Hacker News Reader

Comment by ermac | Hacker News Reader

Your concern is somewhat valid although if someone is making 30 plus attempts to submit a form can we not assume it is a bot? We have made a configuration interface to allow users to increase the number of possible response photos if they are security paranoid.

View on HN

You are missing the way people break captchas... it is not because they have super cool software that can read the captcha, have a huge database of hashed portions of a particular captcha softwares library or make blind random attempts that would set off any simple limits ( although some have 1 and 2 ) it is because they build technology that sends the webpage to an outsourcing house that performs the actions remotely. I know of one with 200 FT employees each shift ( 24 / 7 ) that solve on average 4 per minute per employee.

I'd probably use just use Tor or similar to make all requests come from different IPs. You don't need to increase the number of pictures by a couple, you need to increase the number of possibilities by several orders of magnitude.

A traditional captcha with 6 letters/numbers has 2,176,782,336 possible combinations. Not 36. The whole point of a captcha is that there is a large enough set of possibilities such that you can't just get it right by guessing randomly a few times.

If someone is making 30+ requests from distinct ip addresses in their botnet, you won't even suspect they're related.

Reply on news.ycombinator.com