615 reputation
1610
bio website github.com/vpereira
location Delaware
age 34
visits member for 4 years
seen Oct 29 at 20:51

Developer and Security analyst


May
3
comment Why re-verify with CAPTCHA on failed form entry?
maybe in YOUR application it shouldn't be secret. But in other applications, where the user name a social security number is the user, maybe for privacy the stakeholders want that as well private.
May
2
comment Why re-verify with CAPTCHA on failed form entry?
@João Portela, i don't know where in my comment i stated that. Do I?
May
2
comment Why re-verify with CAPTCHA on failed form entry?
for example, forms that allows the hacker to do user enumeration. e.g: if in the error message you can identify if the user that you are trying to create already exist. You can use it to find valid users and then do a more precise bruteforce :-)
May
2
comment Why re-verify with CAPTCHA on failed form entry?
i fixed my answer :-)
Apr
26
comment Why re-verify with CAPTCHA on failed form entry?
what you mean with "another CAPTCHA"? it did ask once and then after an failed login attempt, it show one another CAPTCHA?
Apr
26
comment Why re-verify with CAPTCHA on failed form entry?
no if the site, without CAPTCHA is vulnerable to CSRF. The browser being authenticated don't means that the user is authenticated to do this action. Example: h-online.com/security/…