Hacker News Reader

Comment by inbx0 | Hacker News Reader

The most common use case for CAPTCHAs is to prevent or reduce automated spam bots that crawl around the web looking for input fields to fill. For that purpose, the CAPTCHA doesn't have to be perfect, just better than what some other sites have (i.e. no CAPTCHA at all) so that it's not worth it to spend time breaking into your input fields specifically when there's easier targets.

I'm not aware of any CAPTCHA solution that would protect you from actual targeted attacks where the attacker is determined to spend time on breaking your protection specifically.

View on HN

> I'm not aware of any CAPTCHA solution that would protect you from actual targeted attacks

but that's the entire point of reCaptcha/hCaptcha/every CAPTCHA-as-a-service provider, because they provide good enough security that most websites can use it—if they could be broken, we'd likely see many more attacks that can successfully solve it, rather than services in low-income areas that offer to have real humans solve the problems for payment.

> if they could be broken, we'd likely see many more attacks that can successfully solve it

I've used buster for years, it's free and open source, one click to solve: https://github.com/dessant/buster

So it's captcha through obscurity?

Yes. It works. Low-visibility sites can get a lot of mileage out of "Type 'x' in this box:" levels of CAPTCHA.

I ran a little wiki with just a few thousand users, and thought like you... I put a "please type the color of our universities logo into this box:" captcha...

Yet somehow the spammers still flooded in... They must have used a human to solve it the first time, and then automation to make thousands more user accounts and pages.

It surprised me anyone would bother for such a small low impact site.

Same experience, for a wiki and forum with less than a dozen users. When I changed the questions I had some peace for a couple of days, then started flooding again.

Had the opposite experience - was running a wordpress site and picked up a lesser known anti-spam plugin. AFAIK the only thing it did was run a tiny bit of obfuscated js to fill an invisible field. Never had a single spam comment again for over 6 years (sorry for no-js users tho).

_edit_

Just looked it up - it actually used to have a no-js backup and still worked wonders. Sadly seems it has turned into bloatware since I last used it, but the FAQ goes into detail how it works.

https://wordpress.org/plugins/anti-spam/

Basically 1. extra field that you have to enter the current year (hidden and filled by js for most users) and 2. extra hidden url and email fields that bots tend to autofill.

You'll note my phrasing was "can get a lot of mileage out of" and not "never need anything more than"; that was for a reason. If you pick up a particular spammer, with the toolset they have, who either has a personal reason to attack you, or who notices that you have a lot more Google juice than you realize, or even just misidentifies you as a large site for whatever reason, obviously they'll blow right through something as trivial as this. It is far from solid protection.

However, it does quite often work for extended periods of time, and for someone running a small site, it's worth it to try this out before going to something crazier because there's a decent chance it'll work. There are sites I frequent where such simple things have been working for years. It's so easy, that if it doesn't work, there isn't much time wasted. Very good bang for the buck, even if it is not even remotely a guaranteed solution for everybody.

I've always been partial to a seemingly normal form field for data I don't need or want (e.g. id="name") that is visually hidden with CSS. Dumb bots will fill the field but humans won't.

Typing in a box is still much faster than dragging around chess pieces though. And it can be pretty decent with e.g. some very trivial but text-based math questions.

But I can assure you if a site wants me to start solving chess puzzles I'm out of there. It's basically a less secure but much more cumbersome approach than Google's usual "click on all traffic lights" captcha.

Reply on news.ycombinator.com