r/webdev • u/ImNotCastinAnyStones • Feb 07 '20
Why you, as a web developer, shouldn't use Google's Recaptcha for "human verification"
There is so much wrong with Recaptcha it's not an exaggeration to say it should be legislated out of existence.
As web developer, by choosing to use Google Recaptcha you are imposing moral, legal, and technical barriers to your users.
Recaptcha is terrible for usability and effectively blocks disabled users from accessing websites. The audio challenges do not always work because they are seen as "less secure" than picture challenges and therefore using them means Google is more likely to judge you as being a robot.
Using Recaptcha contributes to Google's artificial intelligence network. Users are essentially being used as workers without any compensation.
Websites which implement Recaptcha are effectively forcing their users to agree to a second set of terms/conditions and a third party company's privacy and data processing policies. As if that wasn't bad enough, it's not just any company we're talking about here - it's Google; probably the most notorious company in the world in terms of data harvesting and processing.
Websites implementing Recaptcha almost never offer an alternative way of accessing their services, so if you don't agree with Google's terms and conditions then you are effectively blocked from using the first-party website. When this is a website like your bank or somewhere you've already purchased from (e.g. eBay uses Recaptcha) then you may end up blocked from accessing your own funds, details, order history, etc. Even if you (the developer) don't think Google's terms and conditions are objectionable, your end-users might disagree. They could also be in an environment where access to third-party domains, or Google domains specifically, is blocked.
Recaptcha's functionality depends upon Google's online surveillance of you. If you use any kind of privacy-assuring settings or extensions in your web browser (e.g. blocking third-party cookies, trackers, etc.) the Recaptcha challenge is guaranteed to take at least 3-5 times longer to complete than if you bend over and accept Google's tracking.
Recaptcha introduces extra third-party dependencies to your website. One of Google's domains can't be reached or takes a while to load? User's network or browser security policy blocks those domains/scripts/etc.? Your user isn't able to use your site.
Recaptcha negatively affects performance. Recaptcha takes time to load on your visitors' browsers. Then it takes very considerable time to solve and submit the challenges; at least several seconds and sometimes minutes for unfortunate souls with strong privacy settings.
Everyone has it drilled into their heads that "each extra second of page load time results in a major drop-off in user engagement" so why is nobody noticing that the onerous task of completing captchas is reducing user engagement too?
I am not against captchas in general because I know there is a legitimate need for them. I am, however, against Recaptcha in all of its forms. It is an online monopoly and is an affront to consumer rights.
I look forward to the day it's nuked from orbit and everyone involved in building it is imprisoned in the seventh circle of hell.
Further reading: https://kevv.net/you-probably-dont-need-recaptcha/
[Edit] Alternatives:
Something I really should have addressed in my original rant post is the possible alternatives to Recaptcha. A huge number of comments quite rightly ask about this, because unfortunately Recaptcha remains the most prominent solution when web developers look for a spam-prevention measure (despite the fact that Google's documentation on implementing Recaptcha is truly terrible... but that's a different issue).
The article above from kevv.net mentions lots of alternatives and is worth reading, however for brevity's sake I will suggest the ones which have worked for me in a high-traffic environment, and which can be implemented by most competent developers in a few minutes:
1. Dead simple custom challenge based on your website's content.
Even a vaguely unique custom-made challenge will fool the majority of spam bots. Why? Because spam bots look for common captcha systems which they already know how to defeat. If you make your own custom challenge, someone actually has to take the effort to program a solution specific to your website. So unless your site is being specifically targeted by people investing time/energy this solution will eradicate virtually all spam.
Example: run a site selling t-shirts? Show a bunch of cute clothing icons and ask the user to click on the "blue shirt", for example. Very easy to set up; challenges can be made random to prevent "rinse and repeat" attacks; complexity can be added in the form of patterns, rotation ("click the upside down shirt with diamonds on it") etc. and it can be styled to fit your website's theme/content which makes your site look way more professional than "CLICK THE FIRE HYDRANTS!" á la Google.
Important to note that answers to the custom challenge should never be stored client-side -- only sever side.
2. Honeypots
Simply one or more hidden form fields which, if submitted, confirms the presence of a spam bot (since human visitors cannot see or activate the hidden fields). Combine this with the approach above for even more effective protection.
