7 ms·

I really dont know how well that will work against a dedicated attacker. I am much more confident in ReCAPTCHA of stopping bots compared to any roll your own s

I really dont know how well that will work against a dedicated attacker. I am much more confident in ReCAPTCHA of stopping bots compared to any roll your own solution. I dont want to hope that an alternative is good enough for my needs. I want the best when it comes to protecting my site. Any alternative needs to have a proven track record and support to make consider replacing ReCAPTCHA.

deleted 7y ago
[deleted]
jachee 7y ago
How much does ReCAPTCHA's aggressively targeting non-Chrome and/or privacy-enabled browsers and making completing captchas exceedingly difficult factor in your decision? Do you want your site "protected" from those users, too?
briandear 7y ago
So you force your users to consent to sharing all of their data with Google? That’ll teach ‘em.
- sb8244 7y ago
  What's an alternative that works at scale, though? It's easy to say "this is bad for these reasons, don't use it" while ignoring that there's not really better options once you get targeted.
  - sb8244 7y ago
    To clarify, I do think that this post gives good alternatives because most spam is not targeted. However, you must do something like this if you're a big site or a small site who pissed someone off
    - atoav 7y ago
      The reasonable thing to do would be to initially create challanges with multiple levels/difficulties so you can quickly change the mechanism when you are really targeted. For my personal blog I managed to be spam free with a simple question/answer pair for 5 years. Took me a minute to implement and leaves my user data where it belongs.
  - atoav 7y ago
    I used a bunch of randomized questions with single word answers (case insensitive and typo tolerant) and hidden fields for years now. You can use common knowledge or simple ambiguity of language. You can use simple math arithmetic, written in properly obfuscated html. and randomly generated on each page load. You can use custom question about the content of the article (helps with informed answers). On a small blog of mine just one question with one answer on the contact form prevented all spam for over 5 years already although it would be trivial to exploit in a targeted attack. Targeted attacks are rare unless your captcha protects a juicy target that is worth a targeted attack at some point.
    - akie 7y ago
      Yeah but to be fair he did ask for alternatives in case you are targeted. It happened at work here too, someone with a grudge and a botnet waged a multi-month targeted campaign, and reCAPTCHA was the only thing that helped. Are there alternatives in situations like this?
- shaki-dora 7y ago
  "all their data" is a bit much, isn't it? ReCAPTCHA gives Google exactly one datum, namely the user's visit to the one page it is on. And I would even hazard a guess that the TOS specify that Google will not retain/link that information, considering that's how Analytics is run.
  - beiller 7y ago
    I am fairly certain that ReCAPTCHA does many things behind the scenes. It probably is using webGL and many other browser features to "fingerprint" your browser, OS, graphics card, sound card, etc. This is simple by just for example drawing some polygons in the background then reading the frame buffer, because different graphics cards / drivers may output different buffers slightly. Then it can store that fingerprint to show you less ReCAPTCHA in the future if you successfully pass the first one. This will also link that fingerprint with all other websites which use google analytics and now they have your full browsing history. The TOS may specify they are not _sharing_ that information, but they can do whatever they want internally to fully mine that data.
