3 ms·
I did something unpopular and just didn't have a captcha, I just read up on creepjs etc and rolled out my own which is just browser state analysis, basic ip che
by himata4113 6mo ago
I did something unpopular and just didn't have a captcha, I just read up on creepjs etc and rolled out my own which is just browser state analysis, basic ip check (abuse lists only) and PoW. Haven't had an issue with a single bot registration (yet).
- grishka 6mo agoA simple captcha with distorted characters + some hidden form fields would stop every single "opportunistic" bot. There's hardly anything you can do to stop someone determined enough to spend money to spam your specific website. These kinds of captchas do raise the bar somewhat, but every single one of them is ultimately bypassed by paying people to solve them for you.
- himata4113 6mo agoI rotate structures every request I made it explicitely hard to automate and I just raise the PoW during attacks. It's always about reducing volume rather than preventing it and a million registrations later it's still holding strong. bots get pruned after an hour since 100% of the bots fall into the same trap, giving it a delay makes A/B testing really difficult and breaks most AI strategies.
- alok-g 6mo agoCool! I would like to hear more about this, and understand how to do the same.
- himata4113 6mo agohttps://abrahamjuliot.github.io/creepjs/ https://abrahamjuliot.github.io/creepjs/ took this and made it PoW
- deleted 6mo ago[deleted]