Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You probably don’t need ReCAPTCHA

kevv.net

Post reply on HN
Print view View original

91–100 of 246 posts

Re: You probably don’t need ReCAPTCHA

#91

Post by frosted-flakes »

Washuu wrote: post #87
seancoleman wrote: post #81

I fought an interesting implementation of customized spam on a web app registration form a few months back. Suddenly, every 2-3 seconds, we would get a sign up from a random email address @qq.com (it really clogged our sign up Slack channel). I didn’t want to go full CAPTCHA so I dropped in a simple honeypot and the spam stopped for a good 4-5 hours. Then it picked right back up like normal. I then implemented a rand…

There is someone else on the other end. I had one of them previously get on the forums I worked on and complain about how quick I was to blocked them. I wrote an entire system for learning the patterns and automatically blocking them as they occurred. Eventually I determined that the vast majority of the IP addresses originated from Bangladesh so I just banned the entire country from accessing the web sites. That was…

I have to ask, why do people do this? What do they get out of it?

Re: You probably don’t need ReCAPTCHA

#92

Post by throwawaymath »

WillPostForFood wrote: post #44
throwawaymath wrote: post #31

Earlier quoted context omitted.

As the commenter said, they rotate IPs. It is not that easy. I've also been on the other side of a sophisticated attack like this. The really savvy adversaries do the following, at least: 1. Rotate through several thousand to several hundred thousand noncontiguous, geographically distributed, residential IP addresses, 2. Associate each IP address with a single user agent and suite of cookies, 3. Associate each IP add…

Rotate through several thousand to several hundred thousand noncontiguous, geographically distributed, residential IP addresses How are they getting residential IP addresses, compromised PCs?

Other commenters have basically answered already, but to be clear Luminati is not the only provider, just the most infamous. It’s very easy to find others of greater or lesser reliability. Search “residential IPs proxy” and you’ll find many vendors.

But yes, the whole cottage industry is sketchy. Almost all providers are leasing users’ computer with outright malware or shady TOS. The savvy play is to release a free game, app or even SDK which will then opportunistically route requests from the control server through the user’s device.

Recaptcha solving APIs are frequently bundled with the more reliable and premium services of this kind. They introduce a lot of latency since there’s a real mechanical turk across the world solving it for you, but they basically work.

Re: You probably don’t need ReCAPTCHA

#93

Post by shakna »

dylanz wrote: post #39
Wowfunhappy wrote: post #35

Aren't hidden form elements are a major issue for accessibility? Admittedly, so is ReCaptcha, so the trade-off may be necessary as much as it sucks. But, it's probably at least worth a mention?

They are definitely an issue for accessibility. I make sure to put "Hey! Don't put anything in this field!" as a placeholder.

Though bots may use it, it seems the perfect use case for aria-hidden.

Re: You probably don’t need ReCAPTCHA

#94

Post by shakna »

hombre_fatal wrote: post #56
shakna wrote: post #36

Earlier quoted context omitted.

From a French IP that usually gets flagged by everybody as potentially a robot, I see exactly 0 JS on the HN login form. Are you sure it is HN that uses ReCAPTCHA?

I've seen it before. In fact, I'd double checked last time I brought it up and it was there on /login in an incognito tab. Either HN has changed or they now conditionally load it. For example, I encountered it every time I used Tor on HN, though I haven't hit /login in months.

Perhaps it's Cloudflare, and not HN directly.

Re: You probably don’t need ReCAPTCHA

#95

Post by Washuu »

frosted-flakes wrote: post #91
Washuu wrote: post #87

Earlier quoted context omitted.

There is someone else on the other end. I had one of them previously get on the forums I worked on and complain about how quick I was to blocked them. I wrote an entire system for learning the patterns and automatically blocking them as they occurred. Eventually I determined that the vast majority of the IP addresses originated from Bangladesh so I just banned the entire country from accessing the web sites. That was…

I have to ask, why do people do this? What do they get out of it?

I assume SEO targeting and associating phrases with various products. For example, people on Reddit will name and shame by dropping people's names accused of crimes next to the thing they are accused of in a complete sentence. This is an attempt to promote the relevance of those two facts in Google Search to each other.

Re: You probably don’t need ReCAPTCHA

#96

Post by cthaeh »

robjan wrote: post #47
bduerst wrote: post #27

Earlier quoted context omitted.

>Why isn't there a solid alternative offering yet? The latest version of recaptcha doesn't even prompt users. It loads on the front-end and uses a scoring system. It's likely you've used it but didn't even know because it's invisible. It's the older implementations that have the slow loading images.

