Hacker News Reader

Comment by jermaustin1 | Hacker News Reader

The best solution I've ever come to that didn't negatively impact my clients was generating a UUID on the server via an ajax call 100ms after page load. That UUID was stored in a cookie, and returned via AJAX and stuck it in a hidden field on the form.

Server checks cookie != null and cookie == hidden field, and returned a 200 OK regardless of if it failed (used the response text for success or failure indication), and deleted the cookie.

Implemented it across a network of sites ~10 years ago, and only a handful of spam had gotten through when I quit that job 4 years ago. They had been getting 10-20 spam comments per day per site.

View on HN

That will work for low end drive by stuff. Anyone motivated will have a better bot. I was running one 10-12 years ago that was essentially a headless browser. It had a JavaScript runtime and a custom DOM. It could run jquery, prototype, ajax and just about everything else that was popular at the time. I even had a custom flash runtime in there for the jackass sites with the nav in flash.

These days you could just throw together a selenium script and call it a day.

This kind of stuff is fine for stopping comment spam because there are so many other opportunities out there that the spammers move on to an easier target. If you need to protect against a targeted attack then it’s a lot more difficult.

Even easier now with https://github.com/GoogleChrome/puppeteer

Does any kind of captcha stop a targeted attack? I don't think that's what captchas are for.

Maybe. Maybe not. They are pretty darn difficult. I’ve seen a few that are fairly straightforward to break. For the good ones, you’d need some quality CV tech and if what you have is that good then you’re probably better off using it for something other than breaking captchas in order to post comment spam for penis pills or whatever they are peddling these days.

You can pay teenagers in the Phillipines a few dollars a day to solve any kind of captchas for you. Maybe I have a different concept of a targeted attack, but that seems certainly in the realm of what a criminal enterpise or nation state would expend on a high value target.

Some webpages seem to use captchas to stop (targeted) DDOSs, having a easily defeated (but unique) Captcha might not help in those scenarios.

So this solution would work because most automated spam would not make AJAX calls?

Something like Selenium posing as a real user would bypass this kind of protection wouldn't it ?

It works because most bots do not keep running the javascript after pageload like a real user's browser would.

I was thinking to roll my own cookie solution as well, but this makes the form submissions impossible on multiple tabs.

Reply on news.ycombinator.com