Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You probably don’t need ReCAPTCHA

kevv.net

Post reply on HN
Print view View original

151–160 of 246 posts

Re: You probably don’t need ReCAPTCHA

#151

Post by akie »

atoav wrote: post #137
sb8244 wrote: post #72

Earlier quoted context omitted.

What's an alternative that works at scale, though? It's easy to say "this is bad for these reasons, don't use it" while ignoring that there's not really better options once you get targeted.

I used a bunch of randomized questions with single word answers (case insensitive and typo tolerant) and hidden fields for years now. You can use common knowledge or simple ambiguity of language. You can use simple math arithmetic, written in properly obfuscated html. and randomly generated on each page load. You can use custom question about the content of the article (helps with informed answers). On a small blog o…

Yeah but to be fair he did ask for alternatives in case you are targeted. It happened at work here too, someone with a grudge and a botnet waged a multi-month targeted campaign, and reCAPTCHA was the only thing that helped.

Are there alternatives in situations like this?

Re: You probably don’t need ReCAPTCHA

#152

Post by imtringued »

shaki-dora wrote: post #122
briandear wrote: post #70

Earlier quoted context omitted.

So you force your users to consent to sharing all of their data with Google? That’ll teach ‘em.

"all their data" is a bit much, isn't it? ReCAPTCHA gives Google exactly one datum, namely the user's visit to the one page it is on. And I would even hazard a guess that the TOS specify that Google will not retain/link that information, considering that's how Analytics is run.

ReCAPTCHA basically looks up your google account and checks your browsing history and if your IP looks "spammy" to determine if you are a bot. The actual challenge is just a data mining operation and isn't meant to actually prove if you are a human because if it has determined you are not a human it won't let you through even if you do 10 challenges correctly.

Re: You probably don’t need ReCAPTCHA

#153

Post by atoav »

sb8244 wrote: post #76
sb8244 wrote: post #72

Earlier quoted context omitted.

What's an alternative that works at scale, though? It's easy to say "this is bad for these reasons, don't use it" while ignoring that there's not really better options once you get targeted.

To clarify, I do think that this post gives good alternatives because most spam is not targeted. However, you must do something like this if you're a big site or a small site who pissed someone off

The reasonable thing to do would be to initially create challanges with multiple levels/difficulties so you can quickly change the mechanism when you are really targeted.

For my personal blog I managed to be spam free with a simple question/answer pair for 5 years. Took me a minute to implement and leaves my user data where it belongs.

Re: You probably don’t need ReCAPTCHA

#154

Post by atoav »

beiller wrote: post #132
shaki-dora wrote: post #122

Earlier quoted context omitted.

"all their data" is a bit much, isn't it? ReCAPTCHA gives Google exactly one datum, namely the user's visit to the one page it is on. And I would even hazard a guess that the TOS specify that Google will not retain/link that information, considering that's how Analytics is run.

I am fairly certain that ReCAPTCHA does many things behind the scenes. It probably is using webGL and many other browser features to "fingerprint" your browser, OS, graphics card, sound card, etc. This is simple by just for example drawing some polygons in the background then reading the frame buffer, because different graphics cards / drivers may output different buffers slightly. Then it can store that fingerprint…

Well on top of that you train the image recognition algorithms of a tech giant. So for them it is a win-win strategy: user data and free labour

Re: You probably don’t need ReCAPTCHA

#155

Post by MakeUsersWant »

zaarn wrote: post #147
mobjack wrote: post #46

Earlier quoted context omitted.

I really dont know how well that will work against a dedicated attacker. I am much more confident in ReCAPTCHA of stopping bots compared to any roll your own solution. I dont want to hope that an alternative is good enough for my needs. I want the best when it comes to protecting my site. Any alternative needs to have a proven track record and support to make consider replacing ReCAPTCHA.

For 20$ you can solve a few million ReCAPTCHA's using Buster and a paid-for STT engine. Atm Buster works about 95% of the time, so you'd see significant amounts of spam even with ReCAPTCHA.

I'd love to pay $20 for a firefox extension that makes this problem go away. I use lots of privacy extensions on Firefox, and those Captchas are annoying as hell. Tor is even worse.

Can you please provide a few ready-to-use links?

Re: You probably don’t need ReCAPTCHA

#156

Post by norrius »

beiller wrote: post #141

Here is an idea I thought of for a captcha. Render your webpage and form and include a hidden "password" field. Use a javascript hashing algorithm to hash the password on the client browser (preferably a very slow one that uses a lot of CPU). When you submit the form check the calculated hash the client did with a pre-calculated hash on the server. If they don't match reject the form. You can pre-generate a list of p…

It could work... If you want to set minimal system requirements to visit your website.

It will also annoy users of password managers with auto-filling capabilities. "password" is normally used for actual passwords.

Besides, nothing stops the attacker from replacing your code with a faster implementation.

Re: You probably don’t need ReCAPTCHA

#157

Post by imtringued »

stordoff wrote: post #99
chii wrote: post #68

Earlier quoted context omitted.

How the hell do they get people to open up their home computer to be used this way?

They encourage developers to include their SDK: > Monetize your mobile app or game with our SDK, without showing intrusive ads or requiring annoying subscriptions and in app purchases. https://luminati.io/sdk They approached nmap of all people: > Hi, > My name is Lior and I'd like to offer you a new way to make money off your software. The Luminati SDK provides your users the option to use your software for free by c…

$3000 USD for 100k users? If you can get five pennies from each you're better off than with this crap.

Re: You probably don’t need ReCAPTCHA

#158

Post by applecrazy »

joshu wrote: post #78
applecrazy wrote: post #18

Earlier quoted context omitted.

There should be an open source captcha solution where all the labeled images can be used to develop a model available freely to the public.

and you don’t think that will be quickly used to make a tool to break the captchas?

No. You cycle through new types of challenges that the model can't solve yet.

For example, one week of stop-sign recognition, another week of pedestrian labeling, etc.

Re: You probably don’t need ReCAPTCHA

#159

Post by swish_bob »

beiller wrote: post #141

Here is an idea I thought of for a captcha. Render your webpage and form and include a hidden "password" field. Use a javascript hashing algorithm to hash the password on the client browser (preferably a very slow one that uses a lot of CPU). When you submit the form check the calculated hash the client did with a pre-calculated hash on the server. If they don't match reject the form. You can pre-generate a list of p…

It would certainly help in some cases, and act as a delay in some others. It pretty much wouldn't stop a targeted attack since they quite probably don't really care about how much CPU use each request is using, and you literally have to publish the code to generate the hash, so it makes it pretty easy to reverse engineer.

Re: You probably don’t need ReCAPTCHA

#160

Post by tutanchamun »

sbov wrote: post #16
blakesterz wrote: post #13

"Many developers vastly over-estimate the likelihood of customized spam." I run 100s of small random low traffic low priority sites. Without some form of form control, the ALL get hit with customized and random other crap spam. I don't have decent experience with many things in life, but I can say this is one topic I have YEARS of experience with. I've never over-estimated the amount of any type of spam any form can…

Have an input element that can't be seen. If it has something in it, ignore the submit. Works for all my sites so far.

Yeah, these honeypotts work quite well, however the last time I looked into it (circa 2012) I read that it is not ideal for visually impaired users with screen readers.
Post reply on HN