Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You probably don’t need ReCAPTCHA

kevv.net

Post reply on HN
Print view View original

121–130 of 246 posts

Re: You probably don’t need ReCAPTCHA

#121

Post by PopeDotNinja »

charrondev wrote: post #17
sbov wrote: post #16

Earlier quoted context omitted.

Have an input element that can't be seen. If it has something in it, ignore the submit. Works for all my sites so far.

Doesn’t work as soon as you’re big enough to target. The company I work for makes a SaSS forum product, and while we do have multiple spam prevention methods (akismet, stopforumspam, honeypot, a hidden input), there’s enough stuff out there that has targeted our platform that a Recaptcha on the registration form is needed. We haven’t need it on any other forms yet though. After registration it’s all handled by the ot…

Please just don't use the bouncing ball that Dropbox made me use once. It was the first time my lack of athleticism prevented me from a signing in.

Re: You probably don’t need ReCAPTCHA

#122

Post by shaki-dora »

briandear wrote: post #70
mobjack wrote: post #46

Earlier quoted context omitted.

I really dont know how well that will work against a dedicated attacker. I am much more confident in ReCAPTCHA of stopping bots compared to any roll your own solution. I dont want to hope that an alternative is good enough for my needs. I want the best when it comes to protecting my site. Any alternative needs to have a proven track record and support to make consider replacing ReCAPTCHA.

So you force your users to consent to sharing all of their data with Google? That’ll teach ‘em.

"all their data" is a bit much, isn't it? ReCAPTCHA gives Google exactly one datum, namely the user's visit to the one page it is on.

And I would even hazard a guess that the TOS specify that Google will not retain/link that information, considering that's how Analytics is run.

Re: You probably don’t need ReCAPTCHA

#123

Post by downandout »

One thing you can do to slow down bots is make it computationally expensive to sign up. Utilize a JavaScript-based proof of work library. Normal users can breeze right through, but somebody trying to create thousands of accounts will find their operation grinding to a halt.

Re: You probably don’t need ReCAPTCHA

#124

Post by nn3 »

charrondev wrote: post #61
mattigames wrote: post #22

Earlier quoted context omitted.

Did you try randomizing the 'name' and 'ids' of the inputs? (including the invisible one)

I was preparing a response here, but many of the other commenters have covered it. I recently spent time ensuring our Auth pages’ HTML could be easily cached outside of our application servers. They were a common target of DDOS attacks because we were generating a unique nonce for CSRF protection. Randomizing form field names does not defeat a targeted attacker (and we have definitely been a target), prevents HTML ca…

>Additionally it will be terrible from a usability and accessibility standpoint.

ReCaptcha is by definition terrible from a usability and accessibility standpoint too, just has all the privacy problems too.

Re: You probably don’t need ReCAPTCHA

#125

Post by atoav »

blakesterz wrote: post #13

"Many developers vastly over-estimate the likelihood of customized spam." I run 100s of small random low traffic low priority sites. Without some form of form control, the ALL get hit with customized and random other crap spam. I don't have decent experience with many things in life, but I can say this is one topic I have YEARS of experience with. I've never over-estimated the amount of any type of spam any form can…

I used 5 randomly choosen english questions with easy answers my readers would know — this prevented literally 100% of the unwanted spam, while it was easy on the users.

If you want to filter comments you could even make the questions reflect the content of the article, filtering uninformed TL;DR type of comments and giving the users the feeling you value onformed opinions.

Re: You probably don’t need ReCAPTCHA

#126

Post by dorgo »

jknz wrote: post #119

Requiring to solve ReCapcha after may be more sensible than the usual use case where ReCapcha is required before any interaction. Let the user create account, let the user create first comment/post, save it somewhere but hide it, then require ReCapcha to make the post visible and activate the account. The issue with requiring ReCapcha before is that the website owner will never know whether a legitimate user was turn…

And how does the timing change things? You want to look at first comments/posts to determine whether it was spam or not?

