Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You probably don’t need ReCAPTCHA

kevv.net

Post reply on HN
Print view View original

51–60 of 246 posts

Re: You probably don’t need ReCAPTCHA

#51

Post by T-hawk »

kbenson wrote: post #49
mattigames wrote: post #29

Earlier quoted context omitted.

You are right it doesn't work but is not trivial at all to detect visibility, there are millions of ways to hide an element using CSS, for example a rare one (without using "opacity", "display" or "visibility") is: transform: scale(0.00001);

The only way I see this being useful is if you do this for one or more elements as well as encrypt the name of every input element and also randomize the layout enough that they can't easily use CSS selectors or regular expressions to fine the relevant inputs by page location. I can and have defeated forms that tried to do all of those things very easily in the past. Keep in mind that if you randomize across a few va…

You're not trying to make your site absolutely bot-proof. Someone deliberately targeting your site can figure out any such measures. (You want legitimate users to do so.) You're just trying to throw in enough friction that most common drive-by scripts won't succeed.

It's a "don't have to outrun the bear" situation, make yourself just difficult enough that some easier target gets snagged instead.

Re: You probably don’t need ReCAPTCHA

#52

Post by hombre_fatal »

WillPostForFood wrote: post #44
throwawaymath wrote: post #31

Earlier quoted context omitted.

As the commenter said, they rotate IPs. It is not that easy. I've also been on the other side of a sophisticated attack like this. The really savvy adversaries do the following, at least: 1. Rotate through several thousand to several hundred thousand noncontiguous, geographically distributed, residential IP addresses, 2. Associate each IP address with a single user agent and suite of cookies, 3. Associate each IP add…

Rotate through several thousand to several hundred thousand noncontiguous, geographically distributed, residential IP addresses How are they getting residential IP addresses, compromised PCs?

https://luminati.io/#pricing

Re: You probably don’t need ReCAPTCHA

#53

Post by jimktrains2 »

ve55 wrote: post #41
shakna wrote: post #36

Earlier quoted context omitted.

From a French IP that usually gets flagged by everybody as potentially a robot, I see exactly 0 JS on the HN login form. Are you sure it is HN that uses ReCAPTCHA?

I've seen multiple comments suggesting HN uses ReCAPTCHA, but I have never encountered it myself, and I even have Javascript disabled and login through 'anonymous' IPs such as tor, so I'm unsure what these users could be doing that is 'worse' to trigger ReCAPTCHAs. If most users don't even know that ReCAPTCHA is used, that's a good sign that it is being used as little as possible, though.

I wonder if it's from CloudFlare and not HN directly.

Re: You probably don’t need ReCAPTCHA

#54

Post by mcpeepants »

mirimir wrote: post #34
throwawaymath wrote: post #31

Earlier quoted context omitted.

As the commenter said, they rotate IPs. It is not that easy. I've also been on the other side of a sophisticated attack like this. The really savvy adversaries do the following, at least: 1. Rotate through several thousand to several hundred thousand noncontiguous, geographically distributed, residential IP addresses, 2. Associate each IP address with a single user agent and suite of cookies, 3. Associate each IP add…

> automated sneaker buying ??? Please ELI5. I mean, why are sales bad, even if automated? Are they using stolen cards?

Most likely related to high-demand, limited run sneaker "drops", which people then resell on the secondary market. Sneaker-scalpers, if you will. It's a problem because it prevents legit buyers from getting in on the sale.

Re: You probably don’t need ReCAPTCHA

#55

Post by scarface74 »

anchpop wrote: post #3
scarface74 wrote: post #2

Microsoft’s implementation is the worse. I sometimes have a hard time deciphering the captcha. Why do they need that in an iOS app? Are robots emulating people from an iPhone?

The iPhone app probably communicates to some servers over an API of some kind - there's no reason someone malicious couldn't pretend to be an iphone and communicate over the same API

Actually, now that is think about it, Microsoft apps could only require a captcha if the username trying to log in doesn’t match the user’s previous iCloud user token.

I’m thinking about how Overcast uses a token linked to the user’s iCloud account and doesn’t require a username and password if you only use iOS devices. You can optionally add a username and password to access the web client.

Re: You probably don’t need ReCAPTCHA

#56

Post by hombre_fatal »

shakna wrote: post #36
MagicPropmaker wrote: post #30

I wish Hacker News didn't use it. It's a PITA logging in! I don't see it when I'm in the U.S. but when I'm overseas...

From a French IP that usually gets flagged by everybody as potentially a robot, I see exactly 0 JS on the HN login form. Are you sure it is HN that uses ReCAPTCHA?

I've seen it before. In fact, I'd double checked last time I brought it up and it was there on /login in an incognito tab.

Either HN has changed or they now conditionally load it. For example, I encountered it every time I used Tor on HN, though I haven't hit /login in months.

Re: You probably don’t need ReCAPTCHA

#57

Post by scarface74 »

arlk wrote: post #7
anchpop wrote: post #3

Earlier quoted context omitted.

The iPhone app probably communicates to some servers over an API of some kind - there's no reason someone malicious couldn't pretend to be an iphone and communicate over the same API

and no reason someone malicious couldn't click-farm iPhones either. https://gizmodo.com/thai-click-fraud-farm-busted-using-wall-...

Mechanical Turk style processing never ceases to amaze me.

Re: You probably don’t need ReCAPTCHA

#58

Post by hombre_fatal »

chii wrote: post #20
cardine wrote: post #11

In my experience, the biggest issue I run into is targeted botnet brute force attacks. In cases like these, someone loads up a huge botnet, a downloaded list of hacked usernames and passwords, and tries every single combination hoping to find a reused username/password combination. In these cases, it is almost always extremely targeted. Log correlation has helped quite a bit, but it is still very painful since they a…

and you can easily count the number of failed attempts from a particular IP, and just show captcha for those over X failures, rather than every login. Normal users don't fail _that_ many times, and so are non-the-wiser.

You need to update your intel to 2019 where botnets cost peanuts and I can trivially rotate a tiny botnet of 100k IP addresses against your "solution", each IP addresses making a couple attempts. Modern script kiddie software has had that built in for over a decade.

Never had your /login forum attacked with {uname,pass} combos? This is exactly what the traffic looks like.

Re: You probably don’t need ReCAPTCHA

#59

Post by scarface74 »

tgsovlerkhgsel wrote: post #12
gsich wrote: post #5

Earlier quoted context omitted.

User agent is quickly changed.

Doesn't iPhone have some sort of device attestation?

Can any iOS developers chime in? I know there has to be some type of server side validation to validate previous in app purchases. Could something similar tie a logged in iCloud user to an account?

Re: You probably don’t need ReCAPTCHA

#60

Post by ALittleLight »

mcpeepants wrote: post #54
mirimir wrote: post #34

Earlier quoted context omitted.

> automated sneaker buying ??? Please ELI5. I mean, why are sales bad, even if automated? Are they using stolen cards?

Most likely related to high-demand, limited run sneaker "drops", which people then resell on the secondary market. Sneaker-scalpers, if you will. It's a problem because it prevents legit buyers from getting in on the sale.

Seems like a market problem. Why not auction the sneakers?
Post reply on HN