4 ms·

The spammers & scrapers seem to have found their way around ReCaptcha. I made a simple spam filter for my website comment form that logs every submission, and

The spammers & scrapers seem to have found their way around ReCaptcha. I made a simple spam filter for my website comment form that logs every submission, and a lot of the spam being sent (maybe 20%?) has a valid Google Recaptcha. I'm thinking of removing Recaptcha because simple keyword based filters have been more effective than ReCaptcha has been.

Jaruzel 8y ago
ReCaptcha and the original two-word based one are just Google using your visitors as 'mechanical turks' - by solving ReCaptcha et al, they are actually helping Google apply identification tags to images in streetview, and previously the Google books collection. An afternoons coding would get you an independent self-hosted Captcha system that would be just as effective (if not more so, as it's proprietary) and probably less annoying to your visitors.
- orf 8y ago
  > and probably less annoying to your visitors. As someone who has used both, absolutely 100% no in every way. Google's captcha is so superior to what you would write, please don't tell people not to.
  - Jaruzel 8y ago
    How so ? It's really not that hard. I've done it, and it zeroed spam coming through a web form almost 100%.
    - danielbarla 8y ago
      Both (custom and recaptcha) are essentially security by obscurity, in the sense that a skilled attacker will eventually bypass it. The problem is not that difficult. The advantage Google has is being able to move the goalposts, potentially on a daily basis, while you presumably have better things to do. On the other hand, they are a juicier target, so will draw more effort. Ymmv. Google tends to strike a good balance between convenience and irritation.
    - ericpauley 8y ago
      So would disabling submissions. The real question is how many legitimate submissions weren't made successfully because of a bad captcha.
    - mockingbirdy 8y ago
      I've build a ReCaptcha breaker in an evening (which beats Google 100% of the time). The only reason why most spammers don't evade ReCaptcha is because they make enough money through other means (and most spammers can't program). There are also a lot of services where you can simply send your challenge token and some guy will solve it for a fraction of a penny. As soon as other money-making opportunities will dry up, spammers will evade ReCaptcha and spam will increase regardless of your security mechanisms.
- senorjazz 8y ago
  this won't work in this case. The site is being specifically targetted. A custom captcha will be trivial to bypass. The reason it worked for you would be your site was just bulk scraped and no patterns could be found in your captcha to match it to a solving solution so the spammer moved on to the next. When your site is specifically targetted, captchas will not work
exikyut 8y ago
They're probably using https://2captcha.com/ https://2captcha.com/ They pay 50c per 2 hours to the workers, and API access costs 50c-$1 per 2000 solved captchas. I think most of the people doing this are in India, where US 50c for a couple hours translates well enough. (Completely naive about the truth of the situation though.)
- SyneRyder 8y ago
  One of the regular spam messages mentions the software they're using ("You read this, so you know it works!"), so it's pretty clear that ReCaptcha has already been defeated. I'd mention the software, but I'd rather not give them publicity. Others have been able to beat reCaptcha too, though: https://www.youtube.com/watch?v=fsF7enQY8uI https://www.youtube.com/watch?v=fsF7enQY8uI
  - senorjazz 8y ago
    didn't watch, but the Russian xrumer forum spammer has been at the forefront of captcha solving for the last decade or more.

Jaruzel 8y ago

ReCaptcha and the original two-word based one are just Google using your visitors as 'mechanical turks' - by solving ReCaptcha et al, they are actually helping Google apply identification tags to images in streetview, and previously the Google books collection. An afternoons coding would get you an independent self-hosted Captcha system that would be just as effective (if not more so, as it's proprietary) and probably less annoying to your visitors.

orf 8y ago
> and probably less annoying to your visitors. As someone who has used both, absolutely 100% no in every way. Google's captcha is so superior to what you would write, please don't tell people not to.
- Jaruzel 8y ago
  How so ? It's really not that hard. I've done it, and it zeroed spam coming through a web form almost 100%.
  - danielbarla 8y ago
    Both (custom and recaptcha) are essentially security by obscurity, in the sense that a skilled attacker will eventually bypass it. The problem is not that difficult. The advantage Google has is being able to move the goalposts, potentially on a daily basis, while you presumably have better things to do. On the other hand, they are a juicier target, so will draw more effort. Ymmv. Google tends to strike a good balance between convenience and irritation.
  - ericpauley 8y ago
    So would disabling submissions. The real question is how many legitimate submissions weren't made successfully because of a bad captcha.
  - mockingbirdy 8y ago
    I've build a ReCaptcha breaker in an evening (which beats Google 100% of the time). The only reason why most spammers don't evade ReCaptcha is because they make enough money through other means (and most spammers can't program). There are also a lot of services where you can simply send your challenge token and some guy will solve it for a fraction of a penny. As soon as other money-making opportunities will dry up, spammers will evade ReCaptcha and spam will increase regardless of your security mechanisms.
senorjazz 8y ago
this won't work in this case. The site is being specifically targetted. A custom captcha will be trivial to bypass. The reason it worked for you would be your site was just bulk scraped and no patterns could be found in your captcha to match it to a solving solution so the spammer moved on to the next. When your site is specifically targetted, captchas will not work

exikyut 8y ago

They're probably using https://2captcha.com/ https://2captcha.com/ They pay 50c per 2 hours to the workers, and API access costs 50c-$1 per 2000 solved captchas. I think most of the people doing this are in India, where US 50c for a couple hours translates well enough. (Completely naive about the truth of the situation though.)

SyneRyder 8y ago
One of the regular spam messages mentions the software they're using ("You read this, so you know it works!"), so it's pretty clear that ReCaptcha has already been defeated. I'd mention the software, but I'd rather not give them publicity. Others have been able to beat reCaptcha too, though: https://www.youtube.com/watch?v=fsF7enQY8uI https://www.youtube.com/watch?v=fsF7enQY8uI
- senorjazz 8y ago
  didn't watch, but the Russian xrumer forum spammer has been at the forefront of captcha solving for the last decade or more.