4

On Stack Exchange, if you login with your email address and password and then get captcha tested, you have to provide your credentials a second time after passing the captcha.

I've been trying to figure out what the possible security advantage is to this. It seems to me that by authenticating in the first instance, I've proven that I have possession of the credentials, and that by passing the captcha I've proven that I'm a human. These seem like independent tests to me.

Is there a security advantage and if so what is it?

7
  • 7
    Are you absolutely 100% sure that you entered the correct password the first time? I can only get the captcha to show by entering the wrong password several times, and it appears to be at least partially ip based as I haven't gotten it to show up since even when using another browser. Mar 27, 2018 at 19:26
  • @AndrolGenhald I'm about 90% - you have me doubting it now. Here's what I did: I typed my email address and clicked login accidentally with a blank password box. A red box popped up saying something like "there has been an error". I then entered my password by copy-pasting it out of a password manager (so no room for error). Then I got the captcha. Then I logged in again with the same paste. I will try to experiment further but as you noted it is not easy to trigger the captcha as and when you want it! Mar 27, 2018 at 19:39
  • 1
    @AndrolGenhald Confirmed. I just carried out the following steps: 1. Switched to Chromium. 2. Deliberately entered a wrong password. 3. Entered the correct password with copy-paste. 4. Passed the captcha. 5. Required to login again. 6. Entered the same copy-pasted password from step 3, and logged in successfully. Mar 27, 2018 at 19:42
  • 1
    Well...this is odd. I can reproduce now too, the reason I wasn't getting the captcha before was because I never entered the correct password the second time. It's a bit concerning that the captcha only seems to show up after a correct password attempt... Mar 27, 2018 at 19:52
  • Scratch that, I just got it to show up on an incorrect attempt too. It's very unclear to me what triggers it though. Mar 27, 2018 at 20:01

1 Answer 1

2

This could potentially be an additional protection measure against password-guessing botnets. As far as I can see, it is meant to confuse automated attackers even when they have a CAPTCHA farm, perhaps fooling them into detecting a rejected password attempt, although a correct password was given.

Due to this, it is likely designed to foil everyone except for a human who is highly confident that they have a correct password, which is to say, the authentic user.

1
  • The website might also trigger this behavior depending on risk factors like source IP address or region, date of day, old cookies etc. May 31, 2020 at 13:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .