3 ms·

Is there any alternative to reCaptcha? As I understand, it's the only system that works well against most spammers, is free to use and easy to integrate. I'd be

by dx034 8y ago

Is there any alternative to reCaptcha? As I understand, it's the only system that works well against most spammers, is free to use and easy to integrate. I'd be happy to switch to another provider but haven't found anything remotely as easy and effective.

auslander 8y ago
If you'd found such service, but it would be paid one, what price, per 1000 checks, would be ok for you?
lucb1e 8y ago
Making your own works fine, even if it's a simple "type these words". On HN I see enough articles about breaking reCAPTCHAs with (claimed) 90% accuracy and I know spammers also employ humans. You can't make the perfect CAPTCHA, but anything custom will almost certainly do. For smaller sites it's also perfectly fine to just include a few "are you humans?" type questions to which people should reply "yes" or some other obvious answer. Having to spend development effort just to flood you with messages is probably not worth it. You will still get the one-off message when the CAPTCHA was solved by a poor worker anyway. My knowledge is a year or two out of date (haven't hosted forms in popular websites anymore), but it doesn't seem like this could have changed that rapidly. Bots don't suddenly understand English, and neural nets aren't much better or worse at word CAPTCHAs than picture CAPTCHAs. It's just that Google didn't need books anymore. I do still host a bug report form on a smaller site, and that just filters <a href, and more recently, http:// http://. If someone enters that, the site gives the helpful message that http is not allowed for spam reasons and they should use hxxp:// instead and that I'll understand what they meant. Haven't gotten any spam since I started including that. The cases where reCAPTCHA is a good idea are really rare. Logins can be solved with exponential back-off, forms can use spam filters similar to email and a simple CAPTCHA to catch the vast majority. With reCAPTCHA, I often spend minutes solving the because Google has no other markers to go on (deleting cookies, localstorage). I used to not mind them when other people were all complaining about those word CAPTCHAs (I found them easy) but now reCAPTCHA just take your time instead of your reading skills and they're absolutely awful. It rewards not using privacy technologies in your browser and so a lot of laymen don't experience the issues. Please don't use reCAPTCHA if at all possible...
mpol 8y ago
reCAPTCHA is a terrible thing for the web, in my experience. It is user hostile. It only gets used on websites because it is easy to set up. But really, the only reason someone would use it is because it is cheap and easy. There are much better options available that are less user hostile. Akismet is a third party service that works really well. You send data there with a HTTP POST and it will reply with a yes or no, it is spam or not spam. It is not that hard to implement. You do have to be aware that you are sending user data to that service, which you have to mention in your privacy policy. Stop Forum Spam is a similar third party service. You send it an ip address and an email address. It will reply on both items if it is spam, together with a confidence level. Quite interesting way to reply :) It is originally intended to fight registration spam, but you can use it for comment spam or contact forms as well. JavaScript spamfilters can be very usefull. Most spambots do a HTTP GET for a page with a form. They fill in all the fields and submit it with a HTTP POST. They don't run any JavaScript on that page. You can have honeypot and timeout fields on a form that get manipulated by JavaScript, and spambots will not validate. Works really well, and all transparent to the user. The only "risk" is that in the future spammers might start using more sophisticated spambots, like using Electron or Chromium. I implemented spamfilters like this in a WordPress plugin and it works really well for me: https://wordpress.org/plugins/la-sentinelle-antispam/ https://wordpress.org/plugins/la-sentinelle-antispam/
JohnFen 8y ago
But it's painful to your users, and will lock out a subset of them (although a small minority, so you might not care).
- baud147258 8y ago
  and the users locked out can't contact support, since it's also protected by reCAPTCHA

by dx034 8y ago

auslander 8y ago

If you'd found such service, but it would be paid one, what price, per 1000 checks, would be ok for you?

lucb1e 8y ago

Making your own works fine, even if it's a simple "type these words". On HN I see enough articles about breaking reCAPTCHAs with (claimed) 90% accuracy and I know spammers also employ humans. You can't make the perfect CAPTCHA, but anything custom will almost certainly do. For smaller sites it's also perfectly fine to just include a few "are you humans?" type questions to which people should reply "yes" or some other obvious answer. Having to spend development effort just to flood you with messages is probably not worth it. You will still get the one-off message when the CAPTCHA was solved by a poor worker anyway. My knowledge is a year or two out of date (haven't hosted forms in popular websites anymore), but it doesn't seem like this could have changed that rapidly. Bots don't suddenly understand English, and neural nets aren't much better or worse at word CAPTCHAs than picture CAPTCHAs. It's just that Google didn't need books anymore. I do still host a bug report form on a smaller site, and that just filters <a href, and more recently, http:// http://. If someone enters that, the site gives the helpful message that http is not allowed for spam reasons and they should use hxxp:// instead and that I'll understand what they meant. Haven't gotten any spam since I started including that. The cases where reCAPTCHA is a good idea are really rare. Logins can be solved with exponential back-off, forms can use spam filters similar to email and a simple CAPTCHA to catch the vast majority. With reCAPTCHA, I often spend minutes solving the because Google has no other markers to go on (deleting cookies, localstorage). I used to not mind them when other people were all complaining about those word CAPTCHAs (I found them easy) but now reCAPTCHA just take your time instead of your reading skills and they're absolutely awful. It rewards not using privacy technologies in your browser and so a lot of laymen don't experience the issues. Please don't use reCAPTCHA if at all possible...

mpol 8y ago

reCAPTCHA is a terrible thing for the web, in my experience. It is user hostile. It only gets used on websites because it is easy to set up. But really, the only reason someone would use it is because it is cheap and easy. There are much better options available that are less user hostile. Akismet is a third party service that works really well. You send data there with a HTTP POST and it will reply with a yes or no, it is spam or not spam. It is not that hard to implement. You do have to be aware that you are sending user data to that service, which you have to mention in your privacy policy. Stop Forum Spam is a similar third party service. You send it an ip address and an email address. It will reply on both items if it is spam, together with a confidence level. Quite interesting way to reply :) It is originally intended to fight registration spam, but you can use it for comment spam or contact forms as well. JavaScript spamfilters can be very usefull. Most spambots do a HTTP GET for a page with a form. They fill in all the fields and submit it with a HTTP POST. They don't run any JavaScript on that page. You can have honeypot and timeout fields on a form that get manipulated by JavaScript, and spambots will not validate. Works really well, and all transparent to the user. The only "risk" is that in the future spammers might start using more sophisticated spambots, like using Electron or Chromium. I implemented spamfilters like this in a WordPress plugin and it works really well for me: https://wordpress.org/plugins/la-sentinelle-antispam/ https://wordpress.org/plugins/la-sentinelle-antispam/

JohnFen 8y ago

But it's painful to your users, and will lock out a subset of them (although a small minority, so you might not care).

baud147258 8y ago
and the users locked out can't contact support, since it's also protected by reCAPTCHA