recaptcha work for y'all?

I like to get a text message when I get new leads, but lately it seems like the spammers are winning and Recaptcha isn't even slowing them down. Are you all seeing this as well? Most of the addresses are something like asdfasds82@gmail.com

Jeff Dwyer

Say something nice to jdwyah…

Post Comment

2
We run a WordPress page which gets hit pretty hard (.gov.uk TLD).

Before Recaptcha we just saw an inexhaustible supply of failed password attempts, probably from bots which specifically target WordPress.
- Locking out accounts didn't work because legitimate users were being locked out of their own accounts due to the number of failed attempts.
- The bots run across vast networks of IP addresses so you cannot easily IP-ban.
- Rate limiting was not very helpful as it was difficult to synchronise when scaling horizontally. Also, it ended up having the same effect as locking out accounts.
- Recaptcha is annoying to legitimate users. But it's stopped the constant brute-force attempts on passwords.
We still see lots of fake accounts being created; approximately a hundred a month. I have no idea why spammers do this but I think it's just an automatic process. (New accounts have no ability to post comments or submit any content.) But Recaptcha certainly solved the brute-force problem.
Tom J Rees

·
8 years ago
·
Reply
1. 3
  Some tips to help out:
  
  Use recaptcha. It's not that bad, people are used to it.
  
  Add a text field to your forms that is invisible for regular users. Automatically permaban anyone who fills this in. Most bots are basic and don't know what shouldn't be filled in. Mailchimp also does this.
  
  Blacklist certain usernames so they can't be created (admin, webmaster, root, ...) and automatically permaban anyone trying to log in with any of these names.
  
  Lock out an IP address automatically after 3 failed attempts in < minutes (I use 3 attempts in 5 minutes).
  
  Your lockouts/bans should be significant. Mine are set to 2 months. Make the bots understand that they'll be wasting resources if they reschedule your site in their system for the next day or next week.
  
  Monitor https://haveibeenpwned.com/API/v2 for your users' email addresses, lock out their old password automatically and send them an email with information if they're in a new data breach.
  
  Monitor accounts for strange IP addresses, and make them verify their login via email at least once if it's an unusual device. Record those strange IPs and permaban them if the user says it wasn't him/her.
  
  Install https://www.fail2ban.org/.
  
  Optional: Blacklist all IP addresses from known server hosters.
  Sébastien Vercammen
  
  ·
  8 years ago
  ·
  Reply
  1. 1
    This is a great walkthrough.
    
    Relating to my experience, I have one question: When you say "Permaban" do you mean locking out the IP address or the username?
    
    Locking out usernames meant that our popular/high value customers were getting DOS'ed out of their own accounts by bot activity. Their usernames were too easily discoverable on the site.
    
    Locking out IP addresses led to problems where we locked out an entire department or an entire office full of legitimate users because one person tripped the kill-switch for their public IP address.
    
    Tom J Rees
    
    ·
    8 years ago
    ·
    Reply
    1. 1
      
      When you say "Permaban" do you mean locking out the IP address or the username?
      
      The IP address. The username is legitimate and shouldn't be affected. If one username is being targeted much more than others, it might mean it was leaked somewhere, but there's no guarantee.
      
      Locking out IP addresses led to problems where we locked out an entire department or an entire office full of legitimate users because one person tripped the kill-switch for their public IP address.
      
      Bots either don't stop or only stop when they went through their list of most common passwords. Find the sweet spot or allowed attempts per x minutes.
      
      But if one person is consistently entering the wrong password, it might be time to educate that person and change their way of working instead of trying to fix a system that isn't broken.
      
      e.g. 4 wrong passwords in < 5 min = lock out IP. If you show on your login screen that they only have x attempts left, and they still do all of them wrong, the user is the problem. Can happen once, but not 3+ times.
      
      If the user doesn't want to be educated and/or their company doesn't want to address it, let the client know you'll start charging them for continued support for this particular (repeating) issue. Don't lower the security of the entire platform just because of a handful of users.
      
      Sébastien Vercammen
      
      ·
      8 years ago
      ·
      Reply