3 ms·

What’s the alternative?

by cadence- 8y ago

robin_reala 8y ago
Fairly simple: not having CAPTCHAs. By including them you externalise your business costs onto your users.
- alanpetrel 8y ago
  So how do you stop bots from submitting fake data to sign up forms or trying to brute force password fields etc. on websites?
  - the8472 8y ago
    > brute force password fields rate limit > stop bots from submitting fake data to sign up forms I don't think there's an universal solution here. it depends on the application itself and why you consider fake signups an issue in the first place.
    - j88439h84 8y ago
      Rate limit by what? Username? IP?
      - the8472 8y ago
        per user if you want to defend against targeted attacks. per IP if you want to prevent untarged attacks. so, both. add an email-reset for the limit so users can't be locked out of their accounts by a DoS.
  - amluto 8y ago
    For passwords: offer 2FA (ideally WebAuthn, but it sadly hasn’t landed in enough browsers yet), use a reasonable password strength policy, and possibly consider OAuth login. Or, and I know this is crazy talk, allow users to opt out of the bloody captcha if they say they use a password manager, and then use some basic heuristic requirements on the password. But stop making me click the friggin’ stop lights every time I log in to my own account.
  - mholt 8y ago
    Circuit-break after 5-10 failed attempts and require 30s or 1m before each attempt after the first 3 failed ones. To stop fake signups, require confirming the email address and only allow some number of signups per IP per day. It's not perfect but neither are CAPTCHAs and either way you can probably stop most spam, if it's even a problem for you.
djitz 8y ago
Something I have found to work well is simply adding a hidden input field to forms. Since just about every spam bot automatically fills every field and submits, you can just disregard any submission which has that field populated and there is zero interruption to normal users.
- meowface 8y ago
  I've used this tactic for years and sadly it's not remotely helpful for any of my websites anymore. The bots only get better over time. Many are also running PhantomJS, headless Chrome, or similar.
  - djitz 8y ago
    It was only a matter of time! I imagine using a standard text field and then hiding it using css probably works much better than setting a type=“hidden” field. I also usually use something like name=“phone” and then just naming the actual phone field something else, if needed.
    - tracker1 8y ago
      Except then, you have autofill/extensions that form fill for you. Generating simple math question/answer can work well enough to keep out non-targeted traffic (someone not targeting a bot tailored to your site).
n_ary 8y ago
Amazon & Google itself(login) uses old squiggly-text captchas. Try wrong password 2-3 times to be greeted by one.

What’s the alternative?

robin_reala 8y ago

Fairly simple: not having CAPTCHAs. By including them you externalise your business costs onto your users.

alanpetrel 8y ago
So how do you stop bots from submitting fake data to sign up forms or trying to brute force password fields etc. on websites?
- the8472 8y ago
  > brute force password fields rate limit > stop bots from submitting fake data to sign up forms I don't think there's an universal solution here. it depends on the application itself and why you consider fake signups an issue in the first place.
  - j88439h84 8y ago
    Rate limit by what? Username? IP?
    - the8472 8y ago
      per user if you want to defend against targeted attacks. per IP if you want to prevent untarged attacks. so, both. add an email-reset for the limit so users can't be locked out of their accounts by a DoS.
- amluto 8y ago
  For passwords: offer 2FA (ideally WebAuthn, but it sadly hasn’t landed in enough browsers yet), use a reasonable password strength policy, and possibly consider OAuth login. Or, and I know this is crazy talk, allow users to opt out of the bloody captcha if they say they use a password manager, and then use some basic heuristic requirements on the password. But stop making me click the friggin’ stop lights every time I log in to my own account.
- mholt 8y ago
  Circuit-break after 5-10 failed attempts and require 30s or 1m before each attempt after the first 3 failed ones. To stop fake signups, require confirming the email address and only allow some number of signups per IP per day. It's not perfect but neither are CAPTCHAs and either way you can probably stop most spam, if it's even a problem for you.

djitz 8y ago

Something I have found to work well is simply adding a hidden input field to forms. Since just about every spam bot automatically fills every field and submits, you can just disregard any submission which has that field populated and there is zero interruption to normal users.

meowface 8y ago
I've used this tactic for years and sadly it's not remotely helpful for any of my websites anymore. The bots only get better over time. Many are also running PhantomJS, headless Chrome, or similar.
- djitz 8y ago
  It was only a matter of time! I imagine using a standard text field and then hiding it using css probably works much better than setting a type=“hidden” field. I also usually use something like name=“phone” and then just naming the actual phone field something else, if needed.
  - tracker1 8y ago
    Except then, you have autofill/extensions that form fill for you. Generating simple math question/answer can work well enough to keep out non-targeted traffic (someone not targeting a bot tailored to your site).

n_ary 8y ago

Amazon & Google itself(login) uses old squiggly-text captchas. Try wrong password 2-3 times to be greeted by one.