Hacker News Reader

Comment by mindslight | Hacker News Reader

Forget adding more draconian identity requirements. 95% of CAPTCHA use is simply unnecessary and could be straightforwardly removed or replaced with rate limiting login attempts per IP. Never mind sites that use it to prevent scraping. If serving static pages is that much of a burden that you want to discourage automated means of retrieving information that you're trying to publish, then work on your website performance instead of adding more user-hostile roadblocks.

View on HN

Exactly. The vast majority of captcha usage is completely unnecessary. Just remove it. As you say I've even seen captchas for static content, which is pure nonsense.

I run several long-lived (decades) sites with mostly static content but also some dynamic pages and a commenting mechanism. Here's what I do to prevent abuse: nothing. It's fine.

If you run a massively popular site or something politically controversial then you'll be targeted for abuse. If you're specifically targeted, I don't know how much captchas will help.

For the rest of the 99.9% of sites, just stop it. You don't need it.

> could be straightforwardly removed or replaced with rate limiting login attempts per IP

This is very outdated intuition. Fresh IP addresses cost peanuts.

For example, your solution still allows an attacker to run a 50k item /login combolist against one of your users with $5 of botnet time, each IP address trying a single uname/pass combo.

Here you pay $18/GB to multiplex your abuse (cred stuffing being classic non-volumetric abuse example) across 72 million residential IP addresses. https://luminati.io/

50k attempts is tiny, like a 3 character password or a single account run through /usr/share/dict/words.

If you're worried about password with between other sites that have leaked, then the real answer is to generate something like a username for each user that they won't be able to share between sites. In fact with the prevalence of password managers, generating users' passwords for them might just be the better approach these days. And just fall back to email auth every time if they don't want to store it.

Duct taping your broken system by throwing up an annoyance for every user who doesn't want to be tracked is not the way.

I would start with blocking those 72 million addresses for starters :)

Many of these ip addresses would also be shared by servers of legitimate businesses and VPNs.

True, but blocking them stimulates them to stop renting them out to such services.

This scenario is not realistic, as you can just lengthen time between subsequent login attempts per username.

Attackers only need one attempt per username.

They will use a leaked list of millions of username and passwords, then use a botnet to try them all on another website.

That’s exactly what I’m thinking too! Lot of it is to prevent scraping and a lot of it is unnecessary

Reply on news.ycombinator.com