https://github.com/xHossein/PyPasser

- Select everything that is a color im sure there are more clever open-ended questions

- Red

- Blue

- Monkey

- Violet

- Armchair

People say that bots can learn such things but if every site had their own in-house tool then bots would have to keep track of thousands of site specific puzzles. Each site could even rotate through a dozen sets of different puzzle types and pause the ones that get learned. This would avoid sending cookies to a third party or depending on 3rd party code.

Bonus complexity: Don't use Alpha-Numeric characers. Use something like "figlet" [1] and cycle through a few of its ASCII art fonts.

[1] - https://github.com/xero/figlet-fonts

Costs money to maintain and build correctly, which naturally leads to buying existing solutions.

And sure, qntm.org isn't nearly as big a website as HN, but I concur that this isn't likely to be super-difficult. The wide use of recaptcha seems like mostly laziness; most websites aren't big enough to get targeted attacks.

Be sure to include a few macros, otherwise the JS crowd will still be able to reverse engineer their way in.

Followed by a modern reimagining of the classic 88x31 animated gif mini-banner button as a not so subtle pixel.gif tracker.

https://www.yewknee.com/_img/blog/blog_webbuttons020.png

"Once you’ve deployed Turnstile, you can go back to the dashboard and see analytics on where you have widgets deployed..."

So less a gift, more another sensor.

I'll send details in an email.

I don't think people are disputing the necessity, just the mechanism used.

The other services (hCaptcha) are effectively drop-in replacement with minimal code changes.

Lastly, what I would do is have users pick a login image, in addition to the password login, they have to pick a correct image in addition to password.So it would still be the process I suggested except a failed login is allowed one time so long as the correct login image is selected. Also, the login images will be slow to load during times of attack on purpose to identify clients that are guessing before the image is served and to slow down their attack. I would also maintain a list of IP+UA that have repeatedly logged in succesfully to exempt or prioritize them depending on the attack.

(Condolences on the attack/headache.)

Also: OTP 2FA?

No I mean when a specific user has a failed login attempt that user has to wait 5-30 seconds before being able to try again. A legitimate user would only be affected if a bot is trying to log in as them.

This is not a novel measure, rest assured that the people that choose to implement captcha instead are aware of its existence and chose for the captcha instead.

Bots will not have access to TouchID, Windows Hello, or a Yubikey but most humans have one of those in the device in front of them right now.

Fallback to captcha for edge cases, but then at least /most/ people can skip it.

Example: https://cloudflarechallenge.com/

There's nothing about the WebAuthn protocol that forces hardware backed key storage, other than everyone collectively agreeing it's a good idea. A bot author would just ignore that.

Firefox already includes this functionality, gated by flag (security.webauth.webauthn_enable_softtoken).

Not possible if vendor signature checking is enforced. All major webauthn device manufacturers sign the keys of all the devices they produce. You can prove a given device is unique and issued by Apple, Yubico, Google, Microsoft, etc.

First, I'm sorry to hear HN was under attack. That's never fun.

Second, I understand your reasons for temporarily turning on the CAPTCHA, even though as a user I really dislike it - especially reCAPTCHA.

Given the latter, I hope you will consider alternatives. Regardless though, it would be nice to add a message to the login page explaining that the CAPTCHA is temporary because the website is under attack. That would allow me to keep 3rd-party stuff blocked by uBO on the login page and still know what's going on. I would probably just keep the pages I'm interested in on a tab and come back to them later, when the CAPTCHA is gone.

In any case, as always, thanks for your work keeping this forum alive and healthy.

I'll whitelist your account for now (i.e. until the server restarts). If anyone else wants that, email [email protected] and I'll do it as soon as I'm back online.

(It looked like the attack had died down but then it un-died back up again)