Completely Automated Public Turing test to tell Computers and Humans Apart used in form validation to restrict access to humans only

learn more… | top users | synonyms

10
votes
4answers
38k views

Why Do we Need CAPTCHA? In what case we should use it?

In what case we should implement Captcha based security?. How accurate it is and if there exists any alternatives for Captcha based Security.
5
votes
5answers
2k views

How strong is visualCaptcha?

I like the user interaction of visualCaptcha, but I'm questioning the amount of protection it gives: Since there are only 5 images (by default), isn't is simply a matter of 1 in 5 to get the right ...
3
votes
2answers
80 views

CAPTCHA code refreshing vulnerability

Question is not programmatic but rather conceptual. When a user is trying to fill in a contact form and then CAPTCHA code, if he/she accidentally refreshes the page or doesn't fill a required input ...
0
votes
3answers
183 views

Should we fear spammbots that write constructive and helpful posts? [closed]

When I found this comic: I just asked my self, what flaws might this have? The system is sticking up with comments that require more comments on, but it would only be a problem if it where ...
29
votes
2answers
4k views

What triggers Google's reCAPTCHA

I noticed that Google's "I am not a robot" reCAPTCHA forces me to check correct images on my computer. I installed a virtual machine and tried there. Same thing. Used proxy. Same thing too. Then I ...
1
vote
2answers
164 views

Bypass CAPTCHA form made with 100% JavaScript?

There is a website I have found where the JavaScript handles the response of the CAPTCHA and then proceeds to fire what I believe is an AJAX request. So the flow is as follows: Button -> ...
6
votes
2answers
104 views

Are photo recognition captchas a reliable way to distinguish humans from bots?

You all know captchas that require you to either type some letters displayed in an obfuscated way as image. Recently I started to see more and more captchas that show you a set of small photos and ...
8
votes
2answers
726 views

Using optical illusions as CAPTCHA

Would using the "flaws" in human perception of an optical illusion graphic allow a system to differentiate between humans and machines (using these pictures like a CAPTCHA)? Some examples are where a ...
11
votes
7answers
4k views

How does CAPTCHA mitigate DDoS attacks?

This seems like an easy question, but I've failed to find an answer. One of the uses of CAPTCHA is to cope mitigate Denial of Service attacks. Suppose an adversary performs excessive login attempts, ...
1
vote
1answer
159 views

Yii client side captcha validation

Apparently, Yii web application framework generates some kind of hash value from captcha codes it generates and sends it to the client side so it can be used for client side validation of the captcha ...
0
votes
1answer
78 views

ReCaptcha Placement

I wish to use google's new version 2.0 reCaptcha on my website. My website displays some users' (public) information to other registered users. Where is the best place to place the reCaptcha? 1) On ...
0
votes
0answers
112 views

How necessary is CAPTCHA (or similar) in REST APIs?

I'm currently implementing a REST API designed to be consumed by multiple platforms (iOS, Android, HTML5/Javascript), and I'm trying to protect my service and reduce (AWS) costs by preventing bots ...
5
votes
4answers
4k views

CAPTCHA or email confirmation?

I have read that captcha isn't a perfect solution to protect a website where for example the user can create an account, since there are many people in different countries that practicallty read ...
20
votes
7answers
3k views

Are reCAPTCHA enough to prevent brute-force password guesses?

I was wondering if reCAPTCHA were strong enough to prevent BruteForce from bots or if I needed to add more security, such as sending a unique mail to the user every 5 tries that someone try to log on ...
0
votes
1answer
59 views

Can handwritten captchas be used?

Suppose a user has just created a new account on some site. You ask him to submit an image of a para of neat handwritten text, along with a typed version of the same text. Then this is kept secret. ...
1
vote
0answers
243 views

Best practices to implement a secure CAPTCHA [closed]

What are the best practices to implement a secure CAPTCHA? Also I want to know: What is the best way to identify an insecure CAPTCHA?
21
votes
2answers
10k views

How does Google's “No Captcha reCaptcha” work?

