<story><title>Ask HN: Captcha Alternatives?</title><text>TLDR: I help with a gaming community-related site that is being targetted by a script kiddie, they are registering hundreds of thousands of accounts on our forums to &amp;#x27;protest&amp;#x27; a cheating (aimbot) ban. They then post large ASCII art spam, giant shock images (the first one started after we blocked new accounts from posting [img]), the usual.&lt;p&gt;Currently we use a simple question&amp;#x2F;answer addon at registration time - it works against all untargeted bots and is just a little &amp;quot;what is 4 plus six&amp;quot; or &amp;quot;what is the abbreviation for this website&amp;quot; type of question. It&amp;#x27;s worked fine for years and we don&amp;#x27;t really get general untargeted spam.&lt;p&gt;I am somewhat ethically disinclined to use reCAPTCHA, and there are some older members that can&amp;#x27;t reasonably solve hcaptcha easily. Same for using heavy fingerprinting or other privacy invading methods. It&amp;#x27;s also donation-run, so enterprise services that would block something like this (such as Distil) are both out of budget and out of ethics.&lt;p&gt;Is there a way I can possibly solve this? Negotiation is not really an option on the table, the last time one of the other volunteers responded at all we got a ~150Gbps volumetric attack.&lt;p&gt;I&amp;#x27;ve tried some basic things, like requiring cookie and JS support via middleware; they moved from a Java HTTP-library script to some kind of Selenium equivalent afterward. They also use a massive amount of proxies, largely compromised machines being sold for abuse.</text></story><parent_chain><item><author>huhtenberg</author><text>* Allow new accounts, but hide messages from them until their posts are verified manually and the accounts are either approved or shadow-banned.&lt;p&gt;* Don&amp;#x27;t delete ban accounts, don&amp;#x27;t notify them in any way, but tag their IPs and cookies to auto shadow-ban any sock puppets, so that these don&amp;#x27;t even make into an approval queue.&lt;p&gt;* Use heuristics to automate the approval process, e.g. if they looked around prior to registering, or if they took time to fill in the form, etc.&lt;p&gt;* Add a content filter for messages, including heuristics for an ASCII art as a first post, for example, and shadow-ban based on that.&lt;p&gt;* Hook it up to StopForumSpam to auto shadow-ban known spammers by email address &amp;#x2F; IP.&lt;p&gt;* Optionally, check for people coming from Tor and VPN IP, and act on that.&lt;p&gt;Basically, make it so that if they spam once, they will need both to change the IP &lt;i&gt;and&lt;/i&gt; to clear the cookies to NOT be auto shadow-banned. You&amp;#x27;d be surprised how effective this trivial tactic is.&lt;p&gt;All in all, the point is not to block trolls and tell them about it, but to block them quietly - to discourage and to frustrate.</text></item></parent_chain><comment><author>mcv</author><text>I don&amp;#x27;t think cookies will do much against a large-scale automated attack, but everything else in this list is solid:&lt;p&gt;Hide posts until legitimacy of the poster has been verified. Allow them to post and respond, but don&amp;#x27;t show it to anyone yet, except to the moderators. If they&amp;#x27;re posting something sensible, unhide them. If it&amp;#x27;s spam, shadow-ban them. Don&amp;#x27;t let the user know. Let them guess why nobody is responding to the spam.&lt;p&gt;For that reason, it may also be a good idea to post an announcement that nobody should respond to this spam. Tat way the spammer won&amp;#x27;t know if he&amp;#x27;s being ignored manually or auto-hidden. Let him waste time and frustration on that.&lt;p&gt;Only use this against people who are this malicious. For regular hot-headed people who accidentally break forum rules but do want to meaningfully contribute to the community, always remain open and honest. Give people the opportunity to learn. Only people who are determined not to learn and to remain purely destructive, do you use the shadow ban.&lt;p&gt;Of course once they catch on, they&amp;#x27;ll probably start making new accounts with some legitimate posts, and once people start responding, they go back into spamming mode. This is tricky. Ideally, it&amp;#x27;d be nice if you had a system that could automatically detect that sort of spam. If someone suddenly starts posting ascii art, bigimages, all caps, or anything like that, or goes on a rapid posting spree, automatically put them back on probation with hidden posts requiring approval, so you can check this change in posting behaviour.</text></comment>
