News for hackers. Stuff that matters.

Ask HN: ReCAPTCHA Alternatives?

A few months back, I had a contact form (on a Drupal site) with a spam problem. It wasn't something I was interested in spending a ton of time on it, so I set up ReCAPTCHA. Problem solved, but I didn't feel great about the privacy implications. So, my question: What should I have done? Specifically, I'm looking for an alternative to ReCAPTCHA that is:

* simple to set up—not much more complicated than ReCAPTCHA

* free or quite cheap

* reasonably effective, at least against generic spiders

I'm not sure if such a thing exists, but I think it needs to if we are to have any chance of moving people off ReCAPTCHA.

( 5 comments | 11 points | on HN )
Re:Ask HN: ReCAPTCHA Alternatives? by masukomi on Monday August 26, 2019 @11:38PM (#20806133)
Akismet has always been good for me for WordPress and I see there's a Drupal plugin for it too. It's not free, but I think it's reasonably priced for how well it functions and the headaches it saves me with no frustration for commenting users.
Re:Ask HN: ReCAPTCHA Alternatives? by wavelen on Saturday August 24, 2019 @08:24AM (#20786733)
I had this problem recently and I figured that I was trying to find a solution for a problem I didn't even have.

I decided to just not use any form of captcha. If it ever becomes problematic (e.g. spam) I can still implement a captcha again. Until now it works perfectly fine.

Re:Ask HN: ReCAPTCHA Alternatives? by viraptor on Friday August 23, 2019 @11:00PM (#20784939)
Have you tried starting with a completely trivial solution to see if you have anyone targeting you at all? By trivial, I mean "write number four in this text field". If you get only full-auto spam bots, that should be enough.
Re:Ask HN: ReCAPTCHA Alternatives? by Gaelan on Saturday August 24, 2019 @12:51AM (#20785300)
Almost certainly don't—I kinda assumed something that trivial would get handled by full-auto bots by now, but maybe not.
Re:Ask HN: ReCAPTCHA Alternatives? by luckylion on Saturday August 24, 2019 @01:38AM (#20785457)
I haven't seen bot spam go past trivial things. A text field name="url" that's hidden via css gets filled by them. They don't execute JavaScript. Granted, those solutions won't work forever, once they are widely adapted, bots will adapt too, and they obviously won't stop targeted spam.