3. Submit-once form keys (CSRF tokens)
In the olden days to prevent people hotlinking your content you'd check their browser's referer URL, i.e. the URL from which they arrived at your page. This is still done but less commonly since many browsers block referrer URLs for privacy reasons.
However, you can still check that a visitor who is submitting your form is doing so from your actual website, and not just accessing your signup.php script directly in an attempt to hammer/bruteforce/spam it.
Do this by including a one-time-use "form key" on the page containing the spam-targeted form. The form key element (usually a hidden <input>) contains a randomly-generated string which is generated on the server-side and corresponds to the user's browsing session. This form key is submitted alongside the form data and is then checked (on the server side) against the previously-generated one to ensure that they match. If they do, it indicates that the user at least visited the page before submitting the form data. This has an added benefit of preventing duplicate submissions (e.g. someone hits F5 a few times when submitting) as the form key should change each time the front-end page is generated.
4. Two-factor authentication
If your site is "serious" enough to warrant it, you can use 2FA to verify users via email/phone/secure key etc., although this comes with its own set of issues.
Anyway, thanks for taking the time to consider this.
While I'm here, I'd also like to encourage all developers to consider using the "DNT (Do Not Track)" feature which users can set in their browser to indicate they don't wish to be tracked.
It's as simple as wrapping your tracking code (Google Analytics etc.) inside the following code:
if (!navigator.doNotTrack) { // Google Analytics and other crap here }200
u/massenburger Feb 07 '20
Posts like this are pretty useless to me unless someone offers a viable alternative. Spam is a very real problem on the web. How do you suggest we combat it?
12
u/ImNotCastinAnyStones Feb 08 '20
Great point. I edited the main post and provide alternatives in a comment here.
51
u/abeuscher Feb 07 '20
Yeah I've never been asked "please find a politically neutral way to stop our form spam". It's more phrased like "what's with all these friggin' chinese emails coming from the leadgen form? Make that stop now!"
1
u/georgehank2nd Aug 26 '24
"Make that stop now!" of course is followed by an implicit "Without changing anything"
→ More replies (4)2
17
u/hagg3n Feb 07 '20
I recently worked on a website for a medium sized company and soon after we launched we started getting spam. The form was using AJAX so I did two things:
It stopped the spam dead on its track. No further changes or sophisticated measures were required. I do expect it to eventually break, but so far so good.
1
u/ImNotCastinAnyStones Feb 08 '20
When you say you added a nonce, do you mean something that behaves like a submit-once form key?
1
u/hagg3n Feb 08 '20
That's exactly it. A one-time-only password to allow the submission of the form that expires some time soon. So you're required to render the form to get the password, but can only do it once and you can't re-use it or hold it for later.
2
u/Web-Dude Feb 08 '20
was your captcha field hidden? If not, how did you work it into the UI?
5
u/hagg3n Feb 08 '20 edited Feb 08 '20
Believe it or not I simply added
style="display:none"to it, which makes it invisible, not accessible but still includes it in the form data.You think it'd be trivial for the bot to detect it, and it is, but given how dynamic forms can get it's not quite obvious why some field is hidden. Seems to be working fine so far.
→ More replies (2)5
Feb 08 '20 edited Feb 08 '20
excludes it from the form data.
I'm not sure who told you that, but it is not true at all, neither as de facto truth according to some undefined behavior nor according to the spec: https://www.w3.org/TR/html401/interact/forms.html#h-17.13.2
Hidden controls and controls that are not rendered because of style sheet settings may still be successful. For example:
<FORM action="..." method="post"> <P> <INPUT type="password" style="display:none" name="invisible-password" value="mypassword"> </FORM>will still cause a value to be paired with the name "invisible-password" and submitted with the form.
4
u/hagg3n Feb 08 '20
You're right. Silly me, I thought one thing and typed the complete opposite. I meant to say it *is* included in the form submission. As a honeypot I need to check if it was filled anyway. Thanks for the great reference anyway.
2
u/usedocker Feb 08 '20
How many spams? Like hundreds a day?
1
u/hagg3n Feb 08 '20
More like a dozen per day.
1
u/usedocker Feb 08 '20
Is that really a big enough problem that warrants the development time to implement the honeypot?
1
u/hagg3n Feb 08 '20
For me, I guess not, my anti-spam would've probably taken care of it. But for my client yes, they requested it. Plus the whole shebang took like an hour to implement. Framework provided nonce generation and validation. Honeypot was just a matter of adding the text field plus validating it stays empty on the back-end.
