Earlier quoted context omitted.
User agent is quickly changed.
Doesn't iPhone have some sort of device attestation?
In the browser?
You probably don’t need ReCAPTCHA
201–210 of 246 posts
Re: You probably don’t need ReCAPTCHA
#202"Many developers vastly over-estimate the likelihood of customized spam." I run 100s of small random low traffic low priority sites. Without some form of form control, the ALL get hit with customized and random other crap spam. I don't have decent experience with many things in life, but I can say this is one topic I have YEARS of experience with. I've never over-estimated the amount of any type of spam any form can…
I used 5 randomly choosen english questions with easy answers my readers would know — this prevented literally 100% of the unwanted spam, while it was easy on the users. If you want to filter comments you could even make the questions reflect the content of the article, filtering uninformed TL;DR type of comments and giving the users the feeling you value onformed opinions.
This (or something very similar) is a core feature of phpBB:
https://www.phpbb.com/support/docs/en/3.2/kb/article/how-to-...
It works very well.
Re: You probably don’t need ReCAPTCHA
#203I think we have to take a step back, and consider why we want to separate humans from computers in the first place. Humans can do a lot of bad things that computers can do. Think of armies of low-wage people in Asia, that are paid to click on ads, spread spam, or write reviews. And also consider that computers can actually do good things, for example, allowing humans to automate their work on certain websites, or pro…
But that's something captchas are used for. Prevent fake signups.
Re: You probably don’t need ReCAPTCHA
#204Earlier quoted context omitted.
Doesn’t work as soon as you’re big enough to target. The company I work for makes a SaSS forum product, and while we do have multiple spam prevention methods (akismet, stopforumspam, honeypot, a hidden input), there’s enough stuff out there that has targeted our platform that a Recaptcha on the registration form is needed. We haven’t need it on any other forms yet though. After registration it’s all handled by the ot…
Please just don't use the bouncing ball that Dropbox made me use once. It was the first time my lack of athleticism prevented me from a signing in.
What is that? This comment is the first Google result for dropbox bouncing ball.
Re: You probably don’t need ReCAPTCHA
#205Earlier quoted context omitted.
Did you try randomizing the 'name' and 'ids' of the inputs? (including the invisible one)
I really dont know how well that will work against a dedicated attacker. I am much more confident in ReCAPTCHA of stopping bots compared to any roll your own solution. I dont want to hope that an alternative is good enough for my needs. I want the best when it comes to protecting my site. Any alternative needs to have a proven track record and support to make consider replacing ReCAPTCHA.
When you consider what “the best” means, please include the value of not feeding your users into Google’s gaping maw.
Re: You probably don’t need ReCAPTCHA
#206Earlier quoted context omitted.
I really dont know how well that will work against a dedicated attacker. I am much more confident in ReCAPTCHA of stopping bots compared to any roll your own solution. I dont want to hope that an alternative is good enough for my needs. I want the best when it comes to protecting my site. Any alternative needs to have a proven track record and support to make consider replacing ReCAPTCHA.
When you consider what “the best” means, please include the value of not feeding your users into Google’s gaping maw.
Some have never cared or either stopped caring altogether because of the average user's apathy. Not that I agree with it, but I can see why someone would ignore that con in favor of the pros.
Re: You probably don’t need ReCAPTCHA
#207Re: You probably don’t need ReCAPTCHA
#208Earlier quoted context omitted.
Sounds like the answer is to increase the response size for failed login requests. At $12.5/G, if you blow up your response to a mega byte, they'll spend about a cent per try - close to the rate they'll need to pay to have recaptchas solved by humans.
Then can't they run-out-of-money DDoS you fairly easily? Since you'd pay for the outgoing bandwidth and at Google Cloud and AWS that's expensive.
I don't know how expensive it is with Google/AWS, but I'm paying about $1.50 per TB at my non-cloud-host (vs their $12500/TB), so if it comes down to it, they need to outspend me by multiple magnitudes. Sucks, but still cheaper than losing customers due to hyper-annoying Recaptchas, and I doubt that somebody is willing to stomach $12500 cost to make me suffer $1.50 ... I'm sure there would be more efficient attacks ;)
Re: You probably don’t need ReCAPTCHA
#209I think we have to take a step back, and consider why we want to separate humans from computers in the first place. Humans can do a lot of bad things that computers can do. Think of armies of low-wage people in Asia, that are paid to click on ads, spread spam, or write reviews. And also consider that computers can actually do good things, for example, allowing humans to automate their work on certain websites, or pro…
But that's something captchas are used for. Prevent fake signups.
It doesn't do that, though. Humans also create fake accounts. It does make mass creation of fake accounts impractical, though.
I solved that in past by actually charging for my service. I think the internet would benefit from having more paid content and less ads driven stuff.
One thing that captchas do protect from is brute force attacks on user passwords. Although there are other possibilities (like making the connection slow after a number of attempts).
Re: You probably don’t need ReCAPTCHA
#210Earlier quoted context omitted.
I was preparing a response here, but many of the other commenters have covered it. I recently spent time ensuring our Auth pages’ HTML could be easily cached outside of our application servers. They were a common target of DDOS attacks because we were generating a unique nonce for CSRF protection. Randomizing form field names does not defeat a targeted attacker (and we have definitely been a target), prevents HTML ca…
> and will prevent auto filling fields by browsers and password managers. I would MUCH prefer the recaptcha over this!
Your browser probably isn’t smart enough to autofill the ‘comment’ part of a guestbook or the ‘body’ of an email.