Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You probably don’t need ReCAPTCHA

kevv.net

Post reply on HN
Print view View original

221–230 of 246 posts

Re: You probably don’t need ReCAPTCHA

#221

Post by dasanman »

sbov wrote: post #16
blakesterz wrote: post #13

"Many developers vastly over-estimate the likelihood of customized spam." I run 100s of small random low traffic low priority sites. Without some form of form control, the ALL get hit with customized and random other crap spam. I don't have decent experience with many things in life, but I can say this is one topic I have YEARS of experience with. I've never over-estimated the amount of any type of spam any form can…

Have an input element that can't be seen. If it has something in it, ignore the submit. Works for all my sites so far.

We used to this, does not seem to work at all these days anymore

Re: You probably don’t need ReCAPTCHA

#222

Post by bduerst »

gbear605 wrote: post #101
bduerst wrote: post #27

Earlier quoted context omitted.

>Why isn't there a solid alternative offering yet? The latest version of recaptcha doesn't even prompt users. It loads on the front-end and uses a scoring system. It's likely you've used it but didn't even know because it's invisible. It's the older implementations that have the slow loading images.

On Google Chrome, with adblock on, without my Google account signed in, in a new incognito tab with no extensions, I have the experience of it being invisible. When I go back to the same site on Firefox, logged onto my Google account, no adblock on, no privacy options on, I have to identify dozens of photos. As far as I can tell, it just checks to see if your browser is Google Chrome to give you your score.

Again, that's still not the latest version of recaptcha, which never prompts users for photos.

Re: You probably don’t need ReCAPTCHA

#223

Post by [deleted] »

DCoder wrote: post #90
charrondev wrote: post #61

Earlier quoted context omitted.

I was preparing a response here, but many of the other commenters have covered it. I recently spent time ensuring our Auth pages’ HTML could be easily cached outside of our application servers. They were a common target of DDOS attacks because we were generating a unique nonce for CSRF protection. Randomizing form field names does not defeat a targeted attacker (and we have definitely been a target), prevents HTML ca…

> Randomizing form field names […] will prevent auto filling fields by browsers and password managers. I wholly agree that this would not help, but for the sake of completeness, I want to point out that [0] is designed to solve this, by decoupling input field names from their intent. But Chrome is playing dumb about it [1]. And of course, the spambots will just adapt to parse the autocomplete info… [0]: https://devel…

[deleted]

Re: You probably don’t need ReCAPTCHA

#224

Post by sli »

mcv wrote: post #174
mobjack wrote: post #46

Earlier quoted context omitted.

I really dont know how well that will work against a dedicated attacker. I am much more confident in ReCAPTCHA of stopping bots compared to any roll your own solution. I dont want to hope that an alternative is good enough for my needs. I want the best when it comes to protecting my site. Any alternative needs to have a proven track record and support to make consider replacing ReCAPTCHA.

> I am much more confident in ReCAPTCHA of stopping bots compared to any roll your own solution. I'm much more afraid of ReCaptcha blocking bonafide users. It's a harmful obstacle that punishes legitimate users for not sharing as much data as possible with Google. Even if you really need a captcha, there are better solutions out there.

Google really, really does not like people who use Firefox and/or a VPN.

Re: You probably don’t need ReCAPTCHA

#225

Post by sli »

inferiorhuman wrote: post #191
ComputerGuru wrote: post #133

Earlier quoted context omitted.

No, that's how it used to be. Now with ReCaptcha v3 the recommend you load it on all your pages, not just the forms you are trying to protect, so they can predict friend vs foe more accurately.

So how does one block this?

Firefox and uMatrix[0], and then never go to those sites again, because you won't be able to use them anyway. Whether or not you want to contact the owner of the site and tell them what's up is up to you.

[0]: https://addons.mozilla.org/en-US/firefox/addon/umatrix/

Re: You probably don’t need ReCAPTCHA

#226

Post by jrphenow »

tutanchamun wrote: post #160
sbov wrote: post #16

Earlier quoted context omitted.

Have an input element that can't be seen. If it has something in it, ignore the submit. Works for all my sites so far.

Yeah, these honeypotts work quite well, however the last time I looked into it (circa 2012) I read that it is not ideal for visually impaired users with screen readers.

I forget everything that you need to do, but I believe I read that there's a happy medium you can strike such that a script would still input data but it wouldn't be shown to a screen reader.

Re: You probably don’t need ReCAPTCHA

#227

Post by m-p-3 »

aflag wrote: post #209
Tepix wrote: post #203

Earlier quoted context omitted.

But that's something captchas are used for. Prevent fake signups.

It doesn't do that, though. Humans also create fake accounts. It does make mass creation of fake accounts impractical, though. I solved that in past by actually charging for my service. I think the internet would benefit from having more paid content and less ads driven stuff. One thing that captchas do protect from is brute force attacks on user passwords. Although there are other possibilities (like making the conn…

This is why you need a multi-layered solution to fight spam. Captchas reduce the amount of fake accounts, which can then be taken care of by the additional layers.

It's easier to fight against a bigger opponent (botnets, etc) if you mitigate their superiority in number first.

Re: You probably don’t need ReCAPTCHA

#228

Post by beiller »

swish_bob wrote: post #159
beiller wrote: post #141

Here is an idea I thought of for a captcha. Render your webpage and form and include a hidden "password" field. Use a javascript hashing algorithm to hash the password on the client browser (preferably a very slow one that uses a lot of CPU). When you submit the form check the calculated hash the client did with a pre-calculated hash on the server. If they don't match reject the form. You can pre-generate a list of p…

It would certainly help in some cases, and act as a delay in some others. It pretty much wouldn't stop a targeted attack since they quite probably don't really care about how much CPU use each request is using, and you literally have to publish the code to generate the hash, so it makes it pretty easy to reverse engineer.

Its not reverse engineer-able. Its basically "proof-of-work" as in all participants know the algorithm, you just make attackers spend CPU time to use your site which would slow them down or cost money.

Re: You probably don’t need ReCAPTCHA

#229

Post by beiller »

norrius wrote: post #156
beiller wrote: post #141

Here is an idea I thought of for a captcha. Render your webpage and form and include a hidden "password" field. Use a javascript hashing algorithm to hash the password on the client browser (preferably a very slow one that uses a lot of CPU). When you submit the form check the calculated hash the client did with a pre-calculated hash on the server. If they don't match reject the form. You can pre-generate a list of p…

It could work... If you want to set minimal system requirements to visit your website. It will also annoy users of password managers with auto-filling capabilities. "password" is normally used for actual passwords. Besides, nothing stops the attacker from replacing your code with a faster implementation.

I shouldn't have named it "password". The idea was all the form fields are hidden and the process is transparent to the user.

Re: You probably don’t need ReCAPTCHA

#230

Post by konradb »

alibarber wrote: post #217
blakesterz wrote: post #13

"Many developers vastly over-estimate the likelihood of customized spam." I run 100s of small random low traffic low priority sites. Without some form of form control, the ALL get hit with customized and random other crap spam. I don't have decent experience with many things in life, but I can say this is one topic I have YEARS of experience with. I've never over-estimated the amount of any type of spam any form can…

I have next to zero experience in this, but completely agree. Literally 'my first website' I made when I was a kid that had a very basic guestbook that I put together in php (actually it may have even been perl)/mysql got hit with random spam. Everything was something completely custom that I had made and not some package that may have had a common vulnerability - so there was and must still be stuff crawling the web…

I must lack imagination! I cannot figure out what the ROI is if one codes stuff to randomly submit crap to forms.
Post reply on HN