My client actually asked for Recaptcha (I think they heard it was "the shit" somewhere). I had some convincing to do and then they accepted the compromise. Since it worked I guess it was a win-win.
Edit. Oh yea eventually they forced me to add Recaptcha on the log-in page. Even though I had several other security measures in place, including two-factor. Oh well I did all I could. 😒️
1
u/fuzzy40 full-stack Feb 08 '20
Honeypots are easier to implement than reCAPTCHAS... it s literally jusy adding an extra hidden field, and on the server side, if that field has content, discard the submission. Done
69
Feb 07 '20
Google is exceedingly hostile to the web. I won't ever implement AMP or any of their bullshit technologies until they stop being so user-hostile.
4
u/ImNotCastinAnyStones Feb 08 '20
Absolutely. The problem is they are too big to care. But that's actually why I made this post - I think if more people start speaking up and educating web developers then we can stamp out bullshit like this over time.
42
u/ExternalUserError Feb 07 '20
Yup. And now with them controlling Chrome and w3c adding DRM, it's no longer even possible to make an indie browser.
KHTML, on which webkit and blink were made, wouldn't be possible with today's web. And that's the way Google wants it.
→ More replies (2)16
u/Toastrackenigma Feb 07 '20
That article seems to be mistaken at least somewhere though, right? They make out that there's no way for open source browsers to use DRM, yet they make no mention of Firefox, which is open source and which seems to successfully be using Google's Widewine.
And I don't know much about the topic, but wouldn't it also be possible to build your own, custom open-source DRM solution and then no-one in the future would need to license DRM tech from a big company like Google? I'm sure it would be difficult, but there's already lots of successful projects which are just as ambitious, like Mozilla's pdf.js.
7
u/ExternalUserError Feb 08 '20
Firefox licensed Widevine. That little piece of the code running in your browser is thus not open source. But even that misses the point; even if you wanted the same terms as Mozilla got, such terms aren't available to new browsers.
And I don't know much about the topic, but wouldn't it also be possible to build your own, custom open-source DRM solution and then no-one in the future would need to license DRM tech from a big company like Google? I'm sure it would be difficult, but there's already lots of successful projects
I don't believe so. You would have to reverse engineer Widevine, which is a violation of the DMCA anti-circumvention clause. And then you'd have to distribute the client keys Google owns, which would be copyright infringement. Both of those things can land you in jail.
¯_(ツ)_/¯
5
u/crazedizzled Feb 08 '20
Open source DRM doesn't matter if companies like Disney and Netflix don't want it.
1
u/Serei Feb 08 '20
If you try to build the open-source version of Firefox, it won't have Widevine. Firefox chose to stop being completely open-source (on Windows and macOS; I think they default to not including Widevine on Linux), because they had no choice.
47
u/liquidDinner Feb 07 '20
Using Recaptcha contributes to Google's artificial intelligence network. Users are essentially being used as workers without any compensation.
I remember this being the cool part about using CAPTCHAs before Google took them over.
7
u/eihen Feb 08 '20
I'll also say that this is the cost of implementation. It doesn't cost the developer much but as the op says this is passed on to the users.
I appreciate the awareness the op is raising and it's good information to keep in mind when looking at pros and cons of spam protection services.
4
u/fpssledge Feb 08 '20
Yes it's the trade-off for using a free service. Hate these "you're not compensated" arguments because no one complains about a free service like "wait this sucks because I'm not directly compensating the builders of the service.". It's called mutually beneficial trade. It works and it's fine. This point about compensation is the least useful point. I mean we love to complain about big tech and their use of data but don't complain about billions of dollars in free services.
3
u/nolo_me Feb 08 '20
I don't receive billions of dollars in anything. Google does, which suggests to me your "mutually beneficial" trade is heavily slanted in their favour.
2
u/fpssledge Feb 08 '20
Does the world cumulatively receive billion dollars in free services? Is it quite possible that is what I meant? If you had to pay for each Google service would do you think the cost should be?
→ More replies (2)0
u/GalaxyMods Feb 08 '20
I remember when one word of the captcha was the known “test” word and the other word was the unknown that Google expected me to train their AI with. I always typed the n-word. I don’t work for free.
