Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The No CAPTCHA problem

homakov.blogspot.com

Post reply on HN
Print view View original

31–40 of 100 posts

Re: The No CAPTCHA problem

#31

Post by JohnTHaller »

geerlingguy wrote: post #4

This is why I still recommend using other form spam prevention techniques before sacrificing usability for a CAPTCHA. One of the most effective combinations for 80%+ of the sites I've ever dealt with is having a honeypot field in the form, plus some amount of time required to pass before the form can be submitted successfully. There are other ways to mitigate bots as well, but these two alone have sufficed for quite…

We use the Drupal Honeypot module on PortableApps.com and it works well. Mainly to block spammers from flooding comments and forum posts with bots. As one of the world's largest Drupal sites, we're under constant attack. We still use captchas for user registration, though, as we have a ton of accounts created by humans and then posted to by bots, which seems to be the m.o. of some of the larger spammers now.

Re: The No CAPTCHA problem

#33

Post by homakov »

sarciszewski wrote: post #29

I'm reading this page: http://homakov.blogspot.com/2013/05/the-recaptcha-problem.ht... Why don't they just invalidate the current challenge when a new one is requested? :S

There's no session ID for current user. They can try to use IP as identifier. Admins can send remoteip to google to prevent spoofing but that parameter is optional and I suppose they don't rely on it.

Re: The No CAPTCHA problem

#34

Post by austenallred »

geerlingguy wrote: post #4

This is why I still recommend using other form spam prevention techniques before sacrificing usability for a CAPTCHA. One of the most effective combinations for 80%+ of the sites I've ever dealt with is having a honeypot field in the form, plus some amount of time required to pass before the form can be submitted successfully. There are other ways to mitigate bots as well, but these two alone have sufficed for quite…

The weird thing about this entire No Captcha solution, in my opinion, is that it assumes that a captcha is the most efficient method for defeating spam.

In most blackhat circles, captchas are an afterthought. You figure out everything else (IPs, original content), then plug in a service like deathbycaptcha that solves the captcha for... looks like $1.39 per 1000 (thanks to ultramancool for the correction). (http://deathbycaptcha.com). What nocaptcha does is only show that captcha (which is already defeated), to a certain subset of the users who haven't been deemed trustworthy. So, the big bot builders will take a day or two and beat the system, and we're right back to where we started.

Honeypots, however, are brutal - especially if you throw a couple in there. When building a bot you build it for efficiency. If your site does anything abnormal (whether it's 'what's n+n?' or 'what popular figure comes through your chimney in December?') a bot is hopeless.

That being said, however, a bot is only hopeless so long as a solution isn't implemented widely enough to be worth breaking through for spammers. If, for example, Wordpress came up with 1000 questions like that, someone somewhere would come up with and sell 1000 solutions.

In some sense it may be the case that Google is one of the worst companies to create a a simple anti-spam API. I'm sure there's something they could do that would be more effective than this, but this won't really move the needle.

Re: The No CAPTCHA problem

#35

Post by 3solarmasses »

geerlingguy wrote: post #4

This is why I still recommend using other form spam prevention techniques before sacrificing usability for a CAPTCHA. One of the most effective combinations for 80%+ of the sites I've ever dealt with is having a honeypot field in the form, plus some amount of time required to pass before the form can be submitted successfully. There are other ways to mitigate bots as well, but these two alone have sufficed for quite…

I created all sorts of honeypots (time based, hidden fields) and they quickly became worthless. As soon as the Russian bot networks target you, honeypots won't do anything to stop them.

Captcha has been the only thing that actually works. I will never use honeypots ever again. The headaches caused by those Friday night attacks aren't worth it.

Re: The No CAPTCHA problem

#36

Post by unreal37 »

probably_wrong wrote: post #16
compbio wrote: post #9

I do not get the problem of hiring a clickfarm for 1$ an hour to click on cat pics. If we take reputation, IP and cookie. All must be in order to pass. We want to spam a 1000 forms today. Scenario 1: The clickfarm itself fills in the Captcha. Result: Their IP's will soon be blacklisted, reputation of a third-world account will be inherently low. Scenario 2: We let the clickfarm send the answer to our own bot, which s…

Here's a scenario: a dissident living in a third world country with pervasive surveillance. He accesses the net using TOR, and disables cookies. Now his IP is blacklisted, because there are lots of people using the same exit node; his reputation is low for the same reason, and the cookie is rejected. There's a good chance that this one person will be blocked, even though he didn't do anything wrong. For a simpler cas…

I would argue that the problem of spam and hackers is a greater burden on society as a whole than someone in Iran not being able to get past a captcha.

Re: The No CAPTCHA problem

#37

Post by Kequc »

homakov wrote: post #17
hdgb wrote: post #15

Earlier quoted context omitted.

I wouldn't be surprised if approval for a Visa depended on your search history.

Oh yes http://newsfeed.time.com/2012/01/31/british-tourists-tweets-...

It's a story about american airports it is to be expected. You should probably give your nose hairs a good trim someone might think you're going to pluck the longest one out and strangle the country to death.

Re: The No CAPTCHA problem

#38

Post by kissickas »

raverbashing wrote: post #19
homakov wrote: post #8

Earlier quoted context omitted.

Why? If no need to type any captcha - do the verification in the background, don't show me anything until you think I'm a bot

Because of page layout. Having a fixed size element is better than having something (that is not yours) that might be there or not.

There's still no need for a click.

Re: The No CAPTCHA problem

#39

Post by corobo »

austenallred wrote: post #34
geerlingguy wrote: post #4

This is why I still recommend using other form spam prevention techniques before sacrificing usability for a CAPTCHA. One of the most effective combinations for 80%+ of the sites I've ever dealt with is having a honeypot field in the form, plus some amount of time required to pass before the form can be submitted successfully. There are other ways to mitigate bots as well, but these two alone have sufficed for quite…

The weird thing about this entire No Captcha solution, in my opinion, is that it assumes that a captcha is the most efficient method for defeating spam. In most blackhat circles, captchas are an afterthought. You figure out everything else (IPs, original content), then plug in a service like deathbycaptcha that solves the captcha for... looks like $1.39 per 1000 (thanks to ultramancool for the correction). ( http://d…

With both of your examples (and many others I've come across) those question type captchas can be done with a quick ping to Google and a sanity check on the answer

"what popular figure comes through your chimney in December" -> "Santa Claus - Wikipedia, the free encyclopedia"

"what's 1+1" -> "2"

They only really work if maybe the question is in the market of the site you're registering for "What's 's last name" etc

Re: The No CAPTCHA problem

#40

Post by [deleted] »

corobo wrote: post #39
austenallred wrote: post #34

Earlier quoted context omitted.

The weird thing about this entire No Captcha solution, in my opinion, is that it assumes that a captcha is the most efficient method for defeating spam. In most blackhat circles, captchas are an afterthought. You figure out everything else (IPs, original content), then plug in a service like deathbycaptcha that solves the captcha for... looks like $1.39 per 1000 (thanks to ultramancool for the correction). ( http://d…

With both of your examples (and many others I've come across) those question type captchas can be done with a quick ping to Google and a sanity check on the answer "what popular figure comes through your chimney in December" -> "Santa Claus - Wikipedia, the free encyclopedia" "what's 1+1" -> "2" They only really work if maybe the question is in the market of the site you're registering for "What's 's last name" etc

[deleted]
Post reply on HN