3 ms·
CAPTCHA is pain in the ass. In a project I am working on, I have two forms I needed to protect - sign up and sign in. Sign up form does not do anything beside s
by hknmtt 3y ago
CAPTCHA is pain in the ass. In a project I am working on, I have two forms I needed to protect - sign up and sign in. Sign up form does not do anything beside storing credentials in cache and waits for confirmation email link to be used. Sign in form uses various authentication methods but resource-wise, it will load user object and compare data at most. I decided to not use any captcha and let rate limiting do the heavy lifting if I get caught in some bot's eye. There really is no need for captcha because you can rate limit any page or form and once bot passes the threshold, nothing can happen since it is not a real user. All this captcha usage are remnants from a decade ago when all was new on the internet. But today, it's entirely archaic concept and serves only to mine personal data, just like all those "free" CDNs and fonts and whatnot that bigtech uses to literally map the entire internet.
- zigzag312 3y agoA few years ago I had a newsletter subscription form where one day some bot started subscribing with real email addresses. These real users started marking confirmation email as spam, which in turn affected domain reputation. I don't remember anymore if it used proxies with different IPs or not, but I added CAPTCHA fix this ... CAPTCHA for newsletter subscription...
- thenickdude 3y agoSame experience here, and I'm still baffled as to why they're doing this, do you have any guesses?
- zigzag312 3y agoI have no idea
- hknmtt 3y agothey could get you on the blacklist of the bigtech and then your emails might have hard time being delivered at all
- semi 3y agoDoSing the users they are signing up would be my guess. Many sites do not even do a validation step and will immediately add any submitted email to the mailing list. Your email box is then filled with tons of emails and manually unsubscribing takes a lot of effort and still only reduces the volume of incoming emails This could just be used on its own as a way to annoy someone. Or it could be used to try to hide some legitimate email that you will receive, like if they are compromising your account somewhere that will notify you of the new login and hope you don't notice in the sea of spam.
- johncolanduoni 3y agoRate limits are not going to help if you get targeted by somebody halfway serious. They’ll have plenty of nice residential IP addresses to bypass your rate limiting with.
- hknmtt 3y agoif i allow one sign up/in request per ip per second, i have no fear of bots. i could implement additional "rate limit" per ip per request if i needed and ban ips if they exceed it manually. it's very easy to do. humans don't send more than one request per handler per second anyway.
- ric2b 3y agoSo in 1 day you'll let a single IP create 86400 users. How many IP's do would think would be needed to create 10x your current user base in a single day? 100? 1000?
- hknmtt 3y agoif you keep taking all you red on the internet literally, without applying a grain of your own thinking, you won't maker it far in life.
- stavros 3y agoI feel like this comment is saying "you don't need a CAPTCHA for cheap operations", which, yes, we all know. What about expensive operations?
- hknmtt 3y agoi'd say figure out a way to make it cheap. don't be afraid to rework your backend.
- stavros 3y agoThat's a lot of assuming that everyone who uses CAPTCHA is too incompetent to fix their problems any other way.
- hknmtt 3y agoi never said anything even close to that. your mind works in mysterious ways.
- stavros 3y agoYou definitely didn't say that, that's true. What do you think is the reason that a company might choose to deploy a CAPTCHA and alienate a percentage of their users, rather than make their backend run more efficiently?