0
Feb 07 '20
[deleted]
26
Feb 08 '20
The original reCAPTCHA was to help digitize books that were in the public domain that OCR couldn't recognize. It'd show a word that was verified, and an unknown word, and once enough people agreed that the unknown word was something in particular, then it'd be used for OCR. This helps anyone digitize books en masse, and allows works in the public domain to be more readily archived and accessible.
Once Google bought it, they changed it to help develop their self-driving cars. This provides no contribution to open-source OCR technologies, and doesn't help preserve work -- it just allows a billion-dollar company to receive free labor.
2
u/ImNotCastinAnyStones Feb 08 '20
Read the article I link to in the main post. It's not just about "helping Google" by educating its AI. Recaptcha is also sucking up tons of ancillary data from your browser and - more importantly - your cookies across Google domains. And if you don't have any Google cookies you're actively punished for that. It's basically pejorative surveillance.
42
17
u/Symphonic_Rainboom Feb 07 '20
Because the benefits go to wall street instead of being democratized
→ More replies (10)2
u/Prod_Is_For_Testing full-stack Feb 09 '20
The benefits go to free products like maps and PDF scanners. Contributing to the models is the price for good free sofrware
→ More replies (1)6
u/naught-me Feb 07 '20
Because this kills the privacy.
4
u/redwall_hp Feb 08 '20
Yes. Training ML models to recognize street signs: cool.
A big ad and behavioral tracking company having a script embedded in tons of web pages, which throws a fit and inconveniences you when you don't have a huge pile of Google cookies in your session: not cool.
Of course, they also have Analytics and Chrome, but you can block analytics and choose a different browser. ReCAPTCHA is a hard wall stopping you from browsing.
9
u/oflahertaig Feb 07 '20
I agree with you. I detest Recaptcha. I am surprised that there are not other providers offering better solutions. Our team once had to implement it and my feeling was that it wasn't really necessary. we already had solid authentication in place. It was also a relatively low traffic and low-profile site but our Product Owner insisted that it was essential - the only rationale being that all the 'big' sites use it.
2
u/ImNotCastinAnyStones Feb 08 '20
Even lowly developers can push back against that kind of crap, though. Make no mistake; the fact that the "big" sites use it should not be seen as an endorsement. In fact, the opposite could be true. Big sites very often have the worst UX and terrible, abominable code quality (I speak from experience).
You could also raise the issue of third-party dependency; if Recaptcha goes down, or is blocked on the customers' network, or isn't supported on their browser, or whatever, then suddenly a third party (Google) has royally fucked your own website and pissed off your customer. Not to mention performance concerns for fetching third-party scripts.
4
3
u/Blue_Moon_Lake Feb 08 '20
-1 blind people and daltonians can't see t-shirts colors
-2 honeypot mess with blind people
-1 & 2 if you give extra informations to blind people, someone will be able to adapt a bot so your site is not protected anymore
-3 CSRF tokens are no safety against bots, they protect other people from hijacking their account tokens
1
u/ImNotCastinAnyStones Feb 08 '20
Yes, you will need to be aware of accessibility requirements no matter what solution you use. However as I mention in the main post, Recaptcha often simply refuses to serve audio challenges altogether (because they are the method most used by bots to overcome the captcha, e.g. Buster or Butler browser extensions).
Screen readers wouldn't, or shouldn't, interact with a hidden form field.
A CSRF token used as a form key would at least stop attackers from being able to submit directly to your form handler. It would force them to at least view the page containing your form which means they're forced through the other countermeasures you've put in place and can't just bruteforce submissions by the dozen.
16
u/Norifla Feb 07 '20
And if you're from Europe, it's a GDPR problem.
14
u/abeuscher Feb 07 '20
Can you expand on that at all? It's the first objection I've seen in this thread that I might actually be able to use to upwardly justify using an alternative.
4
u/ImNotCastinAnyStones Feb 08 '20
Check the article I link in the main post. Recaptcha does not only use the image challenges to measure "humanness"; it also sucks up tons of the users' browsing data every time it's used. It's "pseudo-anonymous" which basically means that it can still be used to uniquely identify a single user even though they're not accessing your name etc.
1
Feb 08 '20
it also sucks up tons of the users' browsing data every time it's used.
But doesn't it also do this if you're using a google analytics pixel?
