Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: A Good Alternative for ReCaptcha?

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 207 posts

Re: Ask HN: A Good Alternative for ReCaptcha?

#51

Post by Ayesh »

StreamBright wrote: post #35
lucb1e wrote: post #26

Earlier quoted context omitted.

That's like saying "why don't you use algoritms and code". Like, sure, but what is it you're proposing? What features would you learn from and match against? (For those unfamiliar with algoritms and code as solution, it's a reference to this: https://www.reddit.com/r/ProgrammerHumor/comments/5ylndv/so_... )

Actually we have implemented something like that for HTTP requests. Features would be: IP (first 3 octets are probably enough), posting time, length, time to solve captcha, time between clicks, country where the IP is located, post contains certain words (can be learnt from spam posts), does the post contain a link(y/n) I think I would start with these, probably looking into what other people are doing.

An ideal machine learning implementation would also need the context, such as the original post itself, parent comment(s), other comments in the thread, etc.

It can be quite difficult than one might think. For example, now that we are talking about spam, the word "Viagra" shouldn't block my comment, even though my parent post doesn't mention the word or in a situation where nobody else mentioned it.

Re: Ask HN: A Good Alternative for ReCaptcha?

#52

Post by mpol »

avian wrote: post #43
mpol wrote: post #11

Akismet is a third party service that works really well. You send data there with a HTTP POST and it will reply with a yes or no, it is spam or not spam. It is not that hard to implement. You do have to be aware that you are sending user data to that service, which you have to mention in your privacy policy. Stop Forum Spam is a similar third party service. You send it an ip address and an email address. It will repl…

> The only "risk" is that in the future spammers might start using more sophisticated spambots You’re also making your website unusable for people with Javascript blocked or disabled in their browsers.

In the context of the question, that is not relevant. reCAPTCHA requires JavaScript as well. The question is about an alternative to reCAPTCHA. Both methods use JavaScript.

I do understand where you are coming from though. And I also think this alternative is better in this regard. reCAPTCHA loads JavaScript from a third-party domain. With JavaScript spamfilters you are loading them from the first-party domain.

Re: Ask HN: A Good Alternative for ReCaptcha?

#53

Post by dmos62 »

LogIN- wrote: post #23

As per google "reCAPTCHA is a free service that protects your website from spam and abuse" but instead one can argue that reCAPTCHA is a service that transfer spam issue from the provider to its users, so at the end one provider will be free of spam (I guess) but all of his users will be spamed, tricked, fingerprinted and abused to actually constantly work for free for this 3rd party ant-spam service

I suppose you expand the usage of spam to also mean the recaptcha mini-games where you tick all the boxes with traffic lights in them. I agree with the sentiment. I'll add that if you don't use anti-fingerprinting or anti-tracking measures, then recaptcha catches on really quickly that you're a person, and it's not much of a bother in that case. The problem with it is that it's made for the ad-peddling web, not for the private web, or whatever the alternative should be called.

Re: Ask HN: A Good Alternative for ReCaptcha?

#56

Post by cheschire »

weeb wrote: post #46

Whatever you use, please remember not everyone has good vision / hearing / dextrous mouse control. Captchas can be a nightmare for accessibility. Most of the 'clever' solutions to this will completely block some subset of keyboard users / blind users / eye gaze users along with the bots.

It's really frustrating talking to client side developers these days about 508 compliance. It feels like only one in 10 understand the concept of accessibility.

Re: Ask HN: A Good Alternative for ReCaptcha?

#57

Post by willio58 »

tpetry wrote: post #32

For bots which are not specifically targeted at your page i simply add an invisible form element named url. Bots _LOVE_ to share their viagra urls. Any request which submitted an url is discarded. This trick is simple stupid and should not work but somehow the simple spam bots have not improved. This does not work for sophisticated bots (never met one) or the ones programmed specifically for your site (happens very r…

This is simple form of a honeypot but it is really ineffective. Any bot with even minimal sophistication will know to leave the hidden field empty.

Re: Ask HN: A Good Alternative for ReCaptcha?

#58

Post by corobo »

willio58 wrote: post #57
tpetry wrote: post #32

For bots which are not specifically targeted at your page i simply add an invisible form element named url. Bots _LOVE_ to share their viagra urls. Any request which submitted an url is discarded. This trick is simple stupid and should not work but somehow the simple spam bots have not improved. This does not work for sophisticated bots (never met one) or the ones programmed specifically for your site (happens very r…

This is simple form of a honeypot but it is really ineffective. Any bot with even minimal sophistication will know to leave the hidden field empty.

You hide it with CSS, not type='hidden'

Re: Ask HN: A Good Alternative for ReCaptcha?

#59

Post by dmos62 »

dessant wrote: post #39

W3C has published an extensive list of reCAPTCHA alternatives: https://www.w3.org/TR/turingtest/ W3C is requesting feedback for the document, if you'd like to make suggestions, please open an issue: https://github.com/w3c/apa/issues

That's a very informative document. Privacy Pass caught my eye: https://privacypass.github.io/ It's an extension that is currently only supported by Cloudflare's CAPTCHA, that pretty much stores tokens after you complete a CAPTCHA, and the next time instead of requiring you to complete a CAPTCHA again, it will use those tokens. The point is that it does it in an anonymity preserving way. You can fork their server for a custom implementation.

Re: Ask HN: A Good Alternative for ReCaptcha?

#60

Post by dev_256 »

corobo wrote: post #58
willio58 wrote: post #57

Earlier quoted context omitted.

This is simple form of a honeypot but it is really ineffective. Any bot with even minimal sophistication will know to leave the hidden field empty.

You hide it with CSS, not type='hidden'

You can still figure out it's hidden.
Post reply on HN