81–90 of 100 posts
Another shameless plug - https://hashcash.io/ :)
>$url = 'https://hashcash.io/api/checkwork/' . $_REQUEST['hashcashid'] . '?apikey=[YOUR-PRIVATE-KEY]';
hashcashid can change URL completely to something like ../../newpath?newparams#
Another shameless plug - https://hashcash.io/ :)
In your demo I'd be more careful with user input >$url = ' https://hashcash.io/api/checkwork/' . $_REQUEST['hashcashid'] . '?apikey=[YOUR-PRIVATE-KEY]'; hashcashid can change URL completely to something like ../../newpath?newparams#
This is why I still recommend using other form spam prevention techniques before sacrificing usability for a CAPTCHA. One of the most effective combinations for 80%+ of the sites I've ever dealt with is having a honeypot field in the form, plus some amount of time required to pass before the form can be submitted successfully. There are other ways to mitigate bots as well, but these two alone have sufficed for quite…
We have a lot of detection and followup in place, with a manual review process. The next generation will add the need for the user being logged in (though a click-through social network login will make it easier for most users)... At least in that case it's easier to tell when someone has a twitter account with no follows/followers who's never tweeted. Nothing is perfect though.
It really is an arms race, my point is the rules are very different depending on your market.
Seriously guys? This made to the top of the front page? First of all, to all people saying "HUR DUR GOOGLE WANTS YOUR BROWSING DATA", well they already fucking have/had it for a looong time. Secondly, If you tell me that one dude [author] ruled the one+ year work of the engineering team at google as a flaw and simplified it as [So what Google is trying to sell us as a comprehensive bot detecting algorithm is simply a…
> one dude Since you obviously don't know who Homakov is I can't take your post very seriously. Homakov has exposed several serious security flaws at Facebook and Google before. I'm pretty sure Google is actively trying to headhunt him since he is one of the best in the web security field.
Earlier quoted context omitted.
I would argue that the problem of spam and hackers is a greater burden on society as a whole than someone in Iran not being able to get past a captcha.
Depends on what variables you're plugging into your moral calculus. Spam typically doesn't actually cause bodily harm, political repression, etc.
Earlier quoted context omitted.
I would argue that the problem of spam and hackers is a greater burden on society as a whole than someone in Iran not being able to get past a captcha.
Yeah, seeing a few spam links on a website is much more burdensome than free speech!
Earlier quoted context omitted.
The weird thing about this entire No Captcha solution, in my opinion, is that it assumes that a captcha is the most efficient method for defeating spam. In most blackhat circles, captchas are an afterthought. You figure out everything else (IPs, original content), then plug in a service like deathbycaptcha that solves the captcha for... looks like $1.39 per 1000 (thanks to ultramancool for the correction). ( http://d…
With both of your examples (and many others I've come across) those question type captchas can be done with a quick ping to Google and a sanity check on the answer "what popular figure comes through your chimney in December" -> "Santa Claus - Wikipedia, the free encyclopedia" "what's 1+1" -> "2" They only really work if maybe the question is in the market of the site you're registering for "What's 's last name" etc
Earlier quoted context omitted.
With both of your examples (and many others I've come across) those question type captchas can be done with a quick ping to Google and a sanity check on the answer "what popular figure comes through your chimney in December" -> "Santa Claus - Wikipedia, the free encyclopedia" "what's 1+1" -> "2" They only really work if maybe the question is in the market of the site you're registering for "What's 's last name" etc
Well the Santa Claus question will defeat bots for now at least... http://imgur.com/qX8pWrQ