4 ms·

The most common use case for CAPTCHAs is to prevent or reduce automated spam bots that crawl around the web looking for input fields to fill. For that purpose,

by inbx0 6y ago

The most common use case for CAPTCHAs is to prevent or reduce automated spam bots that crawl around the web looking for input fields to fill. For that purpose, the CAPTCHA doesn't have to be perfect, just better than what some other sites have (i.e. no CAPTCHA at all) so that it's not worth it to spend time breaking into your input fields specifically when there's easier targets. I'm not aware of any CAPTCHA solution that would protect you from actual targeted attacks where the attacker is determined to spend time on breaking your protection specifically.

Gunax 6y ago
So it's captcha through obscurity?
- jerf 6y ago
  Yes. It works. Low-visibility sites can get a lot of mileage out of "Type 'x' in this box:" levels of CAPTCHA.
  - londons_explore 6y ago
    I ran a little wiki with just a few thousand users, and thought like you... I put a "please type the color of our universities logo into this box:" captcha... Yet somehow the spammers still flooded in... They must have used a human to solve it the first time, and then automation to make thousands more user accounts and pages. It surprised me anyone would bother for such a small low impact site.
    - progval 6y ago
      Same experience, for a wiki and forum with less than a dozen users. When I changed the questions I had some peace for a couple of days, then started flooding again.
      - kuroguro 6y ago
        Had the opposite experience - was running a wordpress site and picked up a lesser known anti-spam plugin. AFAIK the only thing it did was run a tiny bit of obfuscated js to fill an invisible field. Never had a single spam comment again for over 6 years (sorry for no-js users tho). _edit_ Just looked it up - it actually used to have a no-js backup and still worked wonders. Sadly seems it has turned into bloatware since I last used it, but the FAQ goes into detail how it works. https://wordpress.org/plugins/anti-spam/ https://wordpress.org/plugins/anti-spam/ Basically 1. extra field that you have to enter the current year (hidden and filled by js for most users) and 2. extra hidden url and email fields that bots tend to autofill.
    - jerf 6y ago
      You'll note my phrasing was "can get a lot of mileage out of" and not "never need anything more than"; that was for a reason. If you pick up a particular spammer, with the toolset they have, who either has a personal reason to attack you, or who notices that you have a lot more Google juice than you realize, or even just misidentifies you as a large site for whatever reason, obviously they'll blow right through something as trivial as this. It is far from solid protection. However, it does quite often work for extended periods of time, and for someone running a small site, it's worth it to try this out before going to something crazier because there's a decent chance it'll work. There are sites I frequent where such simple things have been working for years. It's so easy, that if it doesn't work, there isn't much time wasted. Very good bang for the buck, even if it is not even remotely a guaranteed solution for everybody.
  - sli 6y ago
    I've always been partial to a seemingly normal form field for data I don't need or want (e.g. id="name") that is visually hidden with CSS. Dumb bots will fill the field but humans won't.
  - alpaca128 6y ago
    Typing in a box is still much faster than dragging around chess pieces though. And it can be pretty decent with e.g. some very trivial but text-based math questions. But I can assure you if a site wants me to start solving chess puzzles I'm out of there. It's basically a less secure but much more cumbersome approach than Google's usual "click on all traffic lights" captcha.
lights0123 6y ago
> I'm not aware of any CAPTCHA solution that would protect you from actual targeted attacks but that's the entire point of reCaptcha/hCaptcha/every CAPTCHA-as-a-service provider, because they provide good enough security that most websites can use it—if they could be broken, we'd likely see many more attacks that can successfully solve it, rather than services in low-income areas that offer to have real humans solve the problems for payment.
- inquirerofsorts 6y ago
  > if they could be broken, we'd likely see many more attacks that can successfully solve it I've used buster for years, it's free and open source, one click to solve: https://github.com/dessant/buster https://github.com/dessant/buster

by inbx0 6y ago

Gunax 6y ago

So it's captcha through obscurity?

jerf 6y ago
Yes. It works. Low-visibility sites can get a lot of mileage out of "Type 'x' in this box:" levels of CAPTCHA.
- londons_explore 6y ago
  I ran a little wiki with just a few thousand users, and thought like you... I put a "please type the color of our universities logo into this box:" captcha... Yet somehow the spammers still flooded in... They must have used a human to solve it the first time, and then automation to make thousands more user accounts and pages. It surprised me anyone would bother for such a small low impact site.
  - progval 6y ago
    Same experience, for a wiki and forum with less than a dozen users. When I changed the questions I had some peace for a couple of days, then started flooding again.
    - kuroguro 6y ago
      Had the opposite experience - was running a wordpress site and picked up a lesser known anti-spam plugin. AFAIK the only thing it did was run a tiny bit of obfuscated js to fill an invisible field. Never had a single spam comment again for over 6 years (sorry for no-js users tho). _edit_ Just looked it up - it actually used to have a no-js backup and still worked wonders. Sadly seems it has turned into bloatware since I last used it, but the FAQ goes into detail how it works. https://wordpress.org/plugins/anti-spam/ https://wordpress.org/plugins/anti-spam/ Basically 1. extra field that you have to enter the current year (hidden and filled by js for most users) and 2. extra hidden url and email fields that bots tend to autofill.
  - jerf 6y ago
    You'll note my phrasing was "can get a lot of mileage out of" and not "never need anything more than"; that was for a reason. If you pick up a particular spammer, with the toolset they have, who either has a personal reason to attack you, or who notices that you have a lot more Google juice than you realize, or even just misidentifies you as a large site for whatever reason, obviously they'll blow right through something as trivial as this. It is far from solid protection. However, it does quite often work for extended periods of time, and for someone running a small site, it's worth it to try this out before going to something crazier because there's a decent chance it'll work. There are sites I frequent where such simple things have been working for years. It's so easy, that if it doesn't work, there isn't much time wasted. Very good bang for the buck, even if it is not even remotely a guaranteed solution for everybody.
- sli 6y ago
  I've always been partial to a seemingly normal form field for data I don't need or want (e.g. id="name") that is visually hidden with CSS. Dumb bots will fill the field but humans won't.
- alpaca128 6y ago
  Typing in a box is still much faster than dragging around chess pieces though. And it can be pretty decent with e.g. some very trivial but text-based math questions. But I can assure you if a site wants me to start solving chess puzzles I'm out of there. It's basically a less secure but much more cumbersome approach than Google's usual "click on all traffic lights" captcha.

lights0123 6y ago

> I'm not aware of any CAPTCHA solution that would protect you from actual targeted attacks but that's the entire point of reCaptcha/hCaptcha/every CAPTCHA-as-a-service provider, because they provide good enough security that most websites can use it—if they could be broken, we'd likely see many more attacks that can successfully solve it, rather than services in low-income areas that offer to have real humans solve the problems for payment.

inquirerofsorts 6y ago
> if they could be broken, we'd likely see many more attacks that can successfully solve it I've used buster for years, it's free and open source, one click to solve: https://github.com/dessant/buster https://github.com/dessant/buster