<story><title>Ask HN: Captcha Alternatives?</title><text>TLDR: I help with a gaming community-related site that is being targetted by a script kiddie, they are registering hundreds of thousands of accounts on our forums to &amp;#x27;protest&amp;#x27; a cheating (aimbot) ban. They then post large ASCII art spam, giant shock images (the first one started after we blocked new accounts from posting [img]), the usual.&lt;p&gt;Currently we use a simple question&amp;#x2F;answer addon at registration time - it works against all untargeted bots and is just a little &amp;quot;what is 4 plus six&amp;quot; or &amp;quot;what is the abbreviation for this website&amp;quot; type of question. It&amp;#x27;s worked fine for years and we don&amp;#x27;t really get general untargeted spam.&lt;p&gt;I am somewhat ethically disinclined to use reCAPTCHA, and there are some older members that can&amp;#x27;t reasonably solve hcaptcha easily. Same for using heavy fingerprinting or other privacy invading methods. It&amp;#x27;s also donation-run, so enterprise services that would block something like this (such as Distil) are both out of budget and out of ethics.&lt;p&gt;Is there a way I can possibly solve this? Negotiation is not really an option on the table, the last time one of the other volunteers responded at all we got a ~150Gbps volumetric attack.&lt;p&gt;I&amp;#x27;ve tried some basic things, like requiring cookie and JS support via middleware; they moved from a Java HTTP-library script to some kind of Selenium equivalent afterward. They also use a massive amount of proxies, largely compromised machines being sold for abuse.</text></story><parent_chain><item><author>huhtenberg</author><text>* Allow new accounts, but hide messages from them until their posts are verified manually and the accounts are either approved or shadow-banned.&lt;p&gt;* Don&amp;#x27;t delete ban accounts, don&amp;#x27;t notify them in any way, but tag their IPs and cookies to auto shadow-ban any sock puppets, so that these don&amp;#x27;t even make into an approval queue.&lt;p&gt;* Use heuristics to automate the approval process, e.g. if they looked around prior to registering, or if they took time to fill in the form, etc.&lt;p&gt;* Add a content filter for messages, including heuristics for an ASCII art as a first post, for example, and shadow-ban based on that.&lt;p&gt;* Hook it up to StopForumSpam to auto shadow-ban known spammers by email address &amp;#x2F; IP.&lt;p&gt;* Optionally, check for people coming from Tor and VPN IP, and act on that.&lt;p&gt;Basically, make it so that if they spam once, they will need both to change the IP &lt;i&gt;and&lt;/i&gt; to clear the cookies to NOT be auto shadow-banned. You&amp;#x27;d be surprised how effective this trivial tactic is.&lt;p&gt;All in all, the point is not to block trolls and tell them about it, but to block them quietly - to discourage and to frustrate.</text></item></parent_chain><comment><author>ev1</author><text>We already tag&amp;#x2F;drop all Tor and VPN traffic. Cookies don&amp;#x27;t make much sense because this looks like browser automation, not someone just swapping VPNs by hand repeatedly.&lt;p&gt;For IP bans, they are now using illegitimately acquired or fraudulent IP space (the guy is not intelligent enough for this, he&amp;#x27;s almost certainly just buying proxies with in-game gold or some BS - but there is a criminal element here), including what might involve significant hijacking of AT&amp;amp;T, CenturyLink, Level3, and Windstream network resources.&lt;p&gt;(if you work at one of those places and are clueful, I would be very interested in asking about this)</text></comment>