undefined | Better HN

0 pointsmikeash13y ago0 comments

I'm a little confused as to why you spend three paragraphs discussing the random guessing approach and only touch on the more sophisticated method at the end.

I really don't think I'm comparing apples and oranges. I'm simply noting that any novel captcha can look good when attackers can't be bothered to actually attack it.

0 comments

2 comments · 1 top-level

jere13y ago· 1 in thread

Well, mainly because I agreed with you and didn't feel like wasting much time saying so. I was also frustrated with so many people in this thread focusing on the guessing method and acting like a 3% success rate was high. That annoyed me since, as I said, first class captchas have been attacked with ~50% success rate in studies.

My experience with an unknown site has differed from yours dramatically. I have a small, custom site that I share with less than 10 friends and I have had to progressively step up the security (none -> captchas -> passwords) because it has been attacked with thousands of spam messages on several occasions.

mikeashOP13y ago

Odd that your experience has been so different. My progression has been:

1. The "elbow" technique. Worked OK for years, then spam began to rise.

2. A slight variation to defeat generalized bots. I changed the field label to, "Type 'humour' with American spelling." This held on for a few more years.

3. A hashcash-based solution, where a proof of work is generated using JavaScript in the client and required to post a comment. It's calibrated to take 20-30 seconds on typical computers, and doesn't start until you focus the comment fields so it's not burning CPU for people who just view the page. This is still working well for me. I get occasional spams, but from looking at the logs it appears almost certain that these are from real humans who are actually spending the 20-30 seconds waiting for the hashcash to compute. I only have to delete one or two spam comments a month for the moment.

Wonder what caused your site to suffer so much more.

j / k navigate · click thread line to collapse