4 ms·

So this is probably a bit off topic, but why don't more site owners just create their own unique anti-spam system? In my opinion, if they were simpler, yet all

So this is probably a bit off topic, but why don't more site owners just create their own unique anti-spam system? In my opinion, if they were simpler, yet all unique, there would be less bots that could mass spam and privacy would be improved. Even something as simple as a question: "How many legs does a spider have?" ____ And then cycle through different types of free form questions of things that most people should know. Perhaps block the IP after {n} failed attempts for an hour.

JorgeGT 7y ago
I remember a site that had such questions, specific to the knowledge of the site in question. Imagine HN asking "The L in SQL stands for: _____"
vmurthy 7y ago
One possible reason: the site owners nowadays use the likes of Foursquare/wix/whatnot which means reCaptcha etc are just a checkbox item. Custom anti-spam may be beyond their technical capabilities or interest levels.
flixic 7y ago
Most sites use reCAPTCHA to protect against bot registrations, sometimes targeted to their specific registration system. Any simple solution would defeat the purpose of a CAPTCHA.
- LinuxBender 7y ago
  Would it though? If each system was unique and rotated through different types of challenges, the bot would have to be custom tailored to handle every challenge type. i.e. free form questions, count the gray dots (vision impaired friendly), math questions, play tic-tac-toe and get a stalemate, ascii hang-man ... I could think of hundreds of different challenges. The bot would have to constantly adapt and the bot developer would have to really love puzzles. The bot consumers would have to update constantly and would have to learn all the challenges of each site owner. As a bonus, google the all knowing, is less knowing and no longer a gate-keeper.
  - pkaye 7y ago
    The spammers can also use cheap overseas labor to update the bots.
    - LinuxBender 7y ago
      I would be honored to help them feed their families. It would be a fun game of cat and mouse. Based on discussions here, it sounds like people have already automated Google captcha. I will go ahead and work on a few of my own and see what happens. Maybe we can turn this into a public competition.
      - pkaye 7y ago
        Looks like you have a great business plan at hand. Beat Google with a potentially superior product and help employ some people in developing countries!
- luckylion 7y ago
  idk, recaptcha solvers are about $3/1000 or something. That sounds like a very low hurdle to mess with most websites if that's their line of defense.
  - hombre_fatal 7y ago
    We still lock our car doors even though you can jimmy them open in a few seconds.
    - luckylion 7y ago
      Yeah, but you won't build a business on that, you'll add GPS trackers, make renters show you their drivers licenses etc. A captcha isn't "wrong" in general in my mind, it's just not something you add and you're all done, and it shouldn't be your first line of defense. It can be part of a multi-pronged anti-abuse strategy, but it's a very tricky part: it doesn't offer a lot of protection but creates a lot of friction for actual, legit users. Running a DNA test on somebody can be a good way to verify their identity. But asking for their ID card and looking at the picture is a lot quicker, cheaper and less intrusive. I don't see captchas a lot, because I'm not frequenting sites that use them. A friend of mine apparently does, so often that he pays for a captcha solver while he's sitting in front of his computer. He just can't be bothered to play Google's mind games, so he'd rather pay a few cents a day to not deal with it. We've come to the point where humans are paying for services that were created for bots so they can bypass technological hurdles that were meant to tell humans from bots.
mxcrossb 7y ago
I think this would fail under any directed attack. It’s too hard to generate a database that’s large enough.
- lucb1e 7y ago
  This is the answer. It seems that most website owners are somehow super scared of a targeted attack, since it is indeed trivial to bypass (and they realize that), even if nobody will take the time. I've heard stories from people that own small sites and still have someone targeting the site with custom scripts, but never anyone I know (not even a friend of a friend, only ever random people on the internet). But there is also the (much larger, from what I can tell) group of people that never had these issues. But people don't like risks, and installing a tracking captcha from google is made very easy. "Everyone does it, that ought to work!" (Meanwhile I hear of a 90% success rate from a recaptcha browser plugin, but who cares about that right?)
  - marcosdumay 7y ago
    I've had received attacks from custom scripts to post spam in a blog that nobody read. I changed my custom robots tests a couple of times, and each time it took a few days for the bots to adapt. At the end I removed the comments section, so there was nothing to attack.
    - lucb1e 7y ago
      This is exactly the kind of story I'm taking about. I'm sorry about your experience, I don't doubt that you're real, but this is the kind of confirmation/hindsight bias that makes people misjudge risks. I expect you are an outlier, but I have no idea. Might be interesting to poll random people that have websites with <100 unique visitors a month for this sort of thing to get us any sort of idea of how necessary an invasive CAPTCHA like Google's is.
- hombre_fatal 7y ago
  XRumer (forum spamming) software had a feature over a decade ago that would reload a /register page on different proxies to generate a list of these sorts of questions. You'd run it for a moment, feed an answer for each question into XRumer, and then continue on your merry spammy way. These ReCaptcha topics on HN really illuminate how few people have dealt with any real spam, much less targeted human or botnet attacks.
capnrefsmmat 7y ago
Forum software like vBulletin and Invision often has this feature built in, and I've used it on a forum I help run. Unfortunately, after writing four or five custom questions, I soon found server logs showing spam bots blowing through the questions in seconds -- I suspect that since this is a common enough strategy, it's worth their time to pay someone $0.10 to pick the correct answer, then save the question and answer pair in a database somewhere for future use.
- dmux 7y ago
  I don't remember what forum software it was, but they'd render a number or word using all periods (kind of like ASCII art) and ask you to enter it in a text field. I wonder how well that worked.
  - LinuxBender 7y ago
    Here is a rough silly first pass using figlet. [1] It just displays a word. Next I need to accept a post of that word and do something. Maybe another version will use a game. [1] - https://tinyvpn.org/up/d/ https://tinyvpn.org/up/d/

JorgeGT 7y ago

I remember a site that had such questions, specific to the knowledge of the site in question. Imagine HN asking "The L in SQL stands for: _____"

vmurthy 7y ago

One possible reason: the site owners nowadays use the likes of Foursquare/wix/whatnot which means reCaptcha etc are just a checkbox item. Custom anti-spam may be beyond their technical capabilities or interest levels.

flixic 7y ago

Most sites use reCAPTCHA to protect against bot registrations, sometimes targeted to their specific registration system. Any simple solution would defeat the purpose of a CAPTCHA.