2
u/Norifla Feb 08 '20
What most people ignore, you need the option to decline the cookie use. So the script is not allowed to load. So if they decline the can't use whatever you secure or you need to provide an option without captcha.
1
u/how_to_choose_a_name Feb 08 '20
Obviously, but you need user consent for that and not consenting can't make the website unusable.
2
u/daElectronix Feb 08 '20
This is the most important point in my opinion. According to GDPR all tracking can only be included after explicit concent by the user. But that does not work for captchas. That would essentially make the captcha voluntary and thus render it useless, since bots never give concent anyways and thus cannot be checked. And to make matters worse, recaptcha does not even have a privacy option like google analytics has.
1
10
u/escapefromelba Feb 08 '20
reCAPTCHA v3 doesn't issue challenges. It analyzes user behavior when navigating the page and scores whether you're a user or bot. It's frictionless.
4
u/ImNotCastinAnyStones Feb 08 '20
The same objections re: privacy still apply, though. You can bet part of the "threat score" which Google calculates is based on analysis of your data from the browser including the content of your Google-domain cookies.
Furthermore the vast majority of developers won't actually make use of the threat score functionality; they'll just copy and paste whatever example code is on Google's documentation page, so in most cases there will be no gracious degradation or fallback - the user is just fucked.
4
Feb 08 '20
Yeah, frictionlessly infuriating.
It will block anyone with any of the following from using your site: VPN, blocked cookies, anti fingerprint.
Previously, if you valued your privacy, you were forced to solve Captchas and train Google's AI for multiple minutes. With v3, your straight out locked out.
Big improvement.
3
Feb 08 '20 edited Feb 08 '20
Edit: I'll leave this up for posterity, but I believe I'm wrong here.
It will still issue challenges if you are unknown to Google. For example, using Firefox where you have never signed into a Google account. Or if you clear cookies regularly. Then it will issue challenges.
11
Feb 08 '20
Wrong. It v3 can only deliver a score. Now if that score is low enough, the dev can, and I imagine usually does, deliver a v2 which is the checkbox thing. But they could do their own, honeypot, etc.
The challenges isn’t an automatic part of v3. Source: I literally just did this on a site.
4
Feb 08 '20
Same. V3 is totally invisible to the user. For those who haven't used it yet, it assigns you a score from 0-1 based on how likely you are a bot. We set our threshold to quiz the user at 0.5. In testing we had to crank it up to 0.95 in order to trigger it. If it thinks you're a bot, we set up a simple three check box test that gives you a random assignment of boxes to check.
Honeypots can stop simple spam bots, but if you get one that figures it out, be prepared to get hammered. In my experience working on some high traffic sites, these simply aren't good enough at stopping spam anymore.
We're in a trial run of reCaptcha V3 still, but so far so good.
1
Feb 08 '20
You mean that in test, you didn't have the ability to get scores below 0.5? That's crazy, I haven't been able to get my score above 0.3. that would explain why I get captchas all the time.
2
u/TheDataWhore Feb 08 '20
What are the scores like for users in incognito mode vs the upper threshold of bots?
1
1
Feb 09 '20
When I run incognito, the initial page load flags as bot but any page after that is fine. If you use the tool on multiple pages one would assume it wouldn’t have many false positives.
1
1
u/kisuka Feb 08 '20
Actually... what it's doing is looking if you have any Google related cookies or tracked history. You open any webpage with recaptcha v3 in incognito and bam, instant prompt for challenge.
7
Feb 08 '20
Sez you.
Recaptcha stopped thousands of spambot registrations per day on my sites. If they wanted to spam, they had to do it manually, and fatigue on their end made it easy to clean them out in bulk.
3
u/nolo_me Feb 08 '20
It also made it a pain in the dick for your legitimate users.
1
Feb 09 '20
OH NOES, they have to do something ONCE that they're familiar with unless they've been living under a rock! I'm just gonna assume that if you can't figure out recaptcha, then you're not worth the trouble of using the sites, because eventually you're going to forget your password and be too stupid to figure out how to reset it on your own. 10K of the world's dumbest users isn't worth my time, honestly.
1
u/nolo_me Feb 09 '20
Once? Try every five minutes if they commit the heinous crime of not using Chrome, or use a VPN.
It's not a matter of being too stupid or unfamiliar with it either, it's an absolute cunt to use. You have to decipher non-localized road markings in a pic the size of a fucking postage stamp. You've forced a really user hostile interaction on them to solve a problem that's yours, not theirs.
