Tag Info

New answers tagged

1

There is another reason - a lot of internal networks use recaptcha too - like on WiFi hotspots, and things like that. In these circumstances, Google sees both the user and server's IP as the same, since they share the same connection. Giving Google the user's local IP allows the risk-assesment machine to do a better job of tracking individuals who are ...


0

To prevent brute force attacks, you would be better to do the following. 1) Ensure that passwords are complex enough. If given the chance a lot of users will use extremely simple passwords, like their name etc. Passwords should be at least 8 characters, and should include numbers, letters, and mixed case. 2) Lock-out IP's after 5 failed login attempts. It ...


2

Think for a moment about what your captcha is trying to accomplish. Here is the goal I can think of: Prevent a large-scale automated attack from breaking into weak accounts Here's a way to do that which will probably make your users happier: If a computer successfully logs in (as Bob), set a cookie on that computer so the server knows that computer ...


1

Adding a captcha after 10 or 100 failed attempts it useless, as most current bots have a deathbycaptcha account, and the API for dbc is really easy to use. So, showing a captcha every second time is a good thing, I think.


3

Another way of attacking this might be to install a "honeypot". This is an ordinary input field which is included in the HTML together with the login fields (username, password), but this extra field is hidden using CSS. Typically, bots will try to enter text in all the fields shown in the HTML, so in PHP I checked that if the honeypot field were not empty ...


5

A captcha on a login screen makes no sense. I'm not surprised your users hated it. The purpose of captcha fields on forms is to prevent them being submitted by bots. A bot should not be able to login through your login screen, as it should not have valid credentials. If a bot can guess valid credentials, then you need to increase password strength.


3

Adding a Captcha or ReCaptcha is not a solution, it is merely an obstacle for both hackers and users. I have very good vision with my glasses and sometimes I can barely make out the image text. I would imagine that someone in denial about their vision is going to be infuriated. Everything you implement needs to have a specific purpose or else you just end ...


5

The users now hate it, Some did not even understand it and I had to remove it. This is where you'll have to make the decision between usability and security. Altough it is useful to have a captcha on your login pages, it's incredibly user unfriendly. My best tip would to log every invalid login attempt to a database, and before authenticating the user, ...


39

The way I've seen some large systems do it is to only require a captcha after sequential failed login attempts (ie: reset the count after a valid login). If you are worried about automated cracking, you could put the captcha at some high number of failures like 20, 50, 100 failed attempts. Almost no legitimate user will see the captcha, but an automated ...


3

CAPTCHA systems are there to differentiate between automated bots and real users. Unfortunately, as you've noted, they aren't very convenient (in particular for disabled users). Whether it's "a good idea" or not depends on your use case, really, although they aren't very efficient with user logins: they are not very useful to prevent password guessing ...



Top 50 recent answers are included