3 ms·

That article aside, what are everyone's experiences with reCAPTCHA? We are using it to secure one of our contact forms and get a lot of spam through it. Upon re

That article aside, what are everyone's experiences with reCAPTCHA? We are using it to secure one of our contact forms and get a lot of spam through it. Upon research (googling) I found that reCAPTCHA is "broken", e.g. https://threatpost.com/uncaptcha-googles-recaptchas/140593/ https://threatpost.com/uncaptcha-googles-recaptchas/140593/

hedora 7y ago
I can’t reliably pass them without altering browser settings (and even then, answering correctly doesn’t seem to matter one way or another shrug). I switch services whenever it is possible and I see a reCAPTCHA prompt. (I am a human.)
kwhitefoot 7y ago
My experience is pretty much the same as the article. And because I value my time you risk simply not having me contact you if you use any kind of captcha.
tadzik_ 7y ago
We use it to stop bots from opening thousands of trial accounts. We don't have bots anymore, but instead we have humans who open hundreds of trial accounts hourly. I guess it's an improvement.
- ackbar03 7y ago
  Whats the service fir? I know game miners and some other niche services that attract these kind of actors. Do you know what they want from your site?
  - tadzik_ 7y ago
    An email provider. Interestingly enough they don't even send anything. They just... sit there. And who knows why. Not really doing anything harmful afaik, but obviously fradulent so our support still kills them in bulk just in case they were a proper threat waiting for the activation.
    - ackbar03 7y ago
      Huh, interesting, thanks for sharing. Maybe they're just using it as an address to open up accounts for other stuff?
      - tadzik_ 7y ago
        Perhaps – but I'm pretty sure there's some that don't even receive emails either. It's as if someone was just creating a "standing army" of accounts in preparation to unleash something. Spooky :)
megous 7y ago
Companies should just use bogofilter and not submission blocking on contact forms if they're annoyed about receiving spam all the time. That and then just go through the detected spam once in a while (once per week perhaps). Basically the same they'd do with e-mail. Several times I was prevented from complaining about something to a company that didn't have a public e-mail address, but only a contact form with captcha, just because that day, google decided they'll fail all my recaptcha attempts, and tell me "sorry we think your computer is sending automated queries" and wouldn't even allow me to try any futher. It really doesn't help if I'm in a negative midnset about the company already. I've completely stopped using shipping companies that put tracking info behind recpatcha, for the same reason, although that's a different thing from contact forms and a bit harder to manage. But contact forms should not be blocked with recaptcha. Outright blocking communication is a poor taste. Accept all communication and use automated mechanisms to filter through it on your side. BTW, this is even worse for users that block re-captcha via adblocker or something, because you often lose the entire text you were about to send. So the next attempt you're even angrier.

hedora 7y ago

I can’t reliably pass them without altering browser settings (and even then, answering correctly doesn’t seem to matter one way or another shrug). I switch services whenever it is possible and I see a reCAPTCHA prompt. (I am a human.)

kwhitefoot 7y ago

My experience is pretty much the same as the article. And because I value my time you risk simply not having me contact you if you use any kind of captcha.

tadzik_ 7y ago

We use it to stop bots from opening thousands of trial accounts. We don't have bots anymore, but instead we have humans who open hundreds of trial accounts hourly. I guess it's an improvement.

ackbar03 7y ago
Whats the service fir? I know game miners and some other niche services that attract these kind of actors. Do you know what they want from your site?
- tadzik_ 7y ago
  An email provider. Interestingly enough they don't even send anything. They just... sit there. And who knows why. Not really doing anything harmful afaik, but obviously fradulent so our support still kills them in bulk just in case they were a proper threat waiting for the activation.
  - ackbar03 7y ago
    Huh, interesting, thanks for sharing. Maybe they're just using it as an address to open up accounts for other stuff?
    - tadzik_ 7y ago
      Perhaps – but I'm pretty sure there's some that don't even receive emails either. It's as if someone was just creating a "standing army" of accounts in preparation to unleash something. Spooky :)

megous 7y ago

Companies should just use bogofilter and not submission blocking on contact forms if they're annoyed about receiving spam all the time. That and then just go through the detected spam once in a while (once per week perhaps). Basically the same they'd do with e-mail. Several times I was prevented from complaining about something to a company that didn't have a public e-mail address, but only a contact form with captcha, just because that day, google decided they'll fail all my recaptcha attempts, and tell me "sorry we think your computer is sending automated queries" and wouldn't even allow me to try any futher. It really doesn't help if I'm in a negative midnset about the company already. I've completely stopped using shipping companies that put tracking info behind recpatcha, for the same reason, although that's a different thing from contact forms and a bit harder to manage. But contact forms should not be blocked with recaptcha. Outright blocking communication is a poor taste. Accept all communication and use automated mechanisms to filter through it on your side. BTW, this is even worse for users that block re-captcha via adblocker or something, because you often lose the entire text you were about to send. So the next attempt you're even angrier.