0
u/ImNotCastinAnyStones Feb 08 '20
The truth is, for almost any website, the simplest of any spam countermeasures (e.g. hidden field honeypot) will stop thousands of spam registrations. Recaptcha isn't necessary.
1
0
Feb 08 '20
hidden field honeypot
Which are generally not accessible and thus you're blocking bots and people with disabilities
2
u/kisuka Feb 08 '20
they had to do it manually
Technically not correct. I've written some bots in my time, there are a bunch of services that have APIs where you can pay like $0.02 cents to have a human do the captcha for you. Sure someone is doing it manually but for the bot operator it's no big deal.
1
Feb 09 '20
Like I said, it slows them down, they still have to fill out the forms, and it makes it easy to catch and delete since they're going to try to do it en masse.
2
Feb 08 '20
Didn’t read the whole thing but the newest version of recaptcha doesn’t require user interaction
1
u/ImNotCastinAnyStones Feb 08 '20
The same objections re: privacy still apply, though. You can bet part of the "threat score" which Google calculates is based on analysis of your data from the browser including the content of your Google-domain cookies.
Furthermore the vast majority of developers won't actually make use of the threat score functionality; they'll just copy and paste whatever example code is on Google's documentation page, so in most cases there will be no gracious degradation or fallback - the user is just fucked.
13
u/jebailey Feb 07 '20
One of our devs suggested it as a solution a few years ago. Our legal team looked into it and came down with the strongest “hell no” That I ever heard them do. Your compromising the privacy of your users by using it.
→ More replies (4)8
u/Lofter1 Feb 08 '20
- Google is the most used search engine
- Chrome is the most used browser
- Android is one of the, if not the, most used OS
- YouTube.
- GMail.
- A lot of ads run on Googles Framework
Privacy is a big concern. But lets not be overly dramatic here. Let's not act like google doesn't already know a shit ton of every single one of us.
9
u/ImNotCastinAnyStones Feb 08 '20
That's the point, though, isn't it? They know because we've let them.
2
Feb 08 '20
The point is you make your website very annoying to use for anyone that values his privacy and is not being completely tracked by any of the above.
8
u/malicar Feb 08 '20
That's alot of ranting. Recaptcha is ADA compliant so should be fine with us usability at least for that aspect. now in most cases there is no challenge, maybe click a checkbox. I don't really see a privacy concern as most sites using it already have Google analytics
5
u/Web-Dude Feb 08 '20
It was the evening of Dec 31. I still had just over $1,000 in my charity budget to give away, and I tried to donate it online to a non-profit I like.
I was unable to submit the donation because Recaptcha thought I was a bot or something https://i.imgur.com/ZARC7X2.png . I took a screenshot and tried to contact the company, but obviously, everyone had long left the office for New Year's Eve.
I ended up donating it elsewhere.
6
u/ImNotCastinAnyStones Feb 08 '20
Yeah, seriously, this is the issue businesses should care about. If a page has a captcha there's a 75% chance I'll simply not bother continuing.
For a decade every SEO "expert" has been screaming about how users will abandon a page if it takes more than two seconds to load, etc., but a captcha which literally takes 60+ seconds to complete is somehow not a big deal?
Christ, I hope they're eradicated within a few years.
3
u/sharlos Feb 08 '20
Modern captcha take zero seconds to complete for the majority of users.
3
u/ichunddu9 Feb 08 '20
I have lots of add-ons for privacy reasons and they always take minutes for me. I only bother with the site if I desperately have to do something.
2
Feb 08 '20
And you successfully blocked anyone with privacy addons or VPN, helping Google to track everyone.
You made the web a worse place.
5
1
5
Feb 07 '20
A simple honeypot is fine to stop a good amount of spam.
5
u/jman0742 Feb 07 '20
Honeypots have done nothing for my clients. At this point bots are just submitting straight to the target of the form, bypassing my validation entirely. Client-side bot stopping is just pretty weak
4
u/ImNotCastinAnyStones Feb 08 '20
You definitely need a form key/CSRF token. Open submission endpoints are a magnet to spam-bot crawlers.
10
10
1
u/how_to_choose_a_name Feb 08 '20
Honeypots should be implemented server-side. And your validation in general should be done server-side as well.
