Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The No CAPTCHA problem

homakov.blogspot.com

Post reply on HN
Print view View original

21–30 of 100 posts

Re: The No CAPTCHA problem

#21

Post by geerlingguy »

mseebach wrote: post #20
geerlingguy wrote: post #4

This is why I still recommend using other form spam prevention techniques before sacrificing usability for a CAPTCHA. One of the most effective combinations for 80%+ of the sites I've ever dealt with is having a honeypot field in the form, plus some amount of time required to pass before the form can be submitted successfully. There are other ways to mitigate bots as well, but these two alone have sufficed for quite…

A custom spam prevention system, such as a honeypot or the simple "What's n+m?" field, works at 100% until your site is valuable enough for the attacker to spend a couple of cycles to circumvent the honeypot - then it drops to 0%. Publishing your solution as a module just serves to increase the value of circumventing it. The value of "real" CAPTCHAs is that they retain their deterrence no matter how much effort the a…

The logic is sound, but doesn't play out in the real world that often. The reality is, the overwhelming majority of form spam comes from scripts and bots that are not that well-targeted, and in most cases, people who would normally install reCAPTCHA have no need for it.

Additionally, even though the module has been published for quite a while, and honeypot/time-gate techniques are fairly common, most bots can't account for the small adjustments that are made from site to site using adjustable settings for the module (like field name, time defaults, etc.).

The truth is: once your site or app is targeted by a human who is determined to spam you, the stakes are raised to the point where neither CAPTCHAs nor standard honeypots will deter everything. You will have to do at least some ongoing work to find a way to defeat the spammers.

Re: The No CAPTCHA problem

#22

Post by aaron695 »

Random blog article destroys entire Google team of high paid professional engineers specifically employed to solve this problem and they did it just using incognito mode.

Upvote FTW.

Re: The No CAPTCHA problem

#23

Post by meowface »

geerlingguy wrote: post #21
mseebach wrote: post #20

Earlier quoted context omitted.

A custom spam prevention system, such as a honeypot or the simple "What's n+m?" field, works at 100% until your site is valuable enough for the attacker to spend a couple of cycles to circumvent the honeypot - then it drops to 0%. Publishing your solution as a module just serves to increase the value of circumventing it. The value of "real" CAPTCHAs is that they retain their deterrence no matter how much effort the a…

The logic is sound, but doesn't play out in the real world that often. The reality is, the overwhelming majority of form spam comes from scripts and bots that are not that well-targeted, and in most cases, people who would normally install reCAPTCHA have no need for it. Additionally, even though the module has been published for quite a while, and honeypot/time-gate techniques are fairly common, most bots can't accou…

>The logic is sound, but doesn't play out in the real world that often.

It does play out in the real world a whole lot if you have the misfortune to be in charge of certain kinds of websites.

> once your site or app is targeted by a human who is determined to spam you, the stakes are raised to the point where neither CAPTCHAs nor standard honeypots will deter everything.

reCAPTCHA stops the bulk of it. Yes, people can still use CAPTCHA farms, but at the very least they increase the attacker's cost and will generally reduce their spam rate by a lot. After 4chan rolled out reCAPTCHA, 5+ years of spam problems vanished in an instant.

Re: The No CAPTCHA problem

#24

Post by geerlingguy »

meowface wrote: post #23
geerlingguy wrote: post #21

Earlier quoted context omitted.

The logic is sound, but doesn't play out in the real world that often. The reality is, the overwhelming majority of form spam comes from scripts and bots that are not that well-targeted, and in most cases, people who would normally install reCAPTCHA have no need for it. Additionally, even though the module has been published for quite a while, and honeypot/time-gate techniques are fairly common, most bots can't accou…

>The logic is sound, but doesn't play out in the real world that often. It does play out in the real world a whole lot if you have the misfortune to be in charge of certain kinds of websites. > once your site or app is targeted by a human who is determined to spam you, the stakes are raised to the point where neither CAPTCHAs nor standard honeypots will deter everything. reCAPTCHA stops the bulk of it. Yes, people ca…

> It does play out in the real world a whole lot if you have the misfortune to be in charge of certain kinds of websites.

Very true; for some classes of sites, this is definitely the case. I was speaking more in a general sense, as I see many developers and project teams install some sort of CAPTCHA on every site as a default. In most circumstances, I think people should go for the simpler solution first, then be ready to drop in something like reCAPTCHA (or some other active spam deterrent) only when spam becomes a real problem.

Re: The No CAPTCHA problem

#25

Post by Kequc »

aaron695 wrote: post #22

Random blog article destroys entire Google team of high paid professional engineers specifically employed to solve this problem and they did it just using incognito mode. Upvote FTW.

Is this sarcasm? The purpose of Nocaptcha was to alleviate pain for users, as this blog says nothing else has changed. In fact Google said it would fall back to normal captcha when necessary we already knew that.

Re: The No CAPTCHA problem

#26

Post by danielweber »

mseebach wrote: post #20
geerlingguy wrote: post #4

This is why I still recommend using other form spam prevention techniques before sacrificing usability for a CAPTCHA. One of the most effective combinations for 80%+ of the sites I've ever dealt with is having a honeypot field in the form, plus some amount of time required to pass before the form can be submitted successfully. There are other ways to mitigate bots as well, but these two alone have sufficed for quite…

A custom spam prevention system, such as a honeypot or the simple "What's n+m?" field, works at 100% until your site is valuable enough for the attacker to spend a couple of cycles to circumvent the honeypot - then it drops to 0%. Publishing your solution as a module just serves to increase the value of circumventing it. The value of "real" CAPTCHAs is that they retain their deterrence no matter how much effort the a…

It takes an order of magnitude more effort to code around my custom-built anti-spam solution than it took for me to create it.

This doesn't always mean it's worth it, but it's a good leverage for beginners.

Re: The No CAPTCHA problem

#27

Post by meowface »

geerlingguy wrote: post #24
meowface wrote: post #23

Earlier quoted context omitted.

>The logic is sound, but doesn't play out in the real world that often. It does play out in the real world a whole lot if you have the misfortune to be in charge of certain kinds of websites. > once your site or app is targeted by a human who is determined to spam you, the stakes are raised to the point where neither CAPTCHAs nor standard honeypots will deter everything. reCAPTCHA stops the bulk of it. Yes, people ca…

> It does play out in the real world a whole lot if you have the misfortune to be in charge of certain kinds of websites. Very true; for some classes of sites, this is definitely the case. I was speaking more in a general sense, as I see many developers and project teams install some sort of CAPTCHA on every site as a default. In most circumstances, I think people should go for the simpler solution first, then be rea…

I'd agree with that. It's good to have the code production-ready at a moment's notice though, because the reaction time can sometimes mean the difference between having to clean up 100 spam submissions and thousands of spam submissions.

Re: The No CAPTCHA problem

#28

Post by homakov »

aaron695 wrote: post #22

Random blog article destroys entire Google team of high paid professional engineers specifically employed to solve this problem and they did it just using incognito mode. Upvote FTW.

Lol no, i simply found original article too promising with minimum technical details so I decided to dig. And a weakness is a weakness, not a vulnerability. Something to think of.
Post reply on HN