Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You probably don’t need ReCAPTCHA

kevv.net

Post reply on HN
Print view View original

161–170 of 246 posts

Re: You probably don’t need ReCAPTCHA

#161

Post by nprateem »

blakesterz wrote: post #13

"Many developers vastly over-estimate the likelihood of customized spam." I run 100s of small random low traffic low priority sites. Without some form of form control, the ALL get hit with customized and random other crap spam. I don't have decent experience with many things in life, but I can say this is one topic I have YEARS of experience with. I've never over-estimated the amount of any type of spam any form can…

I've got some web sites that use javascript to submit a form to an API gateway endpoint which then uses SES to send me an email. I get absolutely zero spam from any of them. I think the vast majority of spammers use non-javascript tools and that recaptcha is unnecessary for most low-profile sites if they'd just use javascript to POST the data instead.

Re: You probably don’t need ReCAPTCHA

#162

Post by progval »

> Uncustomized spambots are also so unintelligent that they do not correctly answer simple questions such as “What is 2+3?”, or “what color is this website?”.

I found that some uncustomized spambots are able to solve simple math challenges like this one.

And the color question is bad for accessibility.

Many of the suggested alternatives are also terrible for accessibility, because they require solving a visual puzzle, without an audio alternative.

Re: You probably don’t need ReCAPTCHA

#163

Post by AstralStorm »

ComputerGuru wrote: post #133
shaki-dora wrote: post #122

Earlier quoted context omitted.

"all their data" is a bit much, isn't it? ReCAPTCHA gives Google exactly one datum, namely the user's visit to the one page it is on. And I would even hazard a guess that the TOS specify that Google will not retain/link that information, considering that's how Analytics is run.

No, that's how it used to be. Now with ReCaptcha v3 the recommend you load it on all your pages, not just the forms you are trying to protect, so they can predict friend vs foe more accurately.

Or rather keep Google tracking cookies alive forever and updated.

Re: You probably don’t need ReCAPTCHA

#164

Post by zaarn »

MakeUsersWant wrote: post #155
zaarn wrote: post #147

Earlier quoted context omitted.

For 20$ you can solve a few million ReCAPTCHA's using Buster and a paid-for STT engine. Atm Buster works about 95% of the time, so you'd see significant amounts of spam even with ReCAPTCHA.

I'd love to pay $20 for a firefox extension that makes this problem go away. I use lots of privacy extensions on Firefox, and those Captchas are annoying as hell. Tor is even worse. Can you please provide a few ready-to-use links?

Just install Buster, it's free on the Mozilla Addon Site, you can set it to a STT provider other than Google, which I recommend since they seem to detect using their STT engine now.

You can pay for Azure and other STT engines to solve it for you an dthe results are usually a bit better.

Re: You probably don’t need ReCAPTCHA

#165

Post by amelius »

applecrazy wrote: post #158
joshu wrote: post #78

Earlier quoted context omitted.

and you don’t think that will be quickly used to make a tool to break the captchas?

No. You cycle through new types of challenges that the model can't solve yet. For example, one week of stop-sign recognition, another week of pedestrian labeling, etc.

Building those models sounds like a lot of continuous and boring work, and is probably best done by a company. Unless you find some crowd-sourced way of building those models.

Re: You probably don’t need ReCAPTCHA

#166

Post by AstralStorm »

Zak wrote: post #74
chii wrote: post #68

Earlier quoted context omitted.

How the hell do they get people to open up their home computer to be used this way?

Users of free mobile apps (mostly games) are offered the option of allowing use of their devices as proxies as an alternative to being interrupted by ads. https://luminati.io/faq

Excellent, a new botnet to exploit. ;)

Re: You probably don’t need ReCAPTCHA

#167

Post by Ntrails »

blakesterz wrote: post #13

"Many developers vastly over-estimate the likelihood of customized spam." I run 100s of small random low traffic low priority sites. Without some form of form control, the ALL get hit with customized and random other crap spam. I don't have decent experience with many things in life, but I can say this is one topic I have YEARS of experience with. I've never over-estimated the amount of any type of spam any form can…

A forum I post on has zero restrictions on sign up. No recaptchas, nothing. Couple of times a month we see some (usually Cyrillic) bot post some thread with a link that (probably) no one clicks and we all have a laugh and tell it to post more (it never does).

It's a small site, footfall in the 10s, so maybe that's the reason.

Re: You probably don’t need ReCAPTCHA

#168

Post by AstralStorm »

sroussey wrote: post #136
briandear wrote: post #73

Earlier quoted context omitted.

And yet they use reCaptcha. I hit it all the time accessing sites when I was in France.

They also have great IP address reputation data

As if IP addresses are not shared. IPv6 isn't present enough.

Re: You probably don’t need ReCAPTCHA

#169

Post by fybe »

analogmemory wrote: post #110
smt88 wrote: post #88

Earlier quoted context omitted.

Disabling autocomplete is user-hostile and additionally should be considered a security flaw. It makes it harder to use password managers.

You can disable a single input field from autocomplete `autocomplete="off"`

'Autocomplete' doesn't work for Firefox (since version 38), Google Chrome (since 34), and Internet Explorer (since version 11

Huge pain

Re: You probably don’t need ReCAPTCHA

#170

Post by nsajko »

I understand when Recaptcha gets used before registration forms, but why, oh why, does Discord do it before any login?

If I know my email address and password I should be able to login without being logged in to Google as well ...

Post reply on HN