Hacker News Reader

Comment by alexyim | Hacker News Reader

This (and other creative implementations) works because it's not mainstream. I'd imagine once it becomes big, spammers will find a way to defeat it.

As far as I know, different CAPTCHAs have different degrees of effectiveness. Google's is among one of the best.

View on HN

Also, if you wanted to particularly target that site's slider for spamming, it isn't hard to do.

"Although a checkbox "check here if you are not a bot" might serve to distinguish between humans and computers, it is not a CAPTCHA because it relies on the fact that an attacker has not spent effort to break that specific form. (Such 'check here' methods are very easy to defeat.) Instead, CAPTCHAs rely on difficult problems in artificial intelligence. In the short term, this has the benefit of distinguishing humans from computers. In the long term, it creates an incentive to advance the state of AI, which the originators of the term view as a benefit in its own right."

(from wikipedia)

Does a question like "If George Washington had 20 white horses, how many grizzly bears did he own?" count? I always like those kind the best.

The answer to that type of question is always zero (or unanswerable with the given information). It's cute, but ineffective.

That type of thing would probably wind up being way too limited. It has to be generated and checked by a computer so it's going to tend towards a pattern and not be arbitrary enough. And as you make it more convoluted you're probably going to piss off the users more than slow down spammers.

Am I alone in finding Google's CAPTCHAs unreadable a good 25-50% of the time?

You may already be a robot. And me, too -- I'm sometimes stumped by the Google CAPTCHAs.

I find it is much more than that for me, like 75 percent. And for my parents it is pretty much 100% which is extremely annoying.

Yeah I should've clarified, Google's CAPTCHAs is one of the best at keeping bots out (and humans too if necessary)

Nope, usually takes me 3 tries.

I'm not sure it will work at all. Bots don't trigger the submit event by clicking a button. They do so by scripted form submission, so if the slider is tied to a simple submit event, it's pointless.

How can you submit a form that has no URL to submit to?

I haven't tried circumventing their form, and maybe they didn't do this, but the basic idea is to store the submission URL in javascript, and assign it to the form only on the slider event.

All that matters is what goes over the wire. The UI doesn't matter. If the data sent has no dynamic component (i.e. the text of a random word-image), then it can be replayed with different inputs.

surely spammers have javascript-enabled spambots by now. i'm sure some of them embed an actual webkit/mozilla/ie rendering engine and just script the interface.

hell, a regular firefox browser with images disabled (for speed) and the selenium plugin installed could probably accomplish a high rate of automated spamming.

The script just sets a hidden input field to a "magic" value once you've moved the slider all the way. If you can write a trivial regexp, you can circumvent their "captcha".

You guys are misunderstanding me, I was referring to bots that autofill any form they come across on hundreds/thousands of sites, not about preventing a direct attack against this site. If someone wrote a bot specific to this site, yes, they'd easily get by it of course.

If the slider is a true input, all you need to do is validate that input and reject any submissions with the wrong value.

Reply on news.ycombinator.com