4 ms·

Good article. We need more of these. GDPR and integrating with 3rd party services can be quite a legal minefield. I would like to see an article regarding Goog

Good article. We need more of these. GDPR and integrating with 3rd party services can be quite a legal minefield. I would like to see an article regarding Google Recaptcha. I am currently considering Recaptcha during a login process as a means of protecting against credential stuffing and password brute forcing. But I do not know if this counts as "legitimate interest" as defined by GDPR. And if it doesn't, there really isn't any way to ask for consent in this case, because "denying" consent sidesteps the entire security measure...

zeepzeep 5y ago
> I am currently considering Recaptcha during a login process Please don't, think about your users. Just use normal rate limiting instead of forcing me to select more god damn street signs.
- Spivak 5y ago
  That makes no sense, one is not a replacement for the other. Spam bots can be slow, and human users can hammer your API. You need both.
  - zeepzeep 5y ago
    You don't. If you want to prevent credential stuffing rate limiting is perfectly fine and that was the only reason EtienneK wanted to use captchas. Spam bots can be slow yes, but this is about credential stuffing, that can not be done slowly or else it'd take years.
    - Spivak 5y ago
      Rate limiting doesn't protect against credential stuffing either -- it doesn't manifest as a brute-force attack, they rarely originate from a single ip/network you could reasonably rate limit against, and even if you could magically rate limit them you've already lost because you let the bots try their stolen credentials in the first place. Your only real defense is to have a system that identifies bots directly to make it so attackers can't automate spamming credentials across a bunch of different sites. If you let attackers have like 10 attempts per ip per minute and you're a site where a bunch of people have accounts then you're gonna become an instant favorite for testing stolen creds.
      - zeepzeep 5y ago
        I just buy captcha solvers in india or use a bypass like the Recaptcha Text to Speech challenge that regulary gets abused by extensions like Buster. (Yes, you can use google speech to text to solve the text to speech captchas.) Captchas don't really work, the only things they do is let google track more people and annoy humans. You let your users train their AI for little to no protection agains a willing attacker. I'll admit captchas protect against many scriptkiddies that buy passwords. I'd rather teach my users to use a password manager or support passwordless login than let them click on cars for "security".

zeepzeep 5y ago

> I am currently considering Recaptcha during a login process Please don't, think about your users. Just use normal rate limiting instead of forcing me to select more god damn street signs.

Spivak 5y ago
That makes no sense, one is not a replacement for the other. Spam bots can be slow, and human users can hammer your API. You need both.
- zeepzeep 5y ago
  You don't. If you want to prevent credential stuffing rate limiting is perfectly fine and that was the only reason EtienneK wanted to use captchas. Spam bots can be slow yes, but this is about credential stuffing, that can not be done slowly or else it'd take years.
  - Spivak 5y ago
    Rate limiting doesn't protect against credential stuffing either -- it doesn't manifest as a brute-force attack, they rarely originate from a single ip/network you could reasonably rate limit against, and even if you could magically rate limit them you've already lost because you let the bots try their stolen credentials in the first place. Your only real defense is to have a system that identifies bots directly to make it so attackers can't automate spamming credentials across a bunch of different sites. If you let attackers have like 10 attempts per ip per minute and you're a site where a bunch of people have accounts then you're gonna become an instant favorite for testing stolen creds.
    - zeepzeep 5y ago
      I just buy captcha solvers in india or use a bypass like the Recaptcha Text to Speech challenge that regulary gets abused by extensions like Buster. (Yes, you can use google speech to text to solve the text to speech captchas.) Captchas don't really work, the only things they do is let google track more people and annoy humans. You let your users train their AI for little to no protection agains a willing attacker. I'll admit captchas protect against many scriptkiddies that buy passwords. I'd rather teach my users to use a password manager or support passwordless login than let them click on cars for "security".