5 ms·

I hear you, but do you have another solution to fix spammers invading a system? reCAPTCHA is annoying but I understand what it solves, I do type away.. And it’s

I hear you, but do you have another solution to fix spammers invading a system? reCAPTCHA is annoying but I understand what it solves, I do type away.. And it’s true, sometimes I give up too.

DenisM 6y ago
What’s the harm? Depending on your functionality there is hardly any downside to allowing multiple ghost accounts.
- hef19898 6y ago
  True that! Had a discussion along that line just earlier today about the contact us function on my website. Worst case, I get some more mails in my spam folder. I can live with that, checking it every two weeks or so doesn't hurt.
- jbay808 6y ago
  I used to run a forum for an indie videogame with a small but passionate userbase. Unfortunately it was completely overrun by spambots to the point that moderators couldn't keep up and they drowned out the real posts. We had to shut it down.
  - RyJones 6y ago
    This is one of the reasons Begg Knives shut down his forums. We literally couldn't delete accounts fast enough.
    - ValentineC 6y ago
      When I used to manage web forums, I ask a hard question during signup and put the answer within the question itself (e.g. "hint: the answer is xxx"). This usually stops simple spam bots that are aimed at that particular off-the-shelf forum software.
  - AQuantized 6y ago
    Why not stop allowing registration except by manual whitelist? At least until the spammer lost interest.
    - detaro 6y ago
      Is that less friction than captchas?
    - duxup 6y ago
      How would that work? Manually approve someone who registers ... then discover they're a spam bot?
- the_af 6y ago
  Anything with a chat/comments section will be overrun with spam-bots and be rendered unusable and unwelcoming. The difference between a bot-ridden comments section in a blog and a clean one is huge.
- jabroni_salad 6y ago
  There are lists of companies with workflows like this that get used in spam campaigns. You can put any email address in and now they will get a signup notice and multiple 'hey you didnt complete our workflow!' marketing messages. Easy way to put a lot of useless messages that mostly pass spam checks in any mailbox you desire. I recently had an incident with Chime Bank like this, where someone enrolled every public email address at my company with them. I sent them an abuse report and they told us to block their domains. Real great solution, guys.
Matt3o12_ 6y ago
What is your thread model? What’s the worst thing a spammer can do if they sign up? For most websites, what spammers can do is very limited so why are you expecting spammers to sign up in the first place? If you really think a captcha is necessary, limit it. For example, require that a captcha is required for two account registrants with a 24h period from the same ip. Don’t require captchas for logins unless a reasonable limit of attempts has been exceeded (5 wrong passwords within 24h by the same ip for example). If your site is small, a captcha is often overkill. A hidden input can trick pretty much any automated spam bot (if input empty, real user, otherwise bot). Just make sure you do enough research so accessibility readers also work with that field properly. If a spammer targets you, you can always active a captcha manually, although by the time you realize it, it might be too late. Keep in mind that a captcha only adds friction to the spammer (and users). Bypassing reCAPTCHA is possible for any motivated spammer for only a few cents/captcha. There are services that have humans in developing countries solve them for you. Coupled with a headless chromium, you can easily build a reputation so that google will let you through. For testing credit cards, this setup is definitely used and most likely worth it. So a captcha will not always save you from bots. Also keep in mind that hacker news does not have a captcha and the amount of spammers is minimal.
- LunaSea 6y ago
  If you send a validation email being targeted by spammers already means cost increase, messy databases / analytics and maybe even a ban for having sent to many emails at the same time.
- the_af 6y ago
  > What’s the worst thing a spammer can do if they sign up? In any site that creates a community or has any kind of interaction between its users, spammers and spambots will ruin the site for everyone else.
  - hombre_fatal 6y ago
    They must have not been around when proboards/ezboards/phpbbs were regularly taken over by spammers. It could single-handedly kill communities if the admins couldn't keep up. It's hard for me to take people seriously who rail against recaptcha yet don't seem to realize why we use it nor pitch a real alternative. Or that spammer protection is overrated because their obscure blog doesn't get much spam. It's easy to enumerate what sucks about something, but you can't just stop there.
rbritton 6y ago
There are other options. Cloudflare just switched to hCAPTCHA [0], and proof of work [1] can be effective enough. Aside from those, there's always the option of just leaving it open if there's nothing costly a spammer can do. They're unlikely to use the service itself and associated resources. [0]: https://www.hcaptcha.com/ https://www.hcaptcha.com/ [1]: http://www.hashcash.org/ http://www.hashcash.org/
- eyelidlessness 6y ago
  I just tried hCAPTCHA's example and it was basically indistinguishable to me from ReCAPTCHA. I'm unclear on how it's less friction for an end user.
  - dx034 6y ago
    With ReCaptcha 3, most users won't notice any captcha at all. Reducing friction to zero for the majority of users is a huge advantage vs other solutions.
    - gruez 6y ago
      >With ReCaptcha 3, most users won't notice any captcha at all And it achieves that by surveilling all user activity on your site, not just on the signup form.
      - slivanes 6y ago
        The owner of the site decides where the surveying occurs. I've chosen just the page where the captcha is needed and it works great.
        gruez 6y ago
        That's true, although google's own recommendations are to add the scripts on every page >reCAPTCHA works best when it has the most context about interactions with your site, which comes from seeing both legitimate and abusive behavior. For this reason, we recommend including reCAPTCHA verification on forms or actions as well as in the background of pages for analytics. https://developers.google.com/recaptcha/docs/v3 https://developers.google.com/recaptcha/docs/v3 A privacy minded programmer/company might restrict the scripts to the minimal set of pages, but I'd imagine most sites would blindly follow that advice and put it on every page because they think more data = better.

