Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

googleonlinesecurity.blogspot.com

Post reply on HN
Print view View original

1–10 of 442 posts

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#3

Post by Someone1234 »

I recently added recaptcha to a site and got this version.

From an implementation standpoint it is utterly painless. The client side is copy/paste from Google's site and the PHP/server side was this:

      $recapchaURL = 'https://www.google.com/recaptcha/api/siteverify?secret=600SZZ0ZZZZZIZi-ZZ0ZEHZW1000Z_0ZZZ00QZZ&response=' . request_var('g-recaptcha-response','') .'&remoteip=' . $request->server('REMOTE_ADDR');
      $recapchaRespone = file_get_contents($recapchaURL);
      if(is_null($recapchaRespone))
      {
            print("Recaptcha failed. "); return; 
      }
      $recapchaResponeJSON = json_decode($recapchaRespone);
      if(!( !is_null($recapchaResponeJSON->{'success'}) && $recapchaResponeJSON->{'success'} == 'true'))
      {
            print("Recaptcha failed. "); return;
       }
Most of the time it just gives you that one checkbox, but if you use the form multiple times (e.g. testing) it starts to give you the classical text entry box. I have no idea how it works fully and this article only sheds little light on it.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#5

Post by TallGuyShort »

peeyushagarwal wrote: post #2

Here is a video introducing the no CAPTCHA reCAPTCHA https://www.youtube.com/watch?v=jwslDn3ImM0

If I had only seen that video, I would think this was an April Fool's joke. I then read the article and was relieved to hear there is a little more than this. Perhaps I'm just being pessimistic, but I feel like this only raises the bar a little. I would expect checks it does of mouse movements or headers to be spoofable quite quickly after introduction. I think the best measure mentioned is tracking which IPs are bots, but that's still going to have serious shortcomings.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#6

Post by johnward »

The old recaptcha takes good sites and gives them terrible user experience. I tried to order tickets one time on ticketmaster and actually gave up because I couldn't get past the captcha. I hate current captchas with a passion and I hope they finally die. I understand fighting spam but when it completely ruins a user experience it's not worth it.

edit: Bury me with no explanation why? Please don't tell me you think the UX of using recaptcha is great. I'm a 28 year old dev with near perfect eyesight and It takes me several tries to get these right. They are horrible. I welcome this new change and hope it isn't easily cracked.

Re: Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA”

#8

Post by moron4hire »

The tiniest mouse movements I make while tabbing to the checkbox and hitting my spacebar to check it? Or tap it on my touch screen? And why wouldn't this be vulnerable to replaying a real user's input--collected on, say, a "free" pornographic website? Their answer seems to be "security through obscurity".
Post reply on HN