Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You probably don’t need ReCAPTCHA

kevv.net

Post reply on HN
Print view View original

101–110 of 246 posts

Re: You probably don’t need ReCAPTCHA

#101

Post by gbear605 »

bduerst wrote: post #27
hawaiian wrote: post #8

ReCAPTCHA has crossed into the domain of cattle-corralling users and thus should be considered harmful. If the system decides it doesn't like you (most likely because you're "too anonymous," but you don't really know) you will be presented with slower-loading images to click and more click-all-the-things rounds. To pretend this is about slowing down bots is disingenuous as best. On top of that, usage of ReCAPTCHA per…

>Why isn't there a solid alternative offering yet? The latest version of recaptcha doesn't even prompt users. It loads on the front-end and uses a scoring system. It's likely you've used it but didn't even know because it's invisible. It's the older implementations that have the slow loading images.

On Google Chrome, with adblock on, without my Google account signed in, in a new incognito tab with no extensions, I have the experience of it being invisible. When I go back to the same site on Firefox, logged onto my Google account, no adblock on, no privacy options on, I have to identify dozens of photos.

As far as I can tell, it just checks to see if your browser is Google Chrome to give you your score.

Re: You probably don’t need ReCAPTCHA

#102

Post by gbear605 »

feikname wrote: post #19
vkou wrote: post #15

Earlier quoted context omitted.

Because when you don't annoy 'too anonymous' users with obnoxious captchas, your service gets flooded with spam, which annoys every single other user. > To pretend this is about slowing down bots is disingenuous as best. I'm not sure you have a good understanding of what happens to internet services when they don't throttle spam. They become completely unusable.

ReCAPTCHA doesn't prevent the kind of spam that makes internet services completely unusable (i.e. DDoS botnets), it prevents form submition spam.

To be fair, spamming a user-submitted content site (for example, a blog with comments) is just as bad as a DDoS; either one makes the site unusable.

Re: You probably don’t need ReCAPTCHA

#103

Post by luckylion »

kbenson wrote: post #67
T-hawk wrote: post #51

Earlier quoted context omitted.

You're not trying to make your site absolutely bot-proof. Someone deliberately targeting your site can figure out any such measures. (You want legitimate users to do so.) You're just trying to throw in enough friction that most common drive-by scripts won't succeed. It's a "don't have to outrun the bear" situation, make yourself just difficult enough that some easier target gets snagged instead.

> It's a "don't have to outrun the bear" situation If everyone else is incorporating recaptcha, they're all running faster than you. Even with bypass services, cheap is not the same as free, especially at the scale spam runs at. I imagine a mail form that obviously doesn't incorporate a CAPTCHA is going to garner some attention. It might work for weeks or months if it's not being paid attention to, so that's probably…

> Even with bypass services, cheap is not the same as free, especially at the scale spam runs at.

Spam doesn't scale on a small site. Say you can absolutely fill a small site with spam comments to the point that 99% of comments are spam. Very few people visit the site (it's small after all). Fewer still read the comments. Virtually none of those will click on the (usually obvious) spam links. And still fewer will buy, making you money. If you spend 2 hours customizing your spam script to circumvent anti-spam measures on a small site, you might as well flip burgers at McDonald's, you'll make significantly more money.

Spam works at scale only when you're not customizing. I'm involved with quite a few small to medium and a few larger sites (the largest getting around 4m PI/month) and though we use WP we get virtually no spam because of trivial deviations. We get an immense amount of attempts though. The little we do get is obviously manual spam: in the correct language, with content targeted to the individual page/post content (beyond "very interesting article, I wrote about the same" one-size-fits-all).

Re: You probably don’t need ReCAPTCHA

#105

Post by luckylion »

mobjack wrote: post #46
mattigames wrote: post #22

Earlier quoted context omitted.

Did you try randomizing the 'name' and 'ids' of the inputs? (including the invisible one)

I really dont know how well that will work against a dedicated attacker. I am much more confident in ReCAPTCHA of stopping bots compared to any roll your own solution. I dont want to hope that an alternative is good enough for my needs. I want the best when it comes to protecting my site. Any alternative needs to have a proven track record and support to make consider replacing ReCAPTCHA.

> I am much more confident in ReCAPTCHA of stopping bots compared to any roll your own solution.