Google has released a new form of captcha identification of bots, that asks the user to click a single checkbox. It uses image-based verification only if necessary. Could someone please explain to me ...
28
votes
3answers
6k views

Is there anything insecure about Google ReCaptcha?

In this question on software recommendations, the OP asks for an alternative to Google reCAPTCHA because "for a security reasons also we don't want to depend on any out side services". As far as I ...
1
vote
1answer
58 views

CAPTCHA on pages secured with login

My local mobile carrier (Play, Poland) and its paid SMS gate is the first example, that I recall in my entire Internet history, that forces users to fill out dully CAPTCHAs even on pages, which are ...
1
vote
3answers
321 views

How to prove ownership of a website?

We all know how banks identify themselves to users. No, not through TLS certificates. The users pay no attention to those. No, I'm talking about branding-- all those fancy logos and stock photos that ...
14
votes
3answers
3k views

Best practice in web application security authentication to avoid bruteforce attack

I want to cover the possible cases of attacking. My application already has captcha and two-factor authentication, but how can I avoid a tiny attack without annoying my users? The possible cases that ...
0
votes
4answers
533 views

How to secure my captcha application?

Hello information security stack exchange! I made a captcha application in PHP. It's certainly not a great idea to do so, but I was bored and I wanted to learn about Bézier curves and Bresenham line ...
8
votes
3answers
2k views

Is there any reason to include the remote ip when using reCaptcha?

I am implementing Google's reCaptcha in my app. According to the documentation, my API request must include my secret key and the response, and optionally the user's remote ip. For what reasons would ...
23
votes
9answers
5k views

Is it helpful to have a captcha on a login screen?

I introduced recaptcha to the login screen of a system. My goal was all about security things like dictionary/bots attacks or other thing of that type. The users now hate it, Some did not even ...
2
votes
2answers
2k views

Are captchas based on ASCII art secure enough? [closed]

I have just came across an ASCII art captcha, something that I have never seen before. It seems to be really easy to implement server side! Are ASCII art captchas secure enough?
1
vote
0answers
153 views

How to generate a CAPTCHA? [closed]

I want to generate my own CAPTCHA. I am using PIL library of Python to generate an image. I would like to know how should the image be (i.e. numbers with weird font style or some mathematical ...
8
votes
1answer
1k views

Why is it hard to prevent scalpers from using bots to buy up lots of concert tickets?

The New York Times recently has an article that talks about how scalpers are using bots to programmatically buy up lots of concert tickets, making it harder for ordinary fans to buy up tickets. For ...
0
votes
2answers
104 views

Contact form without validation

one of our web page is a contact form eg name, email, and a textbox for sending comments. It seems like if we leave all of those text fields blank and click the submit button, it still went through ...
0
votes
2answers
251 views

Is CAPTCHA necessary when I use token?

I wonder is it a good idea using captcha when using token on login page? I think it's impossible for robots to mess with login page because token changes on every request. Thanks.
1
vote
1answer
483 views

Does Google hand over captcha IPs to webmasters?

Google gets to know a user's IP when someone enters a captcha even if they are using tor (see http://www.wired.com/2014/12/google-one-click-recaptcha/). So, If I go to a non-google website, such as ...
-1
votes
1answer
306 views

How can I test my CAPTCHA's (or CAPTCHA-alternative's) effectiveness?

Are there any tools available to test the effectiveness of user Turing tests such as CAPTCHAs or honeypots, without intentionally getting the site targeted by spam bots? Or, do I simply have to ...
-2
votes
2answers
223 views

I don't use captcha in image upload form am I safe?

I don't use captcha for image upload form because I know that upload box value cannot fill automatically, needs to be filled by user manually. Are there any ways that somebody automatically post huge ...
11
votes
12answers
7k views

Is there a true alternative to using CAPTCHA images?

Security is about balancing costs and risks, nothing is impossible to beat, specially not typical CAPTCHA implementations, but they do add something no other system seems to offer. I've been reading ...
2
votes
2answers
462 views

CAPTCHAs: How does simple math in cleartext prove you're human?

