My website has a registration form that forwards subscriptions to listmonk. My list is configured with double opt-in.
A few months ago, I switched to Altcha following the deprecation of hCaptcha support in listmonk.
I'm using listmonk's default complexity of 300,000, which is well above Altcha's suggested value of 100,000.
Recently, I started receiving an increasing number of spam subscriptions. As a workaround, I added a filtering step before forwarding requests to listmonk. It performs a few simple heuristics (for example, counting the number of dots in Gmail addresses, checking the ratio of uppercase letters to the total number of letters and digits in the given name, etc.) before passing the request to listmonk, which is still responsible for validating the Altcha challenge.
This worked reasonably well for a while, although it somewhat defeats the purpose of having a CAPTCHA in the first place.
Tonight, however, I was hit by a continuous stream of registrations from HeadlessChrome (identified by the sec-ch-ua: "HeadlessChrome";v="143", "Chromium";v="143", "Not A(Brand";v="24" header).
So I had to add yet another filter, but I'm now spending my time inventing heuristics and managing spam subscribers instead of working on my actual business.
But due to the double opt-in, an automatic confirmation email is sent to the address. That kind of attack just look for automatic email to saturate real inbox and hide a real attack. Besides wasting resources, this also hurts my mailing list quality and reputation.
Please don't remove the hCaptcha implementation nor deprecate its support. Altcha's proof-of-work approach is fundamentally ineffective against this kind of attack: a bot only has to spend a little more CPU time solving the challenge. It doesn't distinguish humans from automated clients; it merely makes large-scale abuse slightly more expensive.
My website has a registration form that forwards subscriptions to listmonk. My list is configured with double opt-in.
A few months ago, I switched to Altcha following the deprecation of hCaptcha support in listmonk.
I'm using listmonk's default complexity of 300,000, which is well above Altcha's suggested value of 100,000.
Recently, I started receiving an increasing number of spam subscriptions. As a workaround, I added a filtering step before forwarding requests to listmonk. It performs a few simple heuristics (for example, counting the number of dots in Gmail addresses, checking the ratio of uppercase letters to the total number of letters and digits in the given name, etc.) before passing the request to listmonk, which is still responsible for validating the Altcha challenge.
This worked reasonably well for a while, although it somewhat defeats the purpose of having a CAPTCHA in the first place.
Tonight, however, I was hit by a continuous stream of registrations from HeadlessChrome (identified by the
sec-ch-ua: "HeadlessChrome";v="143", "Chromium";v="143", "Not A(Brand";v="24"header).So I had to add yet another filter, but I'm now spending my time inventing heuristics and managing spam subscribers instead of working on my actual business.
But due to the double opt-in, an automatic confirmation email is sent to the address. That kind of attack just look for automatic email to saturate real inbox and hide a real attack. Besides wasting resources, this also hurts my mailing list quality and reputation.
Please don't remove the hCaptcha implementation nor deprecate its support. Altcha's proof-of-work approach is fundamentally ineffective against this kind of attack: a bot only has to spend a little more CPU time solving the challenge. It doesn't distinguish humans from automated clients; it merely makes large-scale abuse slightly more expensive.