network profile
| bio | website | blog.bigrails.com |
|---|---|---|
| location | Delaware | |
| age | 33 | |
| visits | member for | 2 years, 6 months |
| seen | Jun 18 '12 at 11:59 | |
| stats | profile views | 27 |
Developer and Security analyst
|
May 3 |
comment |
Why re-verify with CAPTCHA on failed form entry? maybe in YOUR application it shouldn't be secret. But in other applications, where the user name a social security number is the user, maybe for privacy the stakeholders want that as well private. |
|
May 2 |
comment |
Why re-verify with CAPTCHA on failed form entry? @João Portela, i don't know where in my comment i stated that. Do I? |
|
May 2 |
comment |
Why re-verify with CAPTCHA on failed form entry? for example, forms that allows the hacker to do user enumeration. e.g: if in the error message you can identify if the user that you are trying to create already exist. You can use it to find valid users and then do a more precise bruteforce :-) |
|
May 2 |
comment |
Why re-verify with CAPTCHA on failed form entry? i fixed my answer :-) |
|
Apr 26 |
comment |
Why re-verify with CAPTCHA on failed form entry? what you mean with "another CAPTCHA"? it did ask once and then after an failed login attempt, it show one another CAPTCHA? |
|
Apr 26 |
comment |
Why re-verify with CAPTCHA on failed form entry? no if the site, without CAPTCHA is vulnerable to CSRF. The browser being authenticated don't means that the user is authenticated to do this action. Example: h-online.com/security/… |
