Tag Info

Hot answers tagged

28

CAPTCHAs are a trade-off between the patience of the attackers, and the patience of the normal users. Even if they can be beaten, they still serve their purpose if they slow down attackers sufficiently to discourage at least some of them, while not frightening too many potential users. Of course, as is customary in IT, a lot of systems are used and deployed ...


23

Everything (everything) in security is balanced against cost. The purpose of CAPTCHA, just like the purpose of encryption, the purpose of physical security, the purpose of passwords, and the purpose of virtually every other security measure[*] is to increase the cost of circumvention, not to make circumvention impossible. The intention is, specifically, to ...


14

Thinking outside the box... In most cases this applies: The business purpose for CAPTCHAs is to identify that the person accessing a page is a human being. The underlying reason for needing to know it it's a human is to prevent automated form submission, and the main reason for preventing that is to prevent brute force attacks. So the ultimate purpose ...


13

For this to be unethical there would need to be the potential for the information displayed to leak personal information. The numbers shown, while they have a small amount of background, do not show enough context for anyone to glean any extra information. The privacy issue of the source of these images, ie street view, is much more relevant as it allows ...


12

Yes, you are correct. The administrators running reCAPTCHA could request a CAPTCHA from your site and then perform a look-up to see which CAPTCHA was generated for your site and therefore the expected string which validates. The trade-off is that 1) they are probably trustworthy not to be doing this because of the potential damage to reputation if/when ...


10

A captcha prevents an attacker from performing more database-intensive operations that may cause a DoS via CPU or memory exhaustion. However, this is only the case when the CPU and memory consumption caused by generating the captcha image must be less than that of the normal page request. One way to ensure this is to use an off-site captcha service, such as ...


8

One alternative to a classic captcha is Microsoft Asirra (which I consider quite interesting). Instead of reading scrambled text, you have to select the cats from pictures containing either cats or dogs. They have over 3 million photos, so you should be safe against the more determined attackers. It is not very probable that someone will index all these ...


8

To answer a bit more explicitly: Do I need to use captcha if I am using AntiForgeryToken in an MVC application. If automated submissions are a problem then yes. Does AntiForgeryToken prevents automated form submission? No. A CSRF token basically ensures that a user visits a page (eg. the one which contains the form) before another action takes ...


7

I am not going into basics of CAPTCHAs based security as you can read it from Wikipedia. But what interesting is how accurate they are and what are the evaluating parameters for them. To my knowledge CAPTCHAs has been broken in research with image processing techniques but still requires practical implementation and its just a matter of time i.e. you can ...


7

Not relating specifically to Asirra, but wrt CAPTCHA in general, I will elaborate on @Graham's point and direct you to the following links: "Has reCaptcha been cracked / hacked / OCR'd / defeated / broken?" on SO My answer to "Practical non-image based CAPTCHA approaches?" on SO Presentation I gave on this topic at OWASP in 2008 Best idea yet (obligatory ...


7

They both solve different problems. CAPTCHA prevents automated signups. Email verification proves that the email address is valid. As such, you should use both. However, a determined spammer will simply outsource image based CAPTCHA solving to 3rd world countries, or get unsuspecting users to solve them via phishing attacks. The best type of CAPTCHA is ...


7

Yes. The most foolproof method is using humans for low wages, who will break ~1000 CAPTCHAs for ~$2. Certain CAPTCHAs have been broken at various times (though they often get upgraded to become more difficult), but still present a difficult barrier for spammers (who often will go to easier targets instead).


7

BY THE MAGICK POWER OF UNICORNS!!! Snark aside, CAPTCHA is a very poor solution for D/DoS protection. While it does have some effect, this is minimal, and easily compensated for by the attackers. CAPTCHA solves the wrong problem for this, and solves it badly. CAPTCHA does not try to rate-limit the connections; it is not intended to protect the login ...


7

Yes it can be done. It's trivial. There are many ways for a user or an attacker to have multiple IP addresses - or to share IP addresses. Here's a list, off the top of my head. These all assume that the IP address of the target system is exposed to your server. Either you're running some code (like JavaScript) to detect the IP address, or the client ...


6

Neither method is foolproof at blocking automated requests, but both have been effective for me in the past. Let me explain: Automating a response to an email is fairly easy, and thus cannot be taken as assurance that the client is not a bot. Similarly, captcha is easily broken (not even using humans). For instance, the hacker group DC949 recently released ...


6

If the site has a means of knowing it's the same user in the same session, then no. So for example given a cookie or an ssl session then it seems OK to assume it's still a human user (within the limits of captcha). If it's just a cookie that establishes the session (i.e. this is over http without SSL) then make sure to time it out tho. And you should be ...


6

It is easier/faster to check if a CAPTCHA is correct than to lookup a user in the database (this may include new connections, hashing and more). A server first check the CAPTCHA, if it is correct then process the rest of the login, if not return an error. It is important to note that making of a CAPTCHA image requires some processing, but this can be done ...


6

Here's how QapTcha works: The JS creates a hidden input field and populates it with a random value. When the user drags successfully, the JS posts that random value to a PHP script and clears the value from the form. It then creates a hidden input whose name is the random value. The PHP script verifies that a session variable hasn't been set, and that the ...


6

CAPTCHA systems are in no way a replacement for a good password policy. They aren't tackling the same problems. CAPTCHA systems only help when someone is attempting an online attack against your system. If your application has some hole that allows an attacker to dump a database full of password hashes, placing a CAPTCHA on every page won't do anything. ...


5

Phone numbers are easy to come by as are credit card numbers. Most credit card companies offer 1 time use credit card numbers and phone numbers can be had for less than a couple of bucks per month. It wouldn't be that hard to setup many SkypeIn or Google Voice numbers for example to get around the phone system issue. It would make things a little bit ...


5

Do I need to use captcha if I am using AntiForgeryToken in an MVC application? A CAPTCHA is a type of challenge-response test used in computing to determine whether or not the user is human. (...) CAPTCHAs are used to prevent bots from using various types of computing services or collecting certain types of sensitive information. - Wikipedia Cross-Site ...


4

This is almost certainly a scam, using the concept of "spam protection" to try to lull you into a false sense of security. The email is likely one of three four things: Spammers looking for real (active) email addresses, so they can focus their efforts. Spammers using you to solve their captchas for them. Pretty sneaky! A site stuffed with browser ...


4

A CAPTCHA would not be defeatable as an XSRF mitigation except by brute force, or another type of attack (eg clickjacking to frame the target site's UI in a redressing context). Image analysis could not be applied because an attacker from another site doesn't have read access to the content in the CAPTCHA. However! One defense that developers use to ...


4

CAPTCHAS are often used by sites not requiring an account (username, password). The content may then be trivially copied and used by another site. A CAPTCHAS is the equivalent of a deadbolt. It sends the thief to the neighbor's house instead of yours, because yours is slightly harder to break into.


4

The simplest way is to add a hidden input to your form, and refuse to submit the form is that input is filled. Another efficient way to do this is to generate a token cookie, store its value inside a hidden input, and compare both of form submission. Since most spambot can't handle JS, it won't work for them.


4

It's less of a matter of if the attacker can change their IP and more of a matter of good practice. If you don't have a captcha on your page, even initally, it allows for automated form submission which you definitely do not want. For example, an attacker that controls a botnet can target you, and then all IPs on the botnet would be different. The attacker ...



Only top voted, non community-wiki answers of a minimum length are eligible