I hear you, but do you have another solution to fix spammers invading a system? reCAPTCHA is annoying but I understand what it solves, I do type away.. And it’s true, sometimes I give up too.

DenisM 6y ago

What’s the harm? Depending on your functionality there is hardly any downside to allowing multiple ghost accounts.

hef19898 6y ago
True that! Had a discussion along that line just earlier today about the contact us function on my website. Worst case, I get some more mails in my spam folder. I can live with that, checking it every two weeks or so doesn't hurt.
jbay808 6y ago
I used to run a forum for an indie videogame with a small but passionate userbase. Unfortunately it was completely overrun by spambots to the point that moderators couldn't keep up and they drowned out the real posts. We had to shut it down.
- RyJones 6y ago
  This is one of the reasons Begg Knives shut down his forums. We literally couldn't delete accounts fast enough.
  - ValentineC 6y ago
    When I used to manage web forums, I ask a hard question during signup and put the answer within the question itself (e.g. "hint: the answer is xxx"). This usually stops simple spam bots that are aimed at that particular off-the-shelf forum software.
- AQuantized 6y ago
  Why not stop allowing registration except by manual whitelist? At least until the spammer lost interest.
  - detaro 6y ago
    Is that less friction than captchas?
  - duxup 6y ago
    How would that work? Manually approve someone who registers ... then discover they're a spam bot?
the_af 6y ago
Anything with a chat/comments section will be overrun with spam-bots and be rendered unusable and unwelcoming. The difference between a bot-ridden comments section in a blog and a clean one is huge.
jabroni_salad 6y ago
There are lists of companies with workflows like this that get used in spam campaigns. You can put any email address in and now they will get a signup notice and multiple 'hey you didnt complete our workflow!' marketing messages. Easy way to put a lot of useless messages that mostly pass spam checks in any mailbox you desire. I recently had an incident with Chime Bank like this, where someone enrolled every public email address at my company with them. I sent them an abuse report and they told us to block their domains. Real great solution, guys.

Matt3o12_ 6y ago

What is your thread model? What’s the worst thing a spammer can do if they sign up? For most websites, what spammers can do is very limited so why are you expecting spammers to sign up in the first place? If you really think a captcha is necessary, limit it. For example, require that a captcha is required for two account registrants with a 24h period from the same ip. Don’t require captchas for logins unless a reasonable limit of attempts has been exceeded (5 wrong passwords within 24h by the same ip for example). If your site is small, a captcha is often overkill. A hidden input can trick pretty much any automated spam bot (if input empty, real user, otherwise bot). Just make sure you do enough research so accessibility readers also work with that field properly. If a spammer targets you, you can always active a captcha manually, although by the time you realize it, it might be too late. Keep in mind that a captcha only adds friction to the spammer (and users). Bypassing reCAPTCHA is possible for any motivated spammer for only a few cents/captcha. There are services that have humans in developing countries solve them for you. Coupled with a headless chromium, you can easily build a reputation so that google will let you through. For testing credit cards, this setup is definitely used and most likely worth it. So a captcha will not always save you from bots. Also keep in mind that hacker news does not have a captcha and the amount of spammers is minimal.

LunaSea 6y ago
If you send a validation email being targeted by spammers already means cost increase, messy databases / analytics and maybe even a ban for having sent to many emails at the same time.
the_af 6y ago
> What’s the worst thing a spammer can do if they sign up? In any site that creates a community or has any kind of interaction between its users, spammers and spambots will ruin the site for everyone else.
- hombre_fatal 6y ago
  They must have not been around when proboards/ezboards/phpbbs were regularly taken over by spammers. It could single-handedly kill communities if the admins couldn't keep up. It's hard for me to take people seriously who rail against recaptcha yet don't seem to realize why we use it nor pitch a real alternative. Or that spammer protection is overrated because their obscure blog doesn't get much spam. It's easy to enumerate what sucks about something, but you can't just stop there.

rbritton 6y ago

There are other options. Cloudflare just switched to hCAPTCHA [0], and proof of work [1] can be effective enough. Aside from those, there's always the option of just leaving it open if there's nothing costly a spammer can do. They're unlikely to use the service itself and associated resources. [0]: https://www.hcaptcha.com/ https://www.hcaptcha.com/ [1]: http://www.hashcash.org/ http://www.hashcash.org/

eyelidlessness 6y ago
I just tried hCAPTCHA's example and it was basically indistinguishable to me from ReCAPTCHA. I'm unclear on how it's less friction for an end user.
- dx034 6y ago
  With ReCaptcha 3, most users won't notice any captcha at all. Reducing friction to zero for the majority of users is a huge advantage vs other solutions.
  - gruez 6y ago
    >With ReCaptcha 3, most users won't notice any captcha at all And it achieves that by surveilling all user activity on your site, not just on the signup form.
    - slivanes 6y ago
      The owner of the site decides where the surveying occurs. I've chosen just the page where the captcha is needed and it works great.
      - gruez 6y ago
        That's true, although google's own recommendations are to add the scripts on every page >reCAPTCHA works best when it has the most context about interactions with your site, which comes from seeing both legitimate and abusive behavior. For this reason, we recommend including reCAPTCHA verification on forms or actions as well as in the background of pages for analytics. https://developers.google.com/recaptcha/docs/v3 https://developers.google.com/recaptcha/docs/v3 A privacy minded programmer/company might restrict the scripts to the minimal set of pages, but I'd imagine most sites would blindly follow that advice and put it on every page because they think more data = better.