Completely Automated Public Turing test to tell Computers and Humans Apart used in form validation to restrict access to humans only

learn more… | top users | synonyms

-1
votes
1answer
67 views

Weird characters from contact page [on hold]

We've just recreated a contact form on a HTML webpage. We've implemented Google reCaptcha to prevents bots and spammers from abusing the form. We've received some feedback from our client, saying ...
13
votes
2answers
2k views

Best practice in web application security authentication to avoid bruteforce attack

I want to cover the possible cases of attacking. My application already has captcha and two-factor authentication, but how can I avoid a tiny attack without annoying my users? The possible cases that ...
3
votes
1answer
114 views

A potential CAPTCHA phishing attack against reCAPTCHA?

In reCAPTCHA's API (without plugin), the key part is <iframe src="http://www.google.com/recaptcha/api/noscript?k=your_public_key" height="300" width="500" ...
3
votes
3answers
915 views

AntiForgeryToken versus Captcha

I am having some question regarding captcha and AntiForgeryToken Do I need to use captcha if I am using AntiForgeryToken in an MVC application. Does AntiForgeryToken prevents automated form ...
4
votes
2answers
118 views

Human or Bot: Behind the Scene Checks vs CAPTCHA

I'm working on a web app at the moment where we’re trying to remove any user friction and excess steps from our user creation page. To avoid computer bots completely spamming our app we need to have a ...
0
votes
1answer
243 views

REST API: does securing the first call with a CAPTCHA make sense?

Let's say I have an iOS/Android app which rely on a custom REST API for things such as account management (register, login, password reset, get/set user-related data). There is no good way to ...
0
votes
2answers
82 views

Showing CAPTCHA

I'd like to show a CAPTCHA to prevent brute forcing attempts, but I was thinking of showing it whenever a user fails for an invalid username/password combination after X attempts, regardless of ...
3
votes
2answers
181 views

how to scan a web application that uses Captcha

I have a web application I am doing a security assessment on and it uses captcha for both the login and for certain operations inside the app. The interesting thing is that this particular app ...
8
votes
5answers
2k views

Is it ethical to use ReCAPTCHA to decode house addresses? [closed]

I noticed recently that ReCAPTCHA is using house numbers and street numbers as images for humans to decode. How ethical is it for Google to do this to this? Does it hamper privacy of an ...
2
votes
0answers
57 views

How to make a captcha maker [closed]

I want to make a captcha maker. I am using PIL library of python to generate an image. I would like to know how should the image be (i.e. numbers with weird font style or some mathematical ...
2
votes
4answers
459 views

How to prevent users from downloading information from our search engine?

We have developed a search engine (simple search, no login required) where users can search details in the database (Apache Lucene) by entering their name (et. al.), then clicking the search button. ...
0
votes
1answer
238 views

CAPTCHA Bypassing with Captcha Clipping Attack is Like MiTM between servers, Is that even Possible?

Sorry if this is a very amateur question. I was checking out some article regarding CAPTCHA bypassing. And I though this article seemed interesting ...
5
votes
1answer
290 views

Would using Google reCAPTCHA allow Google to cheat?

Wanting to go a step further into reducing the attacking surface from my "register new user" form I think on using reCAPTCHA (the one Google offers). Having bots sorted out from being able to ...
2
votes
3answers
904 views

Is it possible to change IP after each request

I am developing a web application. I am planning to skip CAPTCHAs for the initial signup by an IP so as to improve user experience. I was wondering if I am inviting any security risks by doing this. ...
3
votes
2answers
166 views

What are the security benefits of reset all fields if captcha was failed?

Most of the sites will empty the password field when you fail the CAPTCHA, and often they reset all the fields as well. Is there any security benefit on doing this?
0
votes
4answers
232 views

How to secure my captcha application?

Hello information security stack exchange! I made a captcha application in PHP. It's certainly not a great idea to do so, but I was bored and I wanted to learn about Bézier curves and Bresenham line ...
2
votes
3answers
180 views

What is a good way of preventing captcha jacking attacks?

Captcha jacking is an attack to bypass a captcha by coercing a human into solving the challenge response. Prof of concept code that uses a proxy can be found here. Is there a good method of ...
3
votes
0answers
261 views

What are the statistics on how often client form submissions fail CAPTCHAs? [closed]

We've got plenty of argument that CAPTCHA can easily be beaten, and that they introduce usability problems to users. People say that because they can be broken, they shouldn't be used. So if you've ...
7
votes
1answer
439 views

Why is it hard to prevent scalpers from using bots to buy up lots of concert tickets?

