,
3 tweets,
1 min read
Read on Twitter
I am very sad at how ineffective reCAPTCHA is at preventing spam bots. Either spammers have developed a well-oiled human-based pipeline for breaking captchas for <<$0.1 each, or they've made a DL-based captcha breaker. In any case, it's free-for-all these days.
For a long time my go-to spam prevention solution was invisible fields like "username", "password" in the registration form -- if you fill them in, you must be a bot. It used to be very effective, but increasingly less so recently, probably because bots are now browser-based.
Now I'm using ad-hoc questions visible to users. Trivial to break if a human were to write a script specific to my forms, but that's not part of my threat profile.
