You probably don’t need ReCAPTCHA • Hacker News Board

Re: You probably don’t need ReCAPTCHA

#181

Post by mcv » Wed, Jun 12, 2019, 8:50 AM UTC

progval wrote: post #162

> Uncustomized spambots are also so unintelligent that they do not correctly answer simple questions such as “What is 2+3?”, or “what color is this website?”. I found that some uncustomized spambots are able to solve simple math challenges like this one. And the color question is bad for accessibility. Many of the suggested alternatives are also terrible for accessibility, because they require solving a visual puzzle…

> And the color question is bad for accessibility.

That's a valid concern, but not a reason to use ReCaptcha, because ReCaptcha is worse for accessibility.

Re: You probably don’t need ReCAPTCHA

#182

Post by [deleted] » Wed, Jun 12, 2019, 9:01 AM UTC

feikname wrote: post #19

vkou wrote: post #15

Earlier quoted context omitted.

Because when you don't annoy 'too anonymous' users with obnoxious captchas, your service gets flooded with spam, which annoys every single other user. > To pretend this is about slowing down bots is disingenuous as best. I'm not sure you have a good understanding of what happens to internet services when they don't throttle spam. They become completely unusable.

ReCAPTCHA doesn't prevent the kind of spam that makes internet services completely unusable (i.e. DDoS botnets), it prevents form submition spam.

[deleted]

Re: You probably don’t need ReCAPTCHA

#183

Post by mcv » Wed, Jun 12, 2019, 9:02 AM UTC

comex wrote: post #23

3xblah wrote: post #9

"ReCAPTCHA relies extensively on user fingerprinting, putting emphasis on the question of "Which human is this user?" rather than the ordinary "Is this user human?". " Classic example of collecting more information than what is needed.

Depends. The traditional techniques that automatically establish humanity without determining identity are more and more vulnerable to AI, so the only way to keep CAPTCHAs effective is to integrate identity. From that perspective, ReCAPTCHA isn’t collecting more than “needed”. On the other hand, the cutting-edge cryptographic technique used by Privacy Pass does supposedly preserve anonymity by making it impossible fo…

> The traditional techniques that automatically establish humanity without determining identity are more and more vulnerable to AI, so the only way to keep CAPTCHAs effective is to integrate identity.

Is it? What's stopping AI from developing an identity in the eyes of Google? An AI that might behave exactly like Google's ideal user. Searches random stuff on their search, looks at and clicks their ads, logs in to various Google services, and when it encounters a ReCaptcha, it clicks the "I'm not a robot" checkbox.

At some point, caring about privacy might turn out to be the distinguishing feature of humans.

Re: You probably don’t need ReCAPTCHA

#184

Post by buboard » Wed, Jun 12, 2019, 9:04 AM UTC

downandout wrote: post #123

One thing you can do to slow down bots is make it computationally expensive to sign up. Utilize a JavaScript-based proof of work library. Normal users can breeze right through, but somebody trying to create thousands of accounts will find their operation grinding to a halt.

coin miners would be an option, however adblockrs would block them and antiviruses consider them malware

Re: You probably don’t need ReCAPTCHA

#185

Post by buboard » Wed, Jun 12, 2019, 9:07 AM UTC

frosted-flakes wrote: post #91

Washuu wrote: post #87

Earlier quoted context omitted.

There is someone else on the other end. I had one of them previously get on the forums I worked on and complain about how quick I was to blocked them. I wrote an entire system for learning the patterns and automatically blocking them as they occurred. Eventually I determined that the vast majority of the IP addresses originated from Bangladesh so I just banned the entire country from accessing the web sites. That was…

I have to ask, why do people do this? What do they get out of it?

i have the same experience, exclusively bangladeshi and indian IPs signing up to enter SEO spam for small businesses in the US (insurance, hair salons, lawyers, house renovation etc etc). Stopforumspam has most of them in their lists.

Re: You probably don’t need ReCAPTCHA

#186

Post by analogmemory » Wed, Jun 12, 2019, 9:10 AM UTC

fybe wrote: post #169

analogmemory wrote: post #110

Earlier quoted context omitted.

You can disable a single input field from autocomplete `autocomplete="off"`

'Autocomplete' doesn't work for Firefox (since version 38), Google Chrome (since 34), and Internet Explorer (since version 11 Huge pain

This totally works in latest Chrome/FF/Safari

https://codesandbox.io/s/static-jkvzs

https://jkvzs.codesandbox.io/

The other trick is to add a random string/number in from of the name attribute e.g. name="348349_name". This prevents autofill. Interestingly 1Password and LastPass are smart enough to infer that it's a name or email field.

For the honeypot, random number + word makes it ignored by autofill/1password

Re: You probably don’t need ReCAPTCHA

#187

Post by mnw21cam » Wed, Jun 12, 2019, 9:15 AM UTC

jmpeax wrote: post #71

x = exp(-i)

x = cos(1) - isin(1)

Re: You probably don’t need ReCAPTCHA

#188

Post by qtplatypus » Wed, Jun 12, 2019, 9:18 AM UTC

cf141q5325 wrote: post #172

throwawaymath wrote: post #31

Earlier quoted context omitted.

As the commenter said, they rotate IPs. It is not that easy. I've also been on the other side of a sophisticated attack like this. The really savvy adversaries do the following, at least: 1. Rotate through several thousand to several hundred thousand noncontiguous, geographically distributed, residential IP addresses, 2. Associate each IP address with a single user agent and suite of cookies, 3. Associate each IP add…

>The most sophisticated attackers will still lease reputable Google accounts and mechanical turk time to bypass Recaptcha challenges, but it will be expensive for them. You can also just pay people to solve recaptchas all day.

However that still contributes to security. If you make the expense of bypassing it greater then the worth of accessing the site then you have stopped them.

Re: You probably don’t need ReCAPTCHA

#189

Post by qtplatypus » Wed, Jun 12, 2019, 9:28 AM UTC

nsajko wrote: post #170

I understand when Recaptcha gets used before registration forms, but why, oh why, does Discord do it before any login? If I know my email address and password I should be able to login without being logged in to Google as well ...

To stop bots trying lists of usernane password pairs.

Re: You probably don’t need ReCAPTCHA

#190

Post by ackbar03 » Wed, Jun 12, 2019, 9:30 AM UTC

luckylion wrote: post #109

cardine wrote: post #11

In my experience, the biggest issue I run into is targeted botnet brute force attacks. In cases like these, someone loads up a huge botnet, a downloaded list of hacked usernames and passwords, and tries every single combination hoping to find a reused username/password combination. In these cases, it is almost always extremely targeted. Log correlation has helped quite a bit, but it is still very painful since they a…

I've never dealt with anything seriously distributed. Are they running full browsers or simple scripts? Do they execute JS, do they load images? Do they perform other actions on the site, or will they show up with their initial request be a login request? Do they simulate keyboard and mouse events?

Curious about this too