News for hackers. Stuff that matters.
Re:Why can’t a bot tick the 'I'm not a robot' box? by udfalkso on Wednesday February 13, 2019 @05:20PM (#19157677)
Imagine if those sites had to build their own captcha service instead. How much more expensive would they be?
Re:Why can’t a bot tick the 'I'm not a robot' box? by foxylad on Wednesday February 13, 2019 @08:17PM (#19158843)
It's actually not that hard, assuming you control your form generation. Bots usually fill in fields using the actual field name - not the label the user sees. So provide a field labelled "Age" but named "email", and simply check it contains digits. If it's got an email address in it, it's a bot.

Labels can also be obfuscated with javascript, replacing the raw HTML "Email" with "Age"on page load. Getting this right will require the bot to parse both HTML and JS, and we can force them to handle CSS too. Add a "zip" field, and hide it with complex CSS rules. If it contains a zip code, it's a bot.

If you're really paranoid, randomise combinations of distinguishable fields (name, email, phone, age and hidden fields) every time you generate the form, so even if a bot herder manually maps names to fields one time, it'll fail the next. At this stage it'll be cheaper for the bot herder to use Mechanical Turk, after which even Google's captcha is compromised.

Re:Why can’t a bot tick the 'I'm not a robot' box? by miki123211 on Thursday February 14, 2019 @03:33AM (#19160476)
>So provide a field labelled "Age" but named "email", and simply check it contains digits. If it's got an email address in it, it's a bot.

Or a blind user who might actually rely on both labels and names. That's a bit like what arxiv does, they have hidden links that ban your ip when you crawl, but the links aren't hidden for AT users. I got myself banned that way once.

Re:Why can’t a bot tick the 'I'm not a robot' box? by jtolmar on Wednesday February 13, 2019 @10:10PM (#19159319)
This is very hostile to people who use screen readers.
Re:Why can’t a bot tick the 'I'm not a robot' box? by darkpuma on Thursday February 14, 2019 @12:12AM (#19159774)
I've found that the tech industry often is. Trying to get managers to set aside time to iron out accessibility issues is like pulling teeth. Trying to get other developers to take it seriously is almost as bad. Often you count yourself lucky if the bare legal minimum is implemented.

Accessibility is very important, and if accessibility features are implemented well they'll often be useful even to people without disabilities, but do any CS/SE or code bootcamp programs take the topic seriously? I'm sure it must be taught somewhere, but it doesn't seem to be common at all. Can you even imagine 21st century university architecture department that didn't cover ADA compliance? That'd be unthinkable.

Re:Why can’t a bot tick the 'I'm not a robot' box? by cesarb on Thursday February 14, 2019 @06:19AM (#19161079)
> Can you even imagine 21st century university architecture department that didn't cover ADA compliance? That'd be unthinkable.

I can easily imagine it: architecture departments from universities in other countries don't necessarily have to cover compliance with USA laws.

Re:Why can’t a bot tick the 'I'm not a robot' box? by gcb0 on Wednesday February 13, 2019 @05:32PM (#19157793)
wonder if someone is collecting actual data instead of listening to udfalkso, the google sales rep here.

maybe to save them a few $ from bots and spam (bandwidth and storage is very cheap today) they might be losing new users by the thousands (and traffic acquisition is far more expensive than the formers)

Re:Why can’t a bot tick the 'I'm not a robot' box? by JohnFen on Wednesday February 13, 2019 @06:14PM (#19158089)
Or they could just use one of the many free CAPTCHA applications that are around.
Re:Why can’t a bot tick the 'I'm not a robot' box? by hombre_fatal on Wednesday February 13, 2019 @07:13PM (#19158468)
Off the shelf spam software like Xrumer[0] has been cracking those captchas for 10+ years.

Recaptcha isn't obnoxious for fun, it's obnoxious because this is the state of the arms race right now. There's also the challenge of creating a captcha that allows blind people in.

[0]: https://en.wikipedia.org/wiki/XRumer