Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You probably don’t need ReCAPTCHA

kevv.net

Post reply on HN
Print view View original

211–220 of 246 posts

Re: You probably don’t need ReCAPTCHA

#211

Post by throwawaymath »

cf141q5325 wrote: post #172
throwawaymath wrote: post #31

Earlier quoted context omitted.

As the commenter said, they rotate IPs. It is not that easy. I've also been on the other side of a sophisticated attack like this. The really savvy adversaries do the following, at least: 1. Rotate through several thousand to several hundred thousand noncontiguous, geographically distributed, residential IP addresses, 2. Associate each IP address with a single user agent and suite of cookies, 3. Associate each IP add…

>The most sophisticated attackers will still lease reputable Google accounts and mechanical turk time to bypass Recaptcha challenges, but it will be expensive for them. You can also just pay people to solve recaptchas all day.

That's what mechanical turk is.

Re: You probably don’t need ReCAPTCHA

#212

Post by cf141q5325 »

throwawaymath wrote: post #211
cf141q5325 wrote: post #172

Earlier quoted context omitted.

>The most sophisticated attackers will still lease reputable Google accounts and mechanical turk time to bypass Recaptcha challenges, but it will be expensive for them. You can also just pay people to solve recaptchas all day.

That's what mechanical turk is.

Thanks a lot for the correction. I blame the lack of coffee...

Re: You probably don’t need ReCAPTCHA

#213

Post by pornel »

I've developed an alternative to captcha for blog comment/forum spam a while ago.

There are many methods that are easily dismissed with "but not all spam is like that" and "someone could work around it easily":

• blocking of links (if you don't need them, or in fields that are not for them).

• blocking of obviously spammy keywords (or bayesian filter)

• invisible fields and syntax to trip up dumb implementations

• requiring JS, properly-functioning cookies

• blocking of IP ranges that belong to VPS providers and a couple of 3rd world telecoms that allow spam

Each of them is surprisingly effective and combined they block 99.8%.

You really shouldn't flatter yourself thinking that a spammer will even look at your page. They have literally millions of sites to spam, and they couldn't care less if they get yours or not. A bot will find a 1000 other sites to spam quicker than it takes a human to click "View Source".

Most of spam is done by amateurs who take shitty off-the-shelf spam software, seed it with a target list copied off some forum, and run it on a couple of spam-friendly or incompetent VPS hosts. By volume, this is the vast majority and it's very easy to block.

Re: You probably don’t need ReCAPTCHA

#214

Post by adrianN »

mattigames wrote: post #43
netok wrote: post #38

Earlier quoted context omitted.

It will also ignore people who use browser's autofill form function. Realized this after receiving a dozen complaints.

You can randomly generate the "name" of the fields and autofill will never fill them, another option to disable autocomplete is to leave them without "name" and handling the submit using JavaScript.

There are people who don't run Javascript.

Re: You probably don’t need ReCAPTCHA

#215

Post by charrondev »

buboard wrote: post #180
charrondev wrote: post #17

Earlier quoted context omitted.

Doesn’t work as soon as you’re big enough to target. The company I work for makes a SaSS forum product, and while we do have multiple spam prevention methods (akismet, stopforumspam, honeypot, a hidden input), there’s enough stuff out there that has targeted our platform that a Recaptcha on the registration form is needed. We haven’t need it on any other forms yet though. After registration it’s all handled by the ot…

do you eliminate all spam that way? i get signup SEO spam even with recaptcha & stopforumspam.

No it does not. Some creeps through the registration system, which is why we have additional trust measures afterwards.

On my own site I see 1 or 2 spam posts a week although I get the feeling it’s real people doing the registration. They sign up, make 1 comment, get reported very quickly, then banned.

We haven’t had to make our signup/registration system that strong in of itself though, because most of our largest clients end up using some SSO method exclusively and will have their own prevention methods.

Re: You probably don’t need ReCAPTCHA

#216

Post by throwaway2048 »

mda wrote: post #192
imtringued wrote: post #152

Earlier quoted context omitted.

ReCAPTCHA basically looks up your google account and checks your browsing history and if your IP looks "spammy" to determine if you are a bot. The actual challenge is just a data mining operation and isn't meant to actually prove if you are a human because if it has determined you are not a human it won't let you through even if you do 10 challenges correctly.

Theoretocally it might use signals when you are logged in, but Recaptcha also works when you are not logged into google. So, not really.

Just because login isn't required, dosen't mean its not recorded.

Re: You probably don’t need ReCAPTCHA

#217

Post by alibarber »

blakesterz wrote: post #13

"Many developers vastly over-estimate the likelihood of customized spam." I run 100s of small random low traffic low priority sites. Without some form of form control, the ALL get hit with customized and random other crap spam. I don't have decent experience with many things in life, but I can say this is one topic I have YEARS of experience with. I've never over-estimated the amount of any type of spam any form can…

I have next to zero experience in this, but completely agree. Literally 'my first website' I made when I was a kid that had a very basic guestbook that I put together in php (actually it may have even been perl)/mysql got hit with random spam. Everything was something completely custom that I had made and not some package that may have had a common vulnerability - so there was and must still be stuff crawling the web looking for any kind of form to push junk into. In this case it was clearly trying to do some spam 'SEO'/keyword stuffing, because the page would display the static text (I was smart enough to filter out HTML though)...

Re: You probably don’t need ReCAPTCHA

#218

Post by SamuelAdams »

frosted-flakes wrote: post #91
Washuu wrote: post #87

Earlier quoted context omitted.

There is someone else on the other end. I had one of them previously get on the forums I worked on and complain about how quick I was to blocked them. I wrote an entire system for learning the patterns and automatically blocking them as they occurred. Eventually I determined that the vast majority of the IP addresses originated from Bangladesh so I just banned the entire country from accessing the web sites. That was…

I have to ask, why do people do this? What do they get out of it?

I recommend reading the book "Spam Nation" by Brian Krebs(sp?). He goes into the different motives behind spam, the big actors, and how people get paid for creating spam.

Re: You probably don’t need ReCAPTCHA

#219

Post by PopeDotNinja »

peteretep wrote: post #204
PopeDotNinja wrote: post #121

Earlier quoted context omitted.

Please just don't use the bouncing ball that Dropbox made me use once. It was the first time my lack of athleticism prevented me from a signing in.

What is that? This comment is the first Google result for dropbox bouncing ball.

I tried from finding it myself, and I've only seen it once. I was logging into Dropbox via Chrome on my Android phone, and I must have done something to trigger captcha spambot hell. I just tried triggering it again and was not able to do so.

The ball had an animal in it and I was asked to bounce the ball, causing it to rotate. I had to bounce the ball with just enough force to get it to land so the animal was positioned upright. After several failed attempts, I gave up.

Re: You probably don’t need ReCAPTCHA

#220

Post by PopeDotNinja »

spongeb00b wrote: post #146
PopeDotNinja wrote: post #121

Earlier quoted context omitted.

Please just don't use the bouncing ball that Dropbox made me use once. It was the first time my lack of athleticism prevented me from a signing in.

I’ve not heard of this one before. Wouldn’t it cause serious problems for accessibility?

Almost certainly.
Post reply on HN