Replacing a visible CAPTCHA without opening a hole

• Understanding the Attacks
• The Cost of Visible CAPTCHAs
• Invisible Checks
• Implementing Invisible Checks
• Testing and Evaluation
• Server-Side Validation
• Removing Visible CAPTCHAs
• Conclusion

Abuse reaches online store forms in various ways, including card testing at checkout, credential stuffing on login, fake accounts and promo farming, and gift-card guessing. These attacks can lead to significant financial losses and damage to a store’s reputation. One common defence against these attacks is the use of visible CAPTCHAs, which require users to complete a challenge, such as identifying objects in an image, to prove they are human. However, visible CAPTCHAs can be frustrating for real buyers, leading to abandoned carts and lost sales. A more effective approach is to use invisible checks, such as proof-of-work challenges, that do not interrupt the user experience.

§Understanding the Attacks

Card testing at checkout involves attackers attempting to use stolen credit card numbers to make purchases. This can lead to significant financial losses for the store, as well as damage to its reputation. Credential stuffing on login involves attackers using automated tools to try stolen login credentials on a store’s website. Fake accounts and promo farming involve attackers creating fake accounts to take advantage of promotions and discounts. Gift-card guessing involves attackers attempting to guess the codes on gift cards to redeem them for cash or merchandise. These attacks can be costly and time-consuming to defend against, and can lead to significant financial losses if not addressed.

§The Cost of Visible CAPTCHAs

Visible CAPTCHAs can be effective at preventing automated attacks, but they can also be frustrating for real buyers. Users may struggle to complete the challenge, leading to abandoned carts and lost sales. Additionally, visible CAPTCHAs can be expensive to implement and maintain, requiring significant resources to ensure they are effective. Furthermore, visible CAPTCHAs can be bypassed by determined attackers, who may use automated tools to complete the challenge or hire humans to complete it on their behalf. As a result, visible CAPTCHAs may not be the most effective defence against abuse, and may actually drive away legitimate customers.

§Invisible Checks

Invisible checks, such as proof-of-work challenges, offer a more effective and user-friendly alternative to visible CAPTCHAs. These challenges require users to perform a task, such as solving a mathematical problem, to prove they are human. However, unlike visible CAPTCHAs, invisible checks do not interrupt the user experience, and can be completed in the background without the user even noticing. This makes them a more effective defence against abuse, as they do not drive away legitimate customers. Additionally, invisible checks can be more effective at preventing automated attacks, as they require a significant amount of computational power to complete.

§Implementing Invisible Checks

Implementing invisible checks requires careful consideration of several factors, including the type of challenge to use, the level of difficulty, and the user experience. The challenge should be difficult enough to prevent automated attacks, but not so difficult that it frustrates legitimate users. Additionally, the user experience should be carefully considered, to ensure that the challenge does not interrupt the user’s flow. This can be achieved by using a challenge that can be completed in the background, without requiring the user to take any action. By carefully considering these factors, stores can implement invisible checks that are effective at preventing abuse, while also providing a good user experience.

§Testing and Evaluation

Once invisible checks have been implemented, it is essential to test and evaluate their effectiveness. This can be done by monitoring the number of automated attacks that are prevented, as well as the user experience. Stores should also monitor the number of false positives, where legitimate users are incorrectly flagged as automated attackers. By carefully evaluating the effectiveness of invisible checks, stores can make adjustments as needed to ensure that they are providing a good user experience, while also preventing abuse.

§Server-Side Validation

In addition to invisible checks, server-side validation is also essential for preventing abuse. This involves validating user input on the server-side, to ensure that it is legitimate and not automated. Server-side validation can be used in conjunction with invisible checks, to provide an additional layer of defence against abuse. By validating user input on the server-side, stores can ensure that automated attacks are prevented, even if the invisible check is bypassed. This provides a robust defence against abuse, and helps to prevent financial losses and damage to the store’s reputation.

§Removing Visible CAPTCHAs

Once invisible checks and server-side validation have been implemented, visible CAPTCHAs can be removed. This can help to improve the user experience, by reducing the number of challenges that users must complete. Additionally, removing visible CAPTCHAs can help to reduce the cost of implementing and maintaining them, as well as the cost of false positives, where legitimate users are incorrectly flagged as automated attackers. By removing visible CAPTCHAs, stores can provide a more streamlined and user-friendly experience, while also preventing abuse.

§Conclusion

Abuse reaches online store forms in various ways, including card testing at checkout, credential stuffing on login, fake accounts and promo farming, and gift-card guessing. Visible CAPTCHAs can be effective at preventing automated attacks, but they can also be frustrating for real buyers. Invisible checks, such as proof-of-work challenges, offer a more effective and user-friendly alternative to visible CAPTCHAs. By implementing invisible checks, testing and evaluating their effectiveness, using server-side validation, and removing visible CAPTCHAs, stores can provide a robust defence against abuse, while also improving the user experience. To get started, you can use the free scanner to check which CAPTCHA a page shows, and whether its forms are exposed, and then consider the free plan for your online store.