4 ms·

This just encourages spambots to upgrade their technology. You could upgrade spambots quite easily by just running them inside a headless browser with full java

by mayank 16y ago

This just encourages spambots to upgrade their technology. You could upgrade spambots quite easily by just running them inside a headless browser with full javascript support, like phantomjs. There is very little distinction between writing a phantomjs unit test and writing a spambot.

TamDenholm 16y ago
You can apply the same to CAPTCHA as well, its not hard to automate CAPTCHA input either. But the reality of the situation is that the vast majority of spam bots are simple and for every additional check you put into your form you increase the effectiveness by a magnitude.
- mayank 16y ago
  You can't do the same with captcha because that would require a degree of brute forcing. And my point was that existing spambots could trivially be upgraded to handle hidden form values and keystroke timers and other automated javascript validation.
  - roel_v 16y ago
    Sure, they could be, and also to trivially solve captchas on mechanical turk, what's your point?
    - mayank 16y ago
      I'm not sure what you're talking about. With "invisible" JS form validation of any sort: 1. you run your existing spambot software through phantomjs. 2. your unmodified bot fills in all the visible fields without changing a single line of code, and the webkit backend transparently computes your hashes and other automated javascript "human" tests. 3. again, your existing "stupid" spambot code submits your form, and your site is now overrun by spam. With Captcha, you get an image and a unique ID that is validated at the server. Sure, you could run it through mechanical turk, but I'm guessing that a few CPU cycles to load a webkit backend is still vastly cheaper than farming work out to MechTurk. My point is that you wouldn't even have to change your spambot software to defeat these "new" validations, and they can be trivially overcome, as opposed to MechTurk+reCaptcha. Add to that the benefits of targeting sites that are relatively spam-free, and you have a real incentive for spammers to simply plug-in phantomjs instead of using WWW::Mechanize or what have you.
      - roel_v 16y ago
        The point is that all these measure are 'trivial' to break, and so are captcha's. Except with captcha's you impose a burden on your user, and with other techniques you can offload that burden to the developer. I'm not sure what the 'existing' part in 'existing spambot' has to do with it - the time it would take to add farmed captcha solving is marginal (you don't even have to mech turk it - most captcha's are broken with OCR software readily available on the underground market anyway). captcha = sign of clueless or lazy, or both, developer. I don't put up with it anymore - I have yet to meet a single registration that I actually need that uses a captcha. I'm not the only one, either.
- gumbo 16y ago
  @mayank is right, when you get popularity you are EXPOSED, and every developer could be able to spam your système without that much effort. Captcha are Effective even if they are EVIL, anyhow i think that one day we'll find a viable solution again's spams.
nathanb 16y ago
Spammers make money off of volume. The more expensive it is to deploy each individual spam, the less money spammers make. Processing and running javascript, retrieving and inlining external CSS, and rendering HTML all take time. Writing custom bots also takes time. I think the goal is to make spammers lose the arms race simply because the payoff has become too small. If we can do that without CAPTCHAs, so much the better.

by mayank 16y ago

TamDenholm 16y ago

You can apply the same to CAPTCHA as well, its not hard to automate CAPTCHA input either. But the reality of the situation is that the vast majority of spam bots are simple and for every additional check you put into your form you increase the effectiveness by a magnitude.

mayank 16y ago
You can't do the same with captcha because that would require a degree of brute forcing. And my point was that existing spambots could trivially be upgraded to handle hidden form values and keystroke timers and other automated javascript validation.
- roel_v 16y ago
  Sure, they could be, and also to trivially solve captchas on mechanical turk, what's your point?
  - mayank 16y ago
    I'm not sure what you're talking about. With "invisible" JS form validation of any sort: 1. you run your existing spambot software through phantomjs. 2. your unmodified bot fills in all the visible fields without changing a single line of code, and the webkit backend transparently computes your hashes and other automated javascript "human" tests. 3. again, your existing "stupid" spambot code submits your form, and your site is now overrun by spam. With Captcha, you get an image and a unique ID that is validated at the server. Sure, you could run it through mechanical turk, but I'm guessing that a few CPU cycles to load a webkit backend is still vastly cheaper than farming work out to MechTurk. My point is that you wouldn't even have to change your spambot software to defeat these "new" validations, and they can be trivially overcome, as opposed to MechTurk+reCaptcha. Add to that the benefits of targeting sites that are relatively spam-free, and you have a real incentive for spammers to simply plug-in phantomjs instead of using WWW::Mechanize or what have you.
    - roel_v 16y ago
      The point is that all these measure are 'trivial' to break, and so are captcha's. Except with captcha's you impose a burden on your user, and with other techniques you can offload that burden to the developer. I'm not sure what the 'existing' part in 'existing spambot' has to do with it - the time it would take to add farmed captcha solving is marginal (you don't even have to mech turk it - most captcha's are broken with OCR software readily available on the underground market anyway). captcha = sign of clueless or lazy, or both, developer. I don't put up with it anymore - I have yet to meet a single registration that I actually need that uses a captcha. I'm not the only one, either.
gumbo 16y ago
@mayank is right, when you get popularity you are EXPOSED, and every developer could be able to spam your système without that much effort. Captcha are Effective even if they are EVIL, anyhow i think that one day we'll find a viable solution again's spams.

nathanb 16y ago

Spammers make money off of volume. The more expensive it is to deploy each individual spam, the less money spammers make. Processing and running javascript, retrieving and inlining external CSS, and rendering HTML all take time. Writing custom bots also takes time. I think the goal is to make spammers lose the arms race simply because the payoff has become too small. If we can do that without CAPTCHAs, so much the better.