9 ms·
I've made a browser extension that solves CAPTCHAs using the audio challenge. Native user input simulation will come with the next release. https://github.com/
by dessant 8y ago
I've made a browser extension that solves CAPTCHAs using the audio challenge. Native user input simulation will come with the next release.
https://github.com/dessant/buster https://github.com/dessant/buster
On my part it is a direct reaction to developers and their employers cutting corners and adding these challenges to login forms and anything else you can imagine. It's entirely reasonable to show a challenge after a couple of failed login attempts, but they should never be part of the default login flow. These decisions hurt users.
If you work on a product that shows a CAPTCHA while logging in, please discuss this issue with your team and consider not challenging your users during their first login attempt.
- tyingq 8y agoI do use a CAPTCHA, but not on a login form. It's solely for a "contact us" form. We do try to encourage just regular email with a mailto: href, but unfortunately, customers expect a form. And, if I don't use the captcha, we get flooded with spam. We are using Google's "nocaptcha", which is usually unintrusive, but is a pain for anyone not logged into some Google property.
- alexdumitru 8y agoI manage to get rid of line 99.99% of spam with a hidden checkbox. Bots tend to check them, so I just ignore it if it's checked.
- Izkata 8y agoI remember reading about a blog that used this method something like 10 years ago, and wondered why I don't hear about it more often. Glad to know it still works just as well as back then.
- ficklepickle 8y agoI made a contact form that sends the data URL encoded if JS is disabled, or JSON if JS is enabled. If the back end gets url-encoded data, it's spam. I also use the hidden field trick, but I label it phone number and fill it with zeros. Then I hide it with an external stylesheet. I don't actually want a phone field, its a decoy. If it is changed from zeros, it is spam. Most spam bots don't seem to parse external stylesheets. I've had zero contact form spam with this method. Mind you it is a very low volume site. I was just having fun with it, making a php-style contact form backend but using node.js. I read lots of those old blog posts you mention.
- dessant 8y agoFor a contact form I think it's ok to show a challenge. It won't eliminate spam entirely or work against targeted attacks, but at least it keeps out the bulk of annoyances (at the cost of annoying some of your users :P). EDIT: Have you considered putting the messages in a pending state instead? You could ask for their email in the contact form, and send a confirmation link that needs to be clicked for the message to be validated. Unvalidated messages could be deleted after a week, without any human interaction. I'd expect this to have comparable effectiveness against untargeted spam.
- robin_reala 8y agoNot annoying; blocking. There are a reasonable percentage of people that cannot solve the current set of CAPTCHAs.
- dessant 8y agoYes, and Google also blocks the audio challenge sometimes, so people with impaired vision or with neurological issues that affect object recognition are effectively denied access to a large portion of the web.
- CamperBob2 8y agoAt some point the ADA will come into play. Google has to realize that... don't they?
- crankylinuxuser 8y agoThen I suggest a simple change away from Google: Make some text asking a question "What is five plus 2?" And there's an empty text field next to it that on the backend looks for the trivial right answer. That should reasonably stop spam, and still allow a field based html mail sender. And eliminates a dependency on Google.
- dexterdog 8y agoAlso a pain for anybody using tracking blocking. I get captchas all day on all kinds of sites and I'm always logged into anywhere from 3-12 google accounts.
- tyingq 8y agoWe do put a clickable mailto: url on the page as well. Unfortunately, unprotected forms get tons of automated spam. Emailing a verification doesn't work well...customers just don't pay attention to instructions :)
- ficklepickle 8y agoI just base64 encode my email address and decode it in an onload event handler. Most bots don't seem to execute JS because I haven't received a spam email yet. Sucks for users with JS disabled though.
- darkpuma 8y agonocaptcha aka reCAPTCHAv3 is the worst choice. At least with v2 users of firefox/adblock/ec get a chance of passing the captcha by answering challenges. v3 takes that opportunity away from them.
- simple_phrases 8y agoThe reason websites are CAPTCHA laden is because they want to make it harder for people to legally scrape their sites. For this reason, you'll be hard pressed to convince the owner of a site with a login CAPTCHA to remove it.
- dessant 8y agoI think that stems from flawed security models. CAPTCHAs are trivial to bypass, and scrapers can keep their session cookies to never see the login challenge again. Regular users are the ones suffering from CAPTCHAs on login forms, not scrapers.
- simple_phrases 8y agoI agree completely, however CAPTCHAs keep 90% of the riff raff out and check off the anti-scraping checkbox for management.
- hombre_fatal 8y ago>It's entirely reasonable to show a challenge after a couple of failed login attempts, but they should never be part of the default login flow. Nope, that only works if there weren't botnets that just multiplex millions of requests over thousands of websites. Anyone who has tried IP-blocking bots has run into this where 50k+ IP addresses just need to send you one request per couple minutes. Your posts in this thread show how easy it is to be against recaptcha without addressing why people use it, or you suggest it's a flawed security model when people use it. It's kind of hard to take your advice seriously when I think of real world websites fighting real world abuse. In another post of yours, you recommend the web developer to just expend more and more effort to circumvent abuse without recaptcha. Like creating a whole pending message system for, say, a forum instead of just a contact form. In fact, you'll find that there's no shortage of work for you to do once you attract abuse. And that's an easy solution to prescribe when you have no skin in the game. God forbid the site doesn't even make any money.
- darkpuma 8y agoreCAPTCHA's tile fade-in doesn't punish bots, it punishes real humans. Your argument might be valid if reCAPTCHA were a true CAPTCHA, rather than compliance/recruiting mechanism used by google to abuse people until they relent and adopt google products. But yeah, it's free so you can't resist using it. Have you ever stopped to wonder why google gives this service out for free? When you integrate reCAPTCHA into your website, you're selling your users out.
- hombre_fatal 8y agoWell, it's something that works. HN uses it, too. Try to create an account over Tor. It sucks that abuse exists, but it's a real problem and it's only getting easier to do and harder to avoid. After all, what also bones users is having a platform that's trivial to attack because the developer thought abuse wasn't going to be a problem.
- PSZD 8y agoHumans are the problem, not some mythical AI powering the bots. It costs a fraction of a cent to get a CAPTCHA solved. The only real counter being used is making it take longer to solve a CAPTCHA - which is exactly what the services like reCAPTCHA do, while minimizing the impact on heuristically 'good' users. Making CAPTCHA solves take 30 seconds or a minute instead of 5 seconds is the state of the art.