14 ms·

What is a good alternative? I'm going to be looking I to our login system soon and have been meaning to read about the options

spiznnx 8y ago
Not sure you need to make sure the user is human on a log-in form. Just limit the number of attempts per day per account, perhaps with email verification to pass it.
- maccard 8y ago
  At even small to moderate scales you will end up with legitimate users being locked out of their accounts en masse with this approach.
  - spiznnx 7y ago
    Well, most log-in forms do not have any captcha, so I wonder how they do it.
svnpenn 8y ago
github has a good one you can test it by trying to create a new account its dead simple and looks to be pretty secure you have to orient an object so that its not upside down https://octocaptcha.com https://octocaptcha.com
- Chris2048 7y ago
  Are there a fixed number of objects?
  - dual_basis 7y ago
    I'm more worried about the small state space. Even if there are many possible images, randomly guessing lets in 1/8 of the bots. Is there something to protect against this?
    - svnpenn 7y ago
      i found this but i dont know if it answers your question https://blog.jscrambler.com/preventing-automated-abuse-with-arkose-labs-and-jscrambler https://blog.jscrambler.com/preventing-automated-abuse-with-...
- ekovarski 7y ago
  This is definitely easier. While I don't mind reCAPTCHA on many resources, commercial entities which charge money for you to use their products, should try to make the login process as easy as possible and reCAPTCHA isn't one of them, as at times you have to iterate several times of identifying all cross walks or store fronts.
- petercooper 7y ago
  EA use a variant of this for their FIFA app and it was legitimately the most frustrating CAPTCHA I've ever tried to solve. They overlaid several objects at the same time in an attempt to make it harder and it took me 9 minutes to solve them all. Example: https://imgur.com/a/x8x4amL https://imgur.com/a/x8x4amL
baroffoos 8y ago
If there is no way for users to spam other users then there is no need for a captcha at all. Just add rate limiting and alerts to see if one user is using too much resources. If your users can disturb each other than the best solution is to make your system invite only and remove invite perms from anyone who is inviting bots or alternatively have some way where users must add other users as friends before they communicate using an external service so for example someone wants to add a friend they send an email with a friend code then you are using the existing anti spam system of whatever external system the user picks. Maybe none of these are convenient for you but for some websites they work quite well. Invite only communities often have far less trolls and virtually no spam.
- dual_basis 7y ago
  Even if this is true, the problem is that Google reCAPTCHA is way easier to slap on anything, and for the few hurdles it imposes it is very effective at stopping bots. I'm not in a position to decide on a human verification mechanism, but I used to do WordPress and Drupal CMS work as a freelancer. The number of non-technical people setting up their own sites on these platforms vastly outnumbers the people who even are aware of some of the downsides to Google reCAPTCHA. Until the mechanisms you described implementing are as easy as installing a plug-in, Google reCAPTCHA is here to stay.
WalterGR 7y ago
In my experience, email verification gets you 99% of the way there. Strategically-placed honeypot form fields get you to 99.5%. I run a site that gets ~1.2 million visitors a month. YMMV.

spiznnx 8y ago

Not sure you need to make sure the user is human on a log-in form. Just limit the number of attempts per day per account, perhaps with email verification to pass it.

maccard 8y ago
At even small to moderate scales you will end up with legitimate users being locked out of their accounts en masse with this approach.
- spiznnx 7y ago
  Well, most log-in forms do not have any captcha, so I wonder how they do it.

svnpenn 8y ago

github has a good one you can test it by trying to create a new account its dead simple and looks to be pretty secure you have to orient an object so that its not upside down https://octocaptcha.com https://octocaptcha.com

Chris2048 7y ago
Are there a fixed number of objects?
- dual_basis 7y ago
  I'm more worried about the small state space. Even if there are many possible images, randomly guessing lets in 1/8 of the bots. Is there something to protect against this?
  - svnpenn 7y ago
    i found this but i dont know if it answers your question https://blog.jscrambler.com/preventing-automated-abuse-with-arkose-labs-and-jscrambler https://blog.jscrambler.com/preventing-automated-abuse-with-...
ekovarski 7y ago
This is definitely easier. While I don't mind reCAPTCHA on many resources, commercial entities which charge money for you to use their products, should try to make the login process as easy as possible and reCAPTCHA isn't one of them, as at times you have to iterate several times of identifying all cross walks or store fronts.
petercooper 7y ago
EA use a variant of this for their FIFA app and it was legitimately the most frustrating CAPTCHA I've ever tried to solve. They overlaid several objects at the same time in an attempt to make it harder and it took me 9 minutes to solve them all. Example: https://imgur.com/a/x8x4amL https://imgur.com/a/x8x4amL

baroffoos 8y ago

If there is no way for users to spam other users then there is no need for a captcha at all. Just add rate limiting and alerts to see if one user is using too much resources. If your users can disturb each other than the best solution is to make your system invite only and remove invite perms from anyone who is inviting bots or alternatively have some way where users must add other users as friends before they communicate using an external service so for example someone wants to add a friend they send an email with a friend code then you are using the existing anti spam system of whatever external system the user picks. Maybe none of these are convenient for you but for some websites they work quite well. Invite only communities often have far less trolls and virtually no spam.

dual_basis 7y ago
Even if this is true, the problem is that Google reCAPTCHA is way easier to slap on anything, and for the few hurdles it imposes it is very effective at stopping bots. I'm not in a position to decide on a human verification mechanism, but I used to do WordPress and Drupal CMS work as a freelancer. The number of non-technical people setting up their own sites on these platforms vastly outnumbers the people who even are aware of some of the downsides to Google reCAPTCHA. Until the mechanisms you described implementing are as easy as installing a plug-in, Google reCAPTCHA is here to stay.

WalterGR 7y ago

In my experience, email verification gets you 99% of the way there. Strategically-placed honeypot form fields get you to 99.5%. I run a site that gets ~1.2 million visitors a month. YMMV.