Tag Info

New answers tagged

0

Using CAPTCHA will not necessarily stop someone from brute-forcing user accounts. It just adds another hurdle to get over. Once the attacker develops an automatic way to answer the CAPTCHA correctly, then they will continue brute-forcing. There are several ways to prevent brute-forcing attempts against user accounts, but I believe the most effective ...


1

A couple of things to consider: Do you really want to hide your users' IDs/emails? It's worth considering whether users are likely to forget said username/email. When they forget it, a login form that says "id or password incorrect" is terribly frustrating. Think about how often your users login, and whether you send them any paper bills or letters they're ...


4

In your question, you mention that the app displays the text of the captcha right under it. If you mean that the correct answer to the captcha challenge is displayed to the user as text in addition to its display in an image, then it should be a simple matter to script an automated scan. Your script would be able to complete the login process by reading the ...


0

The best solution as pointed out by @schroeder is to use a non-captcha version of the website to run your scans. To answer your question, yes Captcha is used to prevent automated bots from accessing your website, so I would say it makes it some degree of more secure. This may be a little more work intensive but is it possible to manually work your way ...



Top 50 recent answers are included