6 ms·
ReCAPTCHA is one of the worst things that has happened to the Internet. Please consider an alternative if you are a webmaster that has a choice. It's overkill f
by ve55 8y ago
ReCAPTCHA is one of the worst things that has happened to the Internet. Please consider an alternative if you are a webmaster that has a choice. It's overkill for most purposes.
- gingerlime 8y agoAny recommendations?
- ve55 8y agoFor most situations at most scales, there's a lot of simple open source captchas that should work just fine. If you're working on something that has high potential for dedicated abuse, there are some paid ones that will work well too. I can edit this post with links in a moment. But a captcha is just one line of defense, and you can take a lot of other things into account, like threat score of visitor IPs, verification methods like email, phone, etc.
- altfredd 8y agoIf you want to simply limit amount of unwanted traffic, implement conventional image captcha with some minor twist. State-of-art bots do not (yet) have a human-like AI, so you will be safe(r) until someone adapts all existing bots to solve your modification. If you want to hinder determined (but inept) adversary, impose reverse time limit: make your captcha a bit complex and deny answers, that arrive too fast. Legit users will spend a bit of time to solve captcha. Machine-learning-driven bots will blaze it. In addition to measuring speed of filling captchas you can measure amount of user time spent on other actions on your site — in process making your bot detector increasingly similar to Google's reCAPTCHA. In general look for behaviors, distinguishing legitimate users from malicious. Hint: having Google account might or might not indicate a legitimate user, but it is probably more efficient to ask users for it directly than in roundabout way by using reCAPTCHA.
- cadence- 8y agoWhat’s the alternative?
- robin_reala 8y agoFairly simple: not having CAPTCHAs. By including them you externalise your business costs onto your users.
- alanpetrel 8y agoSo how do you stop bots from submitting fake data to sign up forms or trying to brute force password fields etc. on websites?
- the8472 8y ago> brute force password fields rate limit > stop bots from submitting fake data to sign up forms I don't think there's an universal solution here. it depends on the application itself and why you consider fake signups an issue in the first place.
- amluto 8y agoFor passwords: offer 2FA (ideally WebAuthn, but it sadly hasn’t landed in enough browsers yet), use a reasonable password strength policy, and possibly consider OAuth login. Or, and I know this is crazy talk, allow users to opt out of the bloody captcha if they say they use a password manager, and then use some basic heuristic requirements on the password. But stop making me click the friggin’ stop lights every time I log in to my own account.
- jasonhansel 8y agoAlso: by using ReCaptcha, you're essentially giving Google free money, in the form of training samples for self-driving cars. Surely there are CAPTCHAs for things that benefit the public at large?
- HNLurker2 8y agoI never understood how it works. Do we give free feedback and then tests us?
- jasonhansel 8y agoIt compares your answer against answers from other users, to make sure that they agree. This gives them a training set to use.
- HNLurker2 8y agoWhat if we troll it? Or wisdom of the crowd is too strong?
- TrinaryWorksToo 8y agoRecaptcha gives Google exclusive automated access to your website. Do you want Google to grow as company because of this?