I am as well. We enabled Recaptcha on one site and had spam signups drop by 99%. Unfortunately, regular signups also dropped by 20% because people give up when they hit Recaptcha and don't absolutely, seriously need what it's protecting. To us, joining the arms race against the spammers (which, so far, we've easily won) was much more profitable than turning away legitimate customers.

Re: You probably don’t need ReCAPTCHA

#106

Post by godelski »

mobjack wrote: post #46
mattigames wrote: post #22

Earlier quoted context omitted.

Did you try randomizing the 'name' and 'ids' of the inputs? (including the invisible one)

I really dont know how well that will work against a dedicated attacker. I am much more confident in ReCAPTCHA of stopping bots compared to any roll your own solution. I dont want to hope that an alternative is good enough for my needs. I want the best when it comes to protecting my site. Any alternative needs to have a proven track record and support to make consider replacing ReCAPTCHA.

> I really don't know how well that will work against a dedicated attacker.

>>> You probably don’t need ReCAPTCHA

Probably being the keyword, because you probably aren't a big enough site for a dedicated attacker. Or for a dedicated attacker to be an issue.

And really, let's s/attacker/bot/g. Not every bot is a problem. Not every bot is an attacker, i.e. someone doing something malicious.

Re: You probably don’t need ReCAPTCHA

#107

Post by nitrogen »

luckylion wrote: post #103
kbenson wrote: post #67

Earlier quoted context omitted.

> It's a "don't have to outrun the bear" situation If everyone else is incorporating recaptcha, they're all running faster than you. Even with bypass services, cheap is not the same as free, especially at the scale spam runs at. I imagine a mail form that obviously doesn't incorporate a CAPTCHA is going to garner some attention. It might work for weeks or months if it's not being paid attention to, so that's probably…

> Even with bypass services, cheap is not the same as free, especially at the scale spam runs at. Spam doesn't scale on a small site. Say you can absolutely fill a small site with spam comments to the point that 99% of comments are spam. Very few people visit the site (it's small after all). Fewer still read the comments. Virtually none of those will click on the (usually obvious) spam links. And still fewer will buy…

The spam I see is trying to add little bits of pagerank all over the place.

Re: You probably don’t need ReCAPTCHA

#108

Post by Dylan16807 »

bduerst wrote: post #27
hawaiian wrote: post #8

ReCAPTCHA has crossed into the domain of cattle-corralling users and thus should be considered harmful. If the system decides it doesn't like you (most likely because you're "too anonymous," but you don't really know) you will be presented with slower-loading images to click and more click-all-the-things rounds. To pretend this is about slowing down bots is disingenuous as best. On top of that, usage of ReCAPTCHA per…

>Why isn't there a solid alternative offering yet? The latest version of recaptcha doesn't even prompt users. It loads on the front-end and uses a scoring system. It's likely you've used it but didn't even know because it's invisible. It's the older implementations that have the slow loading images.

Kicking """questionable""" users off the site entirely is not a "solid alternative".

This is just splitting recaptcha into two pieces and giving you the first half. Okay, fine, but it's the second half that was causing all the problems!

Re: You probably don’t need ReCAPTCHA

#109

Post by luckylion »

cardine wrote: post #11

In my experience, the biggest issue I run into is targeted botnet brute force attacks. In cases like these, someone loads up a huge botnet, a downloaded list of hacked usernames and passwords, and tries every single combination hoping to find a reused username/password combination. In these cases, it is almost always extremely targeted. Log correlation has helped quite a bit, but it is still very painful since they a…

I've never dealt with anything seriously distributed. Are they running full browsers or simple scripts? Do they execute JS, do they load images? Do they perform other actions on the site, or will they show up with their initial request be a login request? Do they simulate keyboard and mouse events?

Re: You probably don’t need ReCAPTCHA

#110

Post by analogmemory »

smt88 wrote: post #88
mattigames wrote: post #43

Earlier quoted context omitted.

You can randomly generate the "name" of the fields and autofill will never fill them, another option to disable autocomplete is to leave them without "name" and handling the submit using JavaScript.

Disabling autocomplete is user-hostile and additionally should be considered a security flaw. It makes it harder to use password managers.

You can disable a single input field from autocomplete

`autocomplete="off"`

Post reply on HN