Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You probably don’t need ReCAPTCHA

kevv.net

Post reply on HN
Print view View original

231–240 of 246 posts

Re: You probably don’t need ReCAPTCHA

#231

Post by Blackthorn »

tszyn wrote: post #149
Blackthorn wrote: post #50

Literally none of those alternative methods listed worked on my moderate traffic wiki. Recaptcha (and before it went away, identify the dogs or cats from Microsoft) is literally the only solution that stopped us from getting spammed. I wonder how much experience the author of this article really has in this domain. Recaptcha has saved the internet as far as I'm concerned.

For my small wiki, refusing all submissions with external links eliminated virtually all spam. Yes, it's drastic, but in my case external links were not essential. I still use ReCaptcha to cut down on spam account signups.

We do that as well, outside of a small whitelist of allowed external links. Turns out it's not enough and we still need recaptcha for a few reasons.

We have a small set of anonymous edits every day, which go through recaptcha to be allowed.

Re: You probably don’t need ReCAPTCHA

#232

Post by applecrazy »

amelius wrote: post #165
applecrazy wrote: post #158

Earlier quoted context omitted.

No. You cycle through new types of challenges that the model can't solve yet. For example, one week of stop-sign recognition, another week of pedestrian labeling, etc.

Building those models sounds like a lot of continuous and boring work, and is probably best done by a company. Unless you find some crowd-sourced way of building those models.

Exactly, see the other comment in response to mine. If Mozilla can do this for speech recognition, then we can do this for image recognition/transcription tasks.

Re: You probably don’t need ReCAPTCHA

#233

Post by vkou »

mcv wrote: post #179
luckylion wrote: post #116

Earlier quoted context omitted.

Most forum or blog comment spam I've seen was trivial to detect, even without access to the server. Isn't written in the right language? Very likely spam. Contains a link and little text? Very likely spam. If you have access to the server's information, it gets even better. Origin makes it much easier to identify likely spam, previous interactions with the site and their speed ("hits the page and 1s later submits a c…

I'd much rather have a service where I can submit a comment to check if it's meaningful or likely spam, than to force my users to waste time and share data with Google that they don't want to. If clearly spam, block it, if clearly okay, allow it. If unsure, leave it for a moderator. It might even train users to write better comments if badly written ones need to wait for moderation.

As if that's not a complete privacy nightmare. I'm sure either the NSA, or an ad-tech agency would love to get a firehose feed of this sort of data, while providing you with a YES-SPAM/NO-SPAM service.

Also, anyone who mentions can be, of course, blackholed as spam. ;)

Re: You probably don’t need ReCAPTCHA

#234

Post by throwawaymath »

ackbar03 wrote: post #193
throwawaymath wrote: post #98

Earlier quoted context omitted.

To be clear, I don’t have a horse in this particular race. I’m neither condemning nor condoning the market dynamics of sneaker arbitrage here. It’s just an example I’m very familiar with because I used to write scrapers and I’ve been offered silly amounts of money to make them for sneaker trading groups. Not as much as hedge funds will pay for writing crawlers for market research, but still more than you’d probably e…

Hedge fund paying for scrapers, is that a common thing these days? What kind of prices do they pay if I may ask?

Extremely common. Most hedge funds buy what's called "alternative data" from vendors who aggregate it, like 7Park. The data is collected by providers who collect it from location telemetry, web scraping, satellite imagery, etc. Scraping from web applications is one of the more common forms.

The more successful quant funds will often build out internal research teams to do this. For example, both Two Sigma and Millennium have (not so well advertised) research teams devoted to this kind of data collection internally.

Re: You probably don’t need ReCAPTCHA

#235

Post by cardine »

luckylion wrote: post #111
hombre_fatal wrote: post #52

Earlier quoted context omitted.

https://luminati.io/#pricing

Sounds like the answer is to increase the response size for failed login requests. At $12.5/G, if you blow up your response to a mega byte, they'll spend about a cent per try - close to the rate they'll need to pay to have recaptchas solved by humans.

Most criminals are not using services like Luminati - they are using actual botnets made up of compromised computers. In that case, their bandwidth costs are far cheaper than yours.

Re: You probably don’t need ReCAPTCHA

#236

Post by mcv »

vkou wrote: post #233
mcv wrote: post #179

Earlier quoted context omitted.