    - atoav 7y ago
      Well on top of that you train the image recognition algorithms of a tech giant. So for them it is a win-win strategy: user data and free labour
  - ComputerGuru 7y ago
    No, that's how it used to be. Now with ReCaptcha v3 the recommend you load it on all your pages, not just the forms you are trying to protect, so they can predict friend vs foe more accurately.
    - AstralStorm 7y ago
      Or rather keep Google tracking cookies alive forever and updated.
    - inferiorhuman 7y ago
      So how does one block this?
luckylion 7y ago
> I am much more confident in ReCAPTCHA of stopping bots compared to any roll your own solution. I am as well. We enabled Recaptcha on one site and had spam signups drop by 99%. Unfortunately, regular signups also dropped by 20% because people give up when they hit Recaptcha and don't absolutely, seriously need what it's protecting. To us, joining the arms race against the spammers (which, so far, we've easily won) was much more profitable than turning away legitimate customers.
godelski 7y ago
> I really don't know how well that will work against a dedicated attacker. >>> You probably don’t need ReCAPTCHA Probably being the keyword, because you probably aren't a big enough site for a dedicated attacker. Or for a dedicated attacker to be an issue. And really, let's s/attacker/bot/g. Not every bot is a problem. Not every bot is an attacker, i.e. someone doing something malicious.
zaarn 7y ago
For 20$ you can solve a few million ReCAPTCHA's using Buster and a paid-for STT engine. Atm Buster works about 95% of the time, so you'd see significant amounts of spam even with ReCAPTCHA.
- MakeUsersWant 7y ago
  I'd love to pay $20 for a firefox extension that makes this problem go away. I use lots of privacy extensions on Firefox, and those Captchas are annoying as hell. Tor is even worse. Can you please provide a few ready-to-use links?
  - zaarn 7y ago
    Just install Buster, it's free on the Mozilla Addon Site, you can set it to a STT provider other than Google, which I recommend since they seem to detect using their STT engine now. You can pay for Azure and other STT engines to solve it for you an dthe results are usually a bit better.
mcv 7y ago
> I am much more confident in ReCAPTCHA of stopping bots compared to any roll your own solution. I'm much more afraid of ReCaptcha blocking bonafide users. It's a harmful obstacle that punishes legitimate users for not sharing as much data as possible with Google. Even if you really need a captcha, there are better solutions out there.
- sli 7y ago
  Google really, really does not like people who use Firefox and/or a VPN.
Hnrobert42 7y ago
When you consider what “the best” means, please include the value of not feeding your users into Google’s gaping maw.
- codeGreene 7y ago
  Some have never cared or either stopped caring altogether because of the average user's apathy. Not that I agree with it, but I can see why someone would ignore that con in favor of the pros.
krageon 7y ago
Most of the times when I encounter recaptcha I don't even bother filling it out - it's a huge pain in the ass and apparently I look scary because I always have to jump through way too many hoops before I'm allowed into the crappy walled garden that it's probably protecting. I can't be the only one that feels this way, that is something you should consider when picking a captcha solution as well.