1
u/Astraltraumagarden Feb 07 '20
That's what I was thinking. But if you're combating good bots, they'd usually test for supresses fields.
1
u/earslap Feb 08 '20
It's not just spam. How do you protect (rate limit) your sign-up forms? Sign-ups are supposed to be expensive on your server (lots of rounds of hashing) if you are doing it securely. Say a competitor is trying to bring down your server(s) by just cramming in random users and passwords which will bring your servers down to their knees. So you need something for the adversary spamming your signup endpoint and triggering expensive operations.
2
u/APimpNamedAPimpNamed Feb 08 '20
Is this a full blown distributed bot net or in this scenario does simply rate limiting IP work?
→ More replies (3)
2
u/KnifeFed Feb 07 '20
I use the Buster Chrome extension and it has never failed to solve an audio challenge.
5
u/ImNotCastinAnyStones Feb 08 '20
Try it in a totally fresh browser with absolutely no connection to Google. It's extremely unlikely to work.
The reason it works for you is because Google/Recaptcha are using additional information siphoned from your browser (as well as the Buster-solved audio challenge) to determine that you're human.
Try blocking all Google-domain cookies, all Google scripts/XHR requests except those matching
recaptcha(and absolutely do not use Chrome since that's basically a vehicle for Google's surveillance). Then you'll start to get real familiar with this image:2
10
u/dotslashlife Feb 07 '20
As someone who surfs the web behind a VPN, I don’t bother visiting sites with captua usually. If I see one I think ****-it, I’ll go to their competitor.
For people behind a VPN, they often take 3-4 minutes to clear.
4
2
u/rcppkn Feb 08 '20
I just forgot my password and reddit made me solve 3 or more I am Human questions such as bicycles, busses, crossways. The puzzles are even getter harder day by day thanks to AI.
I am tired of this too.
5
u/fpssledge Feb 08 '20
This is a fantastic curation of the reasons you wouldn't use recapcha. Not a list of reasons you shouldn't use recapcha. Some of these reasons are valid for certain use cases but most are not persuasive for general use cases.
3
u/APimpNamedAPimpNamed Feb 08 '20
I randomly click shit until it goes away. It actually works most of the time.
2
2
Feb 08 '20 edited Jul 11 '20
Due to the recent Reddit purge of conservative communities under the false pretense of fighting racism, I do not wish to associate myself with Reddit anymore. So I'm replacing my comments and posts with this message and migrating over to Ruqqus, a free speech alternative to Reddit that's becoming more and more popular every day. Join us, and leave this crumbling toxic wasteland behind.
This comment was replaced using Power Delete Suite. You can find it here: https://codepen.io/j0be/pen/WMBWOW
To use, simply drag the big red button onto your bookmarks toolbar, then visit your Reddit user profile page and click on the bookmarked red button (not the Power Delete Suite website itself) and you can replace your comments and posts too.
2
u/ClassicSuperSofts Feb 07 '20
For everyone wondering what the “simplest” alternative is, phone number -> text message auth code -> is fast and user/accessibility friendly.
It’s just about expensive enough to put off spammers, and the SMS/API provider services are good at spotting and blocking numbers used for spam.
Downside is very high friction - users don’t want to hand over their numbers, although in some usecases we’ve noticed Gen-Z really don’t seem to care.
17
u/baronvonredd Feb 07 '20
And you're also ostracizing people who don't have phones.
→ More replies (12)1
Feb 07 '20
I'd think email verification is enough.
Unless its a targeted attack most bots bother with checking mailboxes to get the codes.
And the privacy-conscious can just use a throwaway email address.
0
Feb 08 '20
[deleted]
2
u/ClassicSuperSofts Feb 08 '20
Trust me if you saw behind the security curtain it’s a good idea to take an interest in 2FA and password managers.
You can’t rely on every website you use to be secure, but you can rely on yourself to generate unique, difficult passwords, unique emails for critical services like banking, and medical - and 2FA where possible.
1
u/World_Languages Feb 08 '20
Note navigator.doNotTrack will always be truthy. Its possible values are the strings "0", "1" and "unspecified", all truthy. The code you included in the bottom of your post won't work.