Re: You probably don’t need ReCAPTCHA

#127

Post by jknz »

dorgo wrote: post #126
jknz wrote: post #119

Requiring to solve ReCapcha after may be more sensible than the usual use case where ReCapcha is required before any interaction. Let the user create account, let the user create first comment/post, save it somewhere but hide it, then require ReCapcha to make the post visible and activate the account. The issue with requiring ReCapcha before is that the website owner will never know whether a legitimate user was turn…

And how does the timing change things? You want to look at first comments/posts to determine whether it was spam or not?

After the post is saved (but hidden until the user solves ReCapcha) you can look at the database and analyse what's happening. Did ReCapcha turned away an interesting post by a legit user? What is the ratio of spans versus legit users? Etc.

If you turn both spammers and annoyed users with ReCapcha before any interaction,you will never know how many were legit and you won't be able to manually accept interesting legitimate content written by a user that is annoyed by Recapcha.

Re: You probably don’t need ReCAPTCHA

#128

Post by alkonaut »

atoav wrote: post #125
blakesterz wrote: post #13

"Many developers vastly over-estimate the likelihood of customized spam." I run 100s of small random low traffic low priority sites. Without some form of form control, the ALL get hit with customized and random other crap spam. I don't have decent experience with many things in life, but I can say this is one topic I have YEARS of experience with. I've never over-estimated the amount of any type of spam any form can…

I used 5 randomly choosen english questions with easy answers my readers would know — this prevented literally 100% of the unwanted spam, while it was easy on the users. If you want to filter comments you could even make the questions reflect the content of the article, filtering uninformed TL;DR type of comments and giving the users the feeling you value onformed opinions.

I once used a form with a random math question: 7+2 = __

It prevented 100% of bot spam for years. Granted, I was never a big enough target to make anyone rewrite their bot, but that's the same for most of us. I'd never use a captcha so long as something trivial like that works 100%.

Re: You probably don’t need ReCAPTCHA

#129

Post by raverbashing »

throwawaymath wrote: post #31
chii wrote: post #20

Earlier quoted context omitted.

and you can easily count the number of failed attempts from a particular IP, and just show captcha for those over X failures, rather than every login. Normal users don't fail _that_ many times, and so are non-the-wiser.

As the commenter said, they rotate IPs. It is not that easy. I've also been on the other side of a sophisticated attack like this. The really savvy adversaries do the following, at least: 1. Rotate through several thousand to several hundred thousand noncontiguous, geographically distributed, residential IP addresses, 2. Associate each IP address with a single user agent and suite of cookies, 3. Associate each IP add…

Sounds like big operations like that should have been putting people into jail

Re: You probably don’t need ReCAPTCHA

#130

Post by sroussey »

ordu wrote: post #25
julianlam wrote: post #6

Most websites probably don't. If you're one of those people, congratulations! Stick a honeypot input into your form and call it a day. However, if you're working on anything with non-insignificant amounts of traffic, you'll get hit with some customized spam. I've been dealing with these spammers, and if you do nothing, your forum will be filled with korean ads. We implement Akismet, StopForumSpam, Project Honeypot, a…

> We implement Akismet, StopForumSpam, Project Honeypot, and ReCAPTCHA Did you tried some techniques from the article? Like hidden form fields, simple javascript checks or simple captcha?

I used to run a forum hosting service. After a while you try everything. Honeypot fields, incorrect field names, etc. You will notice things like CSRF tokens generated by one IP and used by another. When stuff fails, they send 100 real people and record what worked, and it fixes their script. It’s all pretty automated. IP reputation can be helpful for some players, but most snowshoe.

Spam attempts would grow exponentially. So every time we cut it down by 90% via one of these tricks, it only gave us a bit of time.

None of this stops the determined troll though.. they can have all day to manually add offensive content. Shadow banning was good for this (1999) and group shadow banning was the best (bifurcated forum posts so all the banned people saw each other, but no one else did). Ah, memories. So good.

Post reply on HN