LinuxBender 7y ago
Would it though? If each system was unique and rotated through different types of challenges, the bot would have to be custom tailored to handle every challenge type. i.e. free form questions, count the gray dots (vision impaired friendly), math questions, play tic-tac-toe and get a stalemate, ascii hang-man ... I could think of hundreds of different challenges. The bot would have to constantly adapt and the bot developer would have to really love puzzles. The bot consumers would have to update constantly and would have to learn all the challenges of each site owner. As a bonus, google the all knowing, is less knowing and no longer a gate-keeper.
- pkaye 7y ago
  The spammers can also use cheap overseas labor to update the bots.
  - LinuxBender 7y ago
    I would be honored to help them feed their families. It would be a fun game of cat and mouse. Based on discussions here, it sounds like people have already automated Google captcha. I will go ahead and work on a few of my own and see what happens. Maybe we can turn this into a public competition.
    - pkaye 7y ago
      Looks like you have a great business plan at hand. Beat Google with a potentially superior product and help employ some people in developing countries!
luckylion 7y ago
idk, recaptcha solvers are about $3/1000 or something. That sounds like a very low hurdle to mess with most websites if that's their line of defense.
- hombre_fatal 7y ago
  We still lock our car doors even though you can jimmy them open in a few seconds.
  - luckylion 7y ago
    Yeah, but you won't build a business on that, you'll add GPS trackers, make renters show you their drivers licenses etc. A captcha isn't "wrong" in general in my mind, it's just not something you add and you're all done, and it shouldn't be your first line of defense. It can be part of a multi-pronged anti-abuse strategy, but it's a very tricky part: it doesn't offer a lot of protection but creates a lot of friction for actual, legit users. Running a DNA test on somebody can be a good way to verify their identity. But asking for their ID card and looking at the picture is a lot quicker, cheaper and less intrusive. I don't see captchas a lot, because I'm not frequenting sites that use them. A friend of mine apparently does, so often that he pays for a captcha solver while he's sitting in front of his computer. He just can't be bothered to play Google's mind games, so he'd rather pay a few cents a day to not deal with it. We've come to the point where humans are paying for services that were created for bots so they can bypass technological hurdles that were meant to tell humans from bots.

mxcrossb 7y ago

I think this would fail under any directed attack. It’s too hard to generate a database that’s large enough.

lucb1e 7y ago
This is the answer. It seems that most website owners are somehow super scared of a targeted attack, since it is indeed trivial to bypass (and they realize that), even if nobody will take the time. I've heard stories from people that own small sites and still have someone targeting the site with custom scripts, but never anyone I know (not even a friend of a friend, only ever random people on the internet). But there is also the (much larger, from what I can tell) group of people that never had these issues. But people don't like risks, and installing a tracking captcha from google is made very easy. "Everyone does it, that ought to work!" (Meanwhile I hear of a 90% success rate from a recaptcha browser plugin, but who cares about that right?)
- marcosdumay 7y ago
  I've had received attacks from custom scripts to post spam in a blog that nobody read. I changed my custom robots tests a couple of times, and each time it took a few days for the bots to adapt. At the end I removed the comments section, so there was nothing to attack.
  - lucb1e 7y ago
    This is exactly the kind of story I'm taking about. I'm sorry about your experience, I don't doubt that you're real, but this is the kind of confirmation/hindsight bias that makes people misjudge risks. I expect you are an outlier, but I have no idea. Might be interesting to poll random people that have websites with <100 unique visitors a month for this sort of thing to get us any sort of idea of how necessary an invasive CAPTCHA like Google's is.
hombre_fatal 7y ago
XRumer (forum spamming) software had a feature over a decade ago that would reload a /register page on different proxies to generate a list of these sorts of questions. You'd run it for a moment, feed an answer for each question into XRumer, and then continue on your merry spammy way. These ReCaptcha topics on HN really illuminate how few people have dealt with any real spam, much less targeted human or botnet attacks.

capnrefsmmat 7y ago

Forum software like vBulletin and Invision often has this feature built in, and I've used it on a forum I help run. Unfortunately, after writing four or five custom questions, I soon found server logs showing spam bots blowing through the questions in seconds -- I suspect that since this is a common enough strategy, it's worth their time to pay someone $0.10 to pick the correct answer, then save the question and answer pair in a database somewhere for future use.

dmux 7y ago
I don't remember what forum software it was, but they'd render a number or word using all periods (kind of like ASCII art) and ask you to enter it in a text field. I wonder how well that worked.
- LinuxBender 7y ago
  Here is a rough silly first pass using figlet. [1] It just displays a word. Next I need to accept a post of that word and do something. Maybe another version will use a game. [1] - https://tinyvpn.org/up/d/ https://tinyvpn.org/up/d/