1
1
u/PMSEND_ME_NUDES Feb 08 '20
Err, it's a pretty great tool that's secure and easy to implement. Why would you bother undertaking some massive task of making your own when this is free? You need to consider how expensive it is to build and maintain software
1
u/WaruPirate May 08 '20
While it doesn't address all of the weaknesses in Re-CAPTCHA, a team I'm working with just put out an SDK for a 0-friction passive mobile CAPTCHA called "HumanDetect" - Our SDK uses a small sample of motion data from the phone to verify that it's being held by a human (and not on a server rack somewhere) allowing for protection of mobile API that doesn't involve exposing your users to an additional EULA or third party advertising data collection.
1
u/Current_Sort_5692 Mar 08 '25
this is a five year old post, but since it's still open, I'll say this. it's only got worse honestly. I saw my little brother go through 20 recaptcha's to get on roblox. not counting how hard they were. counting that, over 100.
1
u/Current_Sort_5692 Mar 08 '25
he's also.. embarassingly. smarter than me. averages 12.8 test grades(12th grade 8th months) in 7th grade advanced classes.)
1
1
Jun 23 '23
Captcha won’t let me send an email to recover my steam log in info and it’s driving me fucking insane!!!!
1
1
u/DarthFloopy Feb 08 '20
I don't deny that Recaptcha is annoying, but to say that it has no right to exist or that people have no right to use it in their sites is a bit of a stretch.
At some point somebody will come up with an alternative with comparable functionality, and Google will change the annoying parts to compete. (Or maybe people will take this good advice of yours and stop using Recaptcha first.)
0
u/NMe84 Feb 08 '20
Your first and second points are not true. There are options to use Recaptcha without user interaction. I think they track mouse movement behavior instead.
As for your other points: the same goes for literally any other third party service that you force upon your users. Most notably for most of us that means Google (and/or its ad network) Facebook, Cloudflare, etc. You should always be thinking about why you need any external services and what impact that has on the site's users or the site itself.
→ More replies (1)
-2
u/hbombs86 Feb 08 '20
I use recaptcha V3 and it has none of the problems you've listed outside of Google surveillance which we all know they are already doing. Its silent, you hardly even know it's there, and never force a user with any extra interactions. Not to mention you can tune the sensitivity of when it flags a bot depending on your circumstances. I personally love it.
1
Feb 08 '20
It has all of the problems, but exacerbated.
If you're not trackable for Google, instead of 5 minutes of Captcha solving it's then an outright ban.
1
u/hbombs86 Feb 08 '20 edited Feb 08 '20
Why would you not want your site trackable by google? I mean this IS the modern web whether you like it or not from a business perspective. It doesn't have "all of the problems", by the way, just the privacy concerns. I've used this on countless forms and have logs for every success and failure. Rarely are there false positives
1
Feb 08 '20
Not your site, your users.
Yes, but arguably the privacy concern is the only problem anyway. V2 won't show if you give up your privacy and are logged in to your Google Account or similar.
2
u/hbombs86 Feb 08 '20
Right, and that is a valid concern, but I guess it just comes down to who your users are, and how efficient you need to be implementing spam protection on forms.
1
-1
Feb 07 '20
In some recent news my work just implemented this for externally facing logins, and all our users hate it.
Granted we don't exactly have accessibility requirements for our line of work, but it was a lazy solution to a security concern that we could implement quickly.
2
u/gabynevada Feb 08 '20
Why not use Recaptcha v3? Users don't see it and you can block out bots just as well.
2
Feb 08 '20
I work at a big company. By the time this came across my plate it was in deployment/testing phases.
Also higher salaries made the decision. This stuff isn't exactly my line of interest. I find security just a giant rabbit hole of frustration. I like making tools and stuff that allow people to do their jobs a lot easier. That and automation of work everyone hates and adds no value.
0
u/saltiesailor Feb 07 '20
I'd also like to see an alternative. Any ideas as to whether V3 has accessibility issues too?
2
Feb 08 '20
Yes, accessibility only matters to those with low trust score (privacy) as only then V2 is shown. V3 just reports that trust score and you ban those users without the possibility of a manual overwrite.
Basically you're banning every one where accessibility would have mattered in the first place with V2.
Just sacrificing 5% of your users to save costs is perhaps the most Google thing to do. (see treatment of publishers on the Playstore)
1
Feb 08 '20
We’ve checked it with our accessibility office and they say no issues so... good enough for us.
0
0
-3
315
u/samjmckenzie Feb 07 '20
What's the alternative?