Hacker News Reader

Comment by danielweber | Hacker News Reader

Yes, an afternoon of coding to be able to post spam on exactly one website. Until they change the captcha.

Unlikely but not impossible.

I've seen forums get flooded for no other apparent rationale than some random skiddie had nothing better to do for an hour or two than irritate the admins. It being not worth anyone's time to break isn't actually a feature, but it being relatively easy for anyone with time to waste on it is a flaw.

OP may have been suggesting it's not actually a CAPTCHA in the first place, under the understanding that CAPTCHAs are at least nominally supposed to target something computers are bad at.

Chess is even a particularly ironic implementation because it was one of the first traditionally human passtimes where computers excelled.

A site can have a CAPTCHA that's so bad it's not actually a CAPTCHA even if no one bothers to attack it. My hidden forum could require a user to sum one thousand integers before seeing any posts. I probably wouldn't attract any spammers (because no one would join to read their spam), but that doesn't mean the so-called CAPTCHA is beyond reproach.

Actually, the captcha predicate is a GET request that looks like this:

http://en.lichess.org/captcha/78pkfjgz?solution=e5+e4 which returns 1 or 0.

So the brute force captcha solution is to go through 8^4 (~4k) get requests, which you could code in five minutes and execute in a minute.

I would imagine it'd be fairly trivial to limit the number of requests.

So you are, literally, arguing for security by obscurity. "Oh, my captcha is unique, therefore nobody will bother".

There are easier to implement unique captchas, than chess.

I'd agree partially, but I'd comment that it's also security by diversity. If every site had a unique captcha solution requiring custom software for a defeat, the force multiplier effect of "write once, run everywhere" would be hugely diminished, and it would be much less cost effective to implement various types of spam. So, the particular security strategy here is indeed weak, but I would say that it might actually strike closer to the root of the problem than just making a really hard, but still universally applied, captcha technology.

You are not making any sense.

The economics of spam commenting makes sense if it can be done automatically at a massive scale. If only one or a very small number of "humanity tests" exist, then cracking those tests has a high payoff value. Having a huge number of different, ad-hoc authentication schemes would make developing automatic cracks unacceptably expensive for the actual level of benefit achieved by posting the spam comment. Therefore, being a site with a unique CAPTCHA system attacks the core value proposition of spam comments, which strikes the root of the issue.

Another way to look at it is like the entire collection of CAPTCHAs on the Internet is really just one big CAPTCHA library, which tests a subset of "human" abilities. The larger the subset, the more difficult it will be to circumvent. Relying on one or two special abilities makes it easier for a machine to emulate those behaviors and gain access. I hope that clarifies the point I was making.

Obscurity can be a great tool for security. But you have to understand its limitations, and expect at some point it will fail.

Custom captchas are probably a great use of this.

Reply on news.ycombinator.com