I'm intrigued that many sites use seemingly random numbers with a random operator as a security check to validate that you're not a bot. Forgive my ignorance in captcha technology, but what is ...
-1
votes
1answer
140 views

Weird characters from contact page [closed]

We've just recreated a contact form on a HTML webpage. We've implemented Google reCaptcha to prevents bots and spammers from abusing the form. We've received some feedback from our client, saying ...
0
votes
1answer
430 views

CAPTCHA Bypassing with Captcha Clipping Attack is Like MiTM between servers, Is that even Possible?

Sorry if this is a very amateur question. I was checking out some article regarding CAPTCHA bypassing. And I though this article seemed interesting http://blog.opensecurityresearch.com/2012/08/...
3
votes
1answer
446 views

A potential CAPTCHA phishing attack against reCAPTCHA?

In reCAPTCHA's API (without plugin), the key part is <iframe src="http://www.google.com/recaptcha/api/noscript?k=your_public_key" height="300" width="500" frameborder="0"></iframe>&...
7
votes
3answers
2k views

AntiForgeryToken versus Captcha

I am having some question regarding captcha and AntiForgeryToken Do I need to use captcha if I am using AntiForgeryToken in an MVC application. Does AntiForgeryToken prevents automated form ...
4
votes
2answers
382 views

Human or Bot: Behind the Scene Checks vs CAPTCHA

I'm working on a web app at the moment where we’re trying to remove any user friction and excess steps from our user creation page. To avoid computer bots completely spamming our app we need to have a ...
2
votes
1answer
2k views

REST API: does securing the first call with a CAPTCHA make sense?

Let's say I have an iOS/Android app which rely on a custom REST API for things such as account management (register, login, password reset, get/set user-related data). There is no good way to ...
0
votes
2answers
249 views

Showing CAPTCHA

I'd like to show a CAPTCHA to prevent brute forcing attempts, but I was thinking of showing it whenever a user fails for an invalid username/password combination after X attempts, regardless of ...
3
votes
2answers
886 views

how to scan a web application that uses Captcha

I have a web application I am doing a security assessment on and it uses captcha for both the login and for certain operations inside the app. The interesting thing is that this particular app ...
9
votes
5answers
3k views

Is it ethical to use ReCAPTCHA to decode house addresses? [closed]

I noticed recently that ReCAPTCHA is using house numbers and street numbers as images for humans to decode. How ethical is it for Google to do this to this? Does it hamper privacy of an ...
2
votes
4answers
552 views

How to prevent users from downloading information from our search engine?

We have developed a search engine (simple search, no login required) where users can search details in the database (Apache Lucene) by entering their name (et. al.), then clicking the search button. ...
10
votes
1answer
1k views

Would using Google reCAPTCHA allow Google to cheat?

Wanting to go a step further into reducing the attacking surface from my "register new user" form I think on using reCAPTCHA (the one Google offers). Having bots sorted out from being able to ...
2
votes
3answers
2k views

Is it possible to change IP after each request

I am developing a web application. I am planning to skip CAPTCHAs for the initial signup by an IP so as to improve user experience. I was wondering if I am inviting any security risks by doing this. ...
3
votes
2answers
197 views

What are the security benefits of reset all fields if captcha was failed?

Most of the sites will empty the password field when you fail the CAPTCHA, and often they reset all the fields as well. Is there any security benefit on doing this?
2
votes
5answers
1k views

Anyone using Asirra in production? Are there similar alternatives?

The Asirra project is a Captcha alternative that shows you pictures of kittens and puppies to fend off bots and prove that the end user is a human. Is anyone using Asirra (or something similar) in ...
2
votes
3answers
257 views

What is a good way of preventing captcha jacking attacks?

Captcha jacking is an attack to bypass a captcha by coercing a human into solving the challenge response. Prof of concept code that uses a proxy can be found here. Is there a good method of ...
4
votes
0answers
384 views

What are the statistics on how often client form submissions fail CAPTCHAs? [closed]

We've got plenty of argument that CAPTCHA can easily be beaten, and that they introduce usability problems to users. People say that because they can be broken, they shouldn't be used. So if you've ...