The New York Times recently has an article that talks about how scalpers are using bots to programmatically buy up lots of concert tickets, making it harder for ordinary fans to buy up tickets. For ...
1
vote
1answer
221 views

CAPTCHA Weakness to Automated Attack

EDIT: This question was dumb, I misread the quote that made me ask it. Sorry. This is more of a follow up question from schroeder's answer to another question. schroeder said that CAPTCHAs are ...
1
vote
5answers
285 views

Should I enforce a password policy on a web site?

For a commercial web site, is it important to impose some restriction on passwords to access the system? Eg. special $char, Upper and lower case, numbers, at least a minimum length... Can a CAPTCHA ...
1
vote
1answer
325 views

Can a Javascript - WebGL proof of work system prevent website spam?

Is it a good idea to come up with a Javascript-based Proof of Work system to reduce spam on forums, and other websites? This idea would be similar to HashCash, but the computation would be based on ...
1
vote
5answers
450 views

Good ways to prevent spammers from registering [duplicate]

Possible Duplicate: Is there a true alternative to using CAPTCHA images? Since everyone hates captchas what are good alternatives? I'm looking to prevent the automated creation of accounts ...
9
votes
11answers
5k views

Is there a true alternative to using CAPTCHA images?

Security is about balancing costs and risks, nothing is impossible to beat, specially not typical CAPTCHA implementations, but they do add something no other system seems to offer. I've been reading ...
22
votes
3answers
2k views

If we know CAPTCHA can be beat, why are we still using them?

If we know CAPTCHA can be beat, why are we still using them? A 35% to 90% success rate like wikipedia is stating means software is better at solving CAPTCHAs then I am.
7
votes
4answers
11k views

Why Do we Need CAPTCHA? In what case we should use it?

In what case we should implement Captcha based security?. How accurate it is and if there exists any alternatives for Captcha based Security.
1
vote
1answer
301 views

Protect database resources from fake data inputs via web forms

Scenario: I'm working on a project that needs to accept large amounts of data (customer data) from its users. So it can be normal to have a user trying to add 10,000 or 100,000 records at a time. In ...
5
votes
5answers
2k views

How does CAPTCHA mitigate DDoS attacks?

This seems like an easy question, but I've failed to find an answer. One of the uses of CAPTCHA is to cope mitigate Denial of Service attacks. Suppose an adversary performs excessive login attempts, ...
3
votes
4answers
2k views

CAPTCHA or email confirmation?

I have read that captcha isn't a perfect solution to protect a website where for example the user can create an account, since there are many people in different countries that practicallty read ...
-4
votes
2answers
968 views

Is it possible to break captcha? [duplicate]

Possible Duplicate: Can a CSRF CAPTCHA be defeated? Is it to possible break captcha? If yes, how? If no, why websites use difficult captcha systems?
2
votes
2answers
151 views

Are these email captchas legitimate?

The last week, I've been getting this kind of emails to addresses that I don't use: Dear Sir, Madam, For security reasons and as part of our ongoing fight against spam, it is our policy not ...
1
vote
1answer
300 views

How reliable/secure is QCaptcha?

QCaptcha is an alternative way to protect a website from bots. It required a drag and drop action like this: Question How reliable is this implementation when compared to others mentioned on ...
3
votes
4answers
1k views

Can a CSRF CAPTCHA be defeated?

One defense that developers use to protect against a CSRF attack is to implement a CAPTCHA in critical steps. A CAPTCHA ensures that a human is at the keyboard approving the activity. But I've ...
5
votes
5answers
593 views

Why re-verify with CAPTCHA on failed form entry?

Is there a reason for sites to ask for another CAPTCHA verification when some other part of the registration form, e.g. the username, was invalid?
8
votes
7answers
625 views

What type of captcha will you recommend?

What type of captcha will you recommend? I am looking mainly at usability, ease of use (development too), relatively secure Usability I find that those captcha with very curly words/numbers are ...
2
votes
5answers
1k views

Anyone using Asirra in production? Are there similar alternatives?

The Asirra project is a Captcha alternative that shows you pictures of kittens and puppies to fend off bots and prove that the end user is a human. Is anyone using Asirra (or something similar) in ...