I'd much rather have a service where I can submit a comment to check if it's meaningful or likely spam, than to force my users to waste time and share data with Google that they don't want to. If clearly spam, block it, if clearly okay, allow it. If unsure, leave it for a moderator. It might even train users to write better comments if badly written ones need to wait for moderation.

As if that's not a complete privacy nightmare. I'm sure either the NSA, or an ad-tech agency would love to get a firehose feed of this sort of data, while providing you with a YES-SPAM/NO-SPAM service. Also, anyone who mentions can be, of course, blackholed as spam. ;)

As long as it's a public forum, I don't see the issue. It's going to be public anyway, and they could easily scrape it if they want to.

The submission itself should be done by the site, so the user remains anonymous.

Re: You probably don’t need ReCAPTCHA

#237

Post by dennisgorelik »

sroussey wrote: post #130
ordu wrote: post #25

Earlier quoted context omitted.

> We implement Akismet, StopForumSpam, Project Honeypot, and ReCAPTCHA Did you tried some techniques from the article? Like hidden form fields, simple javascript checks or simple captcha?

I used to run a forum hosting service. After a while you try everything. Honeypot fields, incorrect field names, etc. You will notice things like CSRF tokens generated by one IP and used by another. When stuff fails, they send 100 real people and record what worked, and it fixes their script. It’s all pretty automated. IP reputation can be helpful for some players, but most snowshoe. Spam attempts would grow exponent…

> all the banned people saw each other

What did happen with that strategy?

Re: You probably don’t need ReCAPTCHA

#238

Post by tracker1 »

atoav wrote: post #142
kbenson wrote: post #67

Earlier quoted context omitted.

> It's a "don't have to outrun the bear" situation If everyone else is incorporating recaptcha, they're all running faster than you. Even with bypass services, cheap is not the same as free, especially at the scale spam runs at. I imagine a mail form that obviously doesn't incorporate a CAPTCHA is going to garner some attention. It might work for weeks or months if it's not being paid attention to, so that's probably…

I use a simple english question with a five letter word as an answer sucessfully for 8 years on a contact form now. The text isn’t obsfucated, the answer is always the same. This is as primitive as it gets. I didn’t get a single spam mail in all that time. The idea is not to outrun your competition, it is to become a special target that would demand special work to successfully get into. Bots are dumb as long as the…

I mostly agree... I used to work for a classic car website, and in that case, we dealt with a LOT of comment spam, and scams that were out there. A lot of it is actually individual people, doing actual work to get past. We also did see a lot of custom bots, etc. It took a few different approaches and even recaptcha wasn't always the best option, but it did help with most of the non-scam traffic.

Re: You probably don’t need ReCAPTCHA

#239

Post by krageon »

mobjack wrote: post #46
mattigames wrote: post #22

Earlier quoted context omitted.

Did you try randomizing the 'name' and 'ids' of the inputs? (including the invisible one)

I really dont know how well that will work against a dedicated attacker. I am much more confident in ReCAPTCHA of stopping bots compared to any roll your own solution. I dont want to hope that an alternative is good enough for my needs. I want the best when it comes to protecting my site. Any alternative needs to have a proven track record and support to make consider replacing ReCAPTCHA.

Most of the times when I encounter recaptcha I don't even bother filling it out - it's a huge pain in the ass and apparently I look scary because I always have to jump through way too many hoops before I'm allowed into the crappy walled garden that it's probably protecting. I can't be the only one that feels this way, that is something you should consider when picking a captcha solution as well.

Re: You probably don’t need ReCAPTCHA

#240

Post by eythian »

aflag wrote: post #209
Tepix wrote: post #203

Earlier quoted context omitted.

But that's something captchas are used for. Prevent fake signups.

It doesn't do that, though. Humans also create fake accounts. It does make mass creation of fake accounts impractical, though. I solved that in past by actually charging for my service. I think the internet would benefit from having more paid content and less ads driven stuff. One thing that captchas do protect from is brute force attacks on user passwords. Although there are other possibilities (like making the conn…

It does do that. It literally does. It removes the cheapest method of creating fake accounts, thereby reducing the problem hugely.
Post reply on HN