deleted 7y ago

[deleted]

jachee 7y ago

How much does ReCAPTCHA's aggressively targeting non-Chrome and/or privacy-enabled browsers and making completing captchas exceedingly difficult factor in your decision? Do you want your site "protected" from those users, too?

briandear 7y ago

So you force your users to consent to sharing all of their data with Google? That’ll teach ‘em.

sb8244 7y ago
What's an alternative that works at scale, though? It's easy to say "this is bad for these reasons, don't use it" while ignoring that there's not really better options once you get targeted.
- sb8244 7y ago
  To clarify, I do think that this post gives good alternatives because most spam is not targeted. However, you must do something like this if you're a big site or a small site who pissed someone off
  - atoav 7y ago
    The reasonable thing to do would be to initially create challanges with multiple levels/difficulties so you can quickly change the mechanism when you are really targeted. For my personal blog I managed to be spam free with a simple question/answer pair for 5 years. Took me a minute to implement and leaves my user data where it belongs.
- atoav 7y ago
  I used a bunch of randomized questions with single word answers (case insensitive and typo tolerant) and hidden fields for years now. You can use common knowledge or simple ambiguity of language. You can use simple math arithmetic, written in properly obfuscated html. and randomly generated on each page load. You can use custom question about the content of the article (helps with informed answers). On a small blog of mine just one question with one answer on the contact form prevented all spam for over 5 years already although it would be trivial to exploit in a targeted attack. Targeted attacks are rare unless your captcha protects a juicy target that is worth a targeted attack at some point.
  - akie 7y ago
    Yeah but to be fair he did ask for alternatives in case you are targeted. It happened at work here too, someone with a grudge and a botnet waged a multi-month targeted campaign, and reCAPTCHA was the only thing that helped. Are there alternatives in situations like this?
shaki-dora 7y ago
"all their data" is a bit much, isn't it? ReCAPTCHA gives Google exactly one datum, namely the user's visit to the one page it is on. And I would even hazard a guess that the TOS specify that Google will not retain/link that information, considering that's how Analytics is run.
- beiller 7y ago
  I am fairly certain that ReCAPTCHA does many things behind the scenes. It probably is using webGL and many other browser features to "fingerprint" your browser, OS, graphics card, sound card, etc. This is simple by just for example drawing some polygons in the background then reading the frame buffer, because different graphics cards / drivers may output different buffers slightly. Then it can store that fingerprint to show you less ReCAPTCHA in the future if you successfully pass the first one. This will also link that fingerprint with all other websites which use google analytics and now they have your full browsing history. The TOS may specify they are not _sharing_ that information, but they can do whatever they want internally to fully mine that data.
  - atoav 7y ago
    Well on top of that you train the image recognition algorithms of a tech giant. So for them it is a win-win strategy: user data and free labour
- ComputerGuru 7y ago
  No, that's how it used to be. Now with ReCaptcha v3 the recommend you load it on all your pages, not just the forms you are trying to protect, so they can predict friend vs foe more accurately.
  - AstralStorm 7y ago
    Or rather keep Google tracking cookies alive forever and updated.
  - inferiorhuman 7y ago
    So how does one block this?

luckylion 7y ago

> I am much more confident in ReCAPTCHA of stopping bots compared to any roll your own solution. I am as well. We enabled Recaptcha on one site and had spam signups drop by 99%. Unfortunately, regular signups also dropped by 20% because people give up when they hit Recaptcha and don't absolutely, seriously need what it's protecting. To us, joining the arms race against the spammers (which, so far, we've easily won) was much more profitable than turning away legitimate customers.

godelski 7y ago

> I really don't know how well that will work against a dedicated attacker. >>> You probably don’t need ReCAPTCHA Probably being the keyword, because you probably aren't a big enough site for a dedicated attacker. Or for a dedicated attacker to be an issue. And really, let's s/attacker/bot/g. Not every bot is a problem. Not every bot is an attacker, i.e. someone doing something malicious.

zaarn 7y ago

For 20$ you can solve a few million ReCAPTCHA's using Buster and a paid-for STT engine. Atm Buster works about 95% of the time, so you'd see significant amounts of spam even with ReCAPTCHA.

MakeUsersWant 7y ago
I'd love to pay $20 for a firefox extension that makes this problem go away. I use lots of privacy extensions on Firefox, and those Captchas are annoying as hell. Tor is even worse. Can you please provide a few ready-to-use links?
- zaarn 7y ago
  Just install Buster, it's free on the Mozilla Addon Site, you can set it to a STT provider other than Google, which I recommend since they seem to detect using their STT engine now. You can pay for Azure and other STT engines to solve it for you an dthe results are usually a bit better.

mcv 7y ago

> I am much more confident in ReCAPTCHA of stopping bots compared to any roll your own solution. I'm much more afraid of ReCaptcha blocking bonafide users. It's a harmful obstacle that punishes legitimate users for not sharing as much data as possible with Google. Even if you really need a captcha, there are better solutions out there.

sli 7y ago
Google really, really does not like people who use Firefox and/or a VPN.

Hnrobert42 7y ago

When you consider what “the best” means, please include the value of not feeding your users into Google’s gaping maw.

codeGreene 7y ago
Some have never cared or either stopped caring altogether because of the average user's apathy. Not that I agree with it, but I can see why someone would ignore that con in favor of the pros.

krageon 7y ago

Most of the times when I encounter recaptcha I don't even bother filling it out - it's a huge pain in the ass and apparently I look scary because I always have to jump through way too many hoops before I'm allowed into the crappy walled garden that it's probably protecting. I can't be the only one that feels this way, that is something you should consider when picking a captcha solution as well.