grant you access if you didn't seem like a twit. This would be entirely practical for some small-time operator trying to run a forum off residential broadband,…

I guess it's a different time and it also depends on who's your target audience. Some people go crazy if you ask for their email address. Phone numbers and calling is a big no-no.

You could schedule a voice-only jitsi or some other kind of call that doesn't need an email or phone number.
Post reply on HN