If you use as blocking and privacy extensions or live in a "suspicious country" it's still slow loading and multiple pages of images.

Not really. Thats if the developers code it so that if you get a low score -> trigger images captcha (recaptcha v2)

Recatpcha v3 by itself NEVER shows anything to the user and its entirely up the application itself on how to deal with users who are likely to be bots (which also includes users with anti-fingerprinting measures)

Re: You probably don’t need ReCAPTCHA

#97

Post by baroffoos »

frosted-flakes wrote: post #91
Washuu wrote: post #87

Earlier quoted context omitted.

There is someone else on the other end. I had one of them previously get on the forums I worked on and complain about how quick I was to blocked them. I wrote an entire system for learning the patterns and automatically blocking them as they occurred. Eventually I determined that the vast majority of the IP addresses originated from Bangladesh so I just banned the entire country from accessing the web sites. That was…

I have to ask, why do people do this? What do they get out of it?

The automated spam tends to be for financial gain somehow, Either by spaming links thinking someone will click them or SEO stuff. The non automated spam is usually people who find enjoyment in being annoying

Re: You probably don’t need ReCAPTCHA

#98

Post by throwawaymath »

ALittleLight wrote: post #60
mcpeepants wrote: post #54

Earlier quoted context omitted.

Most likely related to high-demand, limited run sneaker "drops", which people then resell on the secondary market. Sneaker-scalpers, if you will. It's a problem because it prevents legit buyers from getting in on the sale.

Seems like a market problem. Why not auction the sneakers?

To be clear, I don’t have a horse in this particular race. I’m neither condemning nor condoning the market dynamics of sneaker arbitrage here. It’s just an example I’m very familiar with because I used to write scrapers and I’ve been offered silly amounts of money to make them for sneaker trading groups. Not as much as hedge funds will pay for writing crawlers for market research, but still more than you’d probably expect just so they can flip Supreme shirts and Yeezys faster than competitors. It’s ridiculous, but this is the world we live in. The point is simply that when the stakes are high (particularly when there is money to be made), stopping adversaries will be really, really difficult.

Back to the point at hand, I don’t like recaptcha in principle. But given my view from both sides of the table, it’s one of very few things that consistently works for sophisticated adversaries. It’s about as close to a silver bullet as they come, with the additional upside that it’s the absolute easiest thing to implement - in both an absolute sense and relative to the return. And once you have, most of what you can implement beyond recaptcha has diminishing returns in comparison.

All of that being said, I would be inclined to agree that most websites and apps don’t need recaptcha, simply because most of them aren’t worthwhile targets for the types of attacks recaptcha is singularly effective against.

Re: You probably don’t need ReCAPTCHA

#99

Post by stordoff »

chii wrote: post #68
hombre_fatal wrote: post #52

Earlier quoted context omitted.

https://luminati.io/#pricing

How the hell do they get people to open up their home computer to be used this way?

They encourage developers to include their SDK:

> Monetize your mobile app or game with our SDK, without showing intrusive ads or requiring annoying subscriptions and in app purchases.

https://luminati.io/sdk

They approached nmap of all people:

> Hi,

> My name is Lior and I'd like to offer you a new way to make money off your software. The Luminati SDK provides your users the option to use your software for free by contributing to the Luminati proxy network.

> We will pay you $3,000 USD a month for every 100K daily active users.

> No collection of users' data, no disruption of user experience.

> I'd like to schedule a 15 minute call to let you know how we can start. Are you available tomorrow at 12:30pm your local time?

> Best regards,

> Lior

https://seclists.org/nmap-dev/2018/q1/27

Re: You probably don’t need ReCAPTCHA

#100

Post by inetknght »

chii wrote: post #66
mirimir wrote: post #63

Earlier quoted context omitted.

Why don't they just sell more of them? Or as ALittleLight says, auction them? Edit: OK, I know, limited editions. Like numbered and signed prints. But it's arguable that people who want them the most will get them. Even if it's just for resale. Doesn't seem like the seller's responsibility.

> Doesn't seem like the seller's responsibility. sounds like to me that the seller doesn't want the scalper to sell outside the official channels imho. It might dilute the brand as well.

Exclusivity agreements are anti-competitive tbqh

The real problem is supply. Popular tickets are scalped because there's only so many tickets. Then unpopular tickets are scalped because it was so easy to scalp the popular ones.

There's only so many sneakers that can be made: making more chews up the supply chain for something which isn't _truly_ being consumed.

Post reply on HN