Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You probably don’t need ReCAPTCHA

kevv.net

Post reply on HN
Print view View original

41–50 of 246 posts

Re: You probably don’t need ReCAPTCHA

#41

Post by ve55 »

shakna wrote: post #36
MagicPropmaker wrote: post #30

I wish Hacker News didn't use it. It's a PITA logging in! I don't see it when I'm in the U.S. but when I'm overseas...

From a French IP that usually gets flagged by everybody as potentially a robot, I see exactly 0 JS on the HN login form. Are you sure it is HN that uses ReCAPTCHA?

I've seen multiple comments suggesting HN uses ReCAPTCHA, but I have never encountered it myself, and I even have Javascript disabled and login through 'anonymous' IPs such as tor, so I'm unsure what these users could be doing that is 'worse' to trigger ReCAPTCHAs.

If most users don't even know that ReCAPTCHA is used, that's a good sign that it is being used as little as possible, though.

Re: You probably don’t need ReCAPTCHA

#42

Post by baroffoos »

shakna wrote: post #36
MagicPropmaker wrote: post #30

I wish Hacker News didn't use it. It's a PITA logging in! I don't see it when I'm in the U.S. but when I'm overseas...

From a French IP that usually gets flagged by everybody as potentially a robot, I see exactly 0 JS on the HN login form. Are you sure it is HN that uses ReCAPTCHA?

I have seen it sometimes.

Re: You probably don’t need ReCAPTCHA

#43

Post by mattigames »

netok wrote: post #38
sbov wrote: post #16

Earlier quoted context omitted.

Have an input element that can't be seen. If it has something in it, ignore the submit. Works for all my sites so far.

It will also ignore people who use browser's autofill form function. Realized this after receiving a dozen complaints.

You can randomly generate the "name" of the fields and autofill will never fill them, another option to disable autocomplete is to leave them without "name" and handling the submit using JavaScript.

Re: You probably don’t need ReCAPTCHA

#44

Post by WillPostForFood »

throwawaymath wrote: post #31
chii wrote: post #20

Earlier quoted context omitted.

and you can easily count the number of failed attempts from a particular IP, and just show captcha for those over X failures, rather than every login. Normal users don't fail _that_ many times, and so are non-the-wiser.

As the commenter said, they rotate IPs. It is not that easy. I've also been on the other side of a sophisticated attack like this. The really savvy adversaries do the following, at least: 1. Rotate through several thousand to several hundred thousand noncontiguous, geographically distributed, residential IP addresses, 2. Associate each IP address with a single user agent and suite of cookies, 3. Associate each IP add…

Rotate through several thousand to several hundred thousand noncontiguous, geographically distributed, residential IP addresses

How are they getting residential IP addresses, compromised PCs?

Re: You probably don’t need ReCAPTCHA

#46

Post by mobjack »

mattigames wrote: post #22
charrondev wrote: post #17

Earlier quoted context omitted.

Doesn’t work as soon as you’re big enough to target. The company I work for makes a SaSS forum product, and while we do have multiple spam prevention methods (akismet, stopforumspam, honeypot, a hidden input), there’s enough stuff out there that has targeted our platform that a Recaptcha on the registration form is needed. We haven’t need it on any other forms yet though. After registration it’s all handled by the ot…

Did you try randomizing the 'name' and 'ids' of the inputs? (including the invisible one)

I really dont know how well that will work against a dedicated attacker.

I am much more confident in ReCAPTCHA of stopping bots compared to any roll your own solution.

I dont want to hope that an alternative is good enough for my needs. I want the best when it comes to protecting my site.

Any alternative needs to have a proven track record and support to make consider replacing ReCAPTCHA.

Re: You probably don’t need ReCAPTCHA

#47

Post by robjan »

bduerst wrote: post #27
hawaiian wrote: post #8

ReCAPTCHA has crossed into the domain of cattle-corralling users and thus should be considered harmful. If the system decides it doesn't like you (most likely because you're "too anonymous," but you don't really know) you will be presented with slower-loading images to click and more click-all-the-things rounds. To pretend this is about slowing down bots is disingenuous as best. On top of that, usage of ReCAPTCHA per…

>Why isn't there a solid alternative offering yet? The latest version of recaptcha doesn't even prompt users. It loads on the front-end and uses a scoring system. It's likely you've used it but didn't even know because it's invisible. It's the older implementations that have the slow loading images.

If you use as blocking and privacy extensions or live in a "suspicious country" it's still slow loading and multiple pages of images.

Re: You probably don’t need ReCAPTCHA

#48

Post by [deleted] »

mobjack wrote: post #46
mattigames wrote: post #22

Earlier quoted context omitted.

Did you try randomizing the 'name' and 'ids' of the inputs? (including the invisible one)

I really dont know how well that will work against a dedicated attacker. I am much more confident in ReCAPTCHA of stopping bots compared to any roll your own solution. I dont want to hope that an alternative is good enough for my needs. I want the best when it comes to protecting my site. Any alternative needs to have a proven track record and support to make consider replacing ReCAPTCHA.

[deleted]

Re: You probably don’t need ReCAPTCHA

#49

Post by kbenson »

mattigames wrote: post #29
korm wrote: post #24

Earlier quoted context omitted.

It's trivial to detect element visibility, this just doesn't work in bigger sites.

You are right it doesn't work but is not trivial at all to detect visibility, there are millions of ways to hide an element using CSS, for example a rare one (without using "opacity", "display" or "visibility") is: transform: scale(0.00001);

The only way I see this being useful is if you do this for one or more elements as well as encrypt the name of every input element and also randomize the layout enough that they can't easily use CSS selectors or regular expressions to fine the relevant inputs by page location.

I can and have defeated forms that tried to do all of those things very easily in the past.

Keep in mind that if you randomize across a few variations (i.e. 4-5 page layouts), that's easily discerned if you pull the page source down 20-30 times, doa complex diff, scrub out obviously random strings, and check the total unique variations you're seeing.

That may seem like a lot of work, but consider that if you don't do it all at once, but instead roll out small change after small change, the person or people using it are not weighing to cost to do everything required to bypass it compared to finding another open mail form, but the cost to bypass just the new fix you put in place. Also, they might think it's fun doing so...

And on the site dev's side, they can just choose to outsource it to a CAPTCHA (not that there aren't services to easily bypass CAPTCHAs at scale at sub-cent per CAPTCHA rates, see https://anti-captcha.com/).

Note: To forestall any assumptions, I wasn't doing any spamming or helping spamming in any way.

Re: You probably don’t need ReCAPTCHA

#50

Post by Blackthorn »

Literally none of those alternative methods listed worked on my moderate traffic wiki. Recaptcha (and before it went away, identify the dogs or cats from Microsoft) is literally the only solution that stopped us from getting spammed. I wonder how much experience the author of this article really has in this domain.

Recaptcha has saved the internet as far as I'm concerned.

Post reply on HN