CAPTCHA code refreshing vulnerability

Question

Question is not programmatic but rather conceptual.

When a user is trying to fill in a contact form and then CAPTCHA code, if he/she accidentally refreshes the page or doesn't fill a required input field, he/she will come back to same page usually with a renewed CAPTCHA code. The user then needs to refill inputs and alas, encounters another CAPTCHA code which has to be solved again.

I - being a user before a developer - see it as a chore to constantly complete CAPTCHAs and wish that it could be changed in some way that doesn't make me unnecessarily distinguish those annoying characters another time.

Then being in my developer's shoes, I decide to change the way the CAPTCHA code is shown. I keep CAPTCHA code in a session and won't renew it programmatically unless:

1. User wants to refresh it.
2. User makes X mistakes in entering the same CAPTCHA code. (e.g. 3 times)

Otherwise, in each request the same characters are shown, there is no need to worry about unwanted refreshes. But being the developer who thought about it, there may be chances that someone could bypass it or do sabotaging things that I'm not aware of.

Can implementing this concept be safe and if not what could be its vulnerabilities?

Answer 1

I don't see how there could possibly be a security risk or other vulnerability as a result of implementing the feature you suggest. The reason is simple: since there is no security risk or other vulnerability to not having a CAPTCHA in the first place (with the possible exception of a DOS attack if the action the CAPTCHA protects is a slow action), any modification you make to the CAPTCHA should not create a new security risk. The purpose of a CAPTCHA is simply to prevent pointless actions to reduce the resource footprint by the host, but none of those actions should be related to security, as humans can do them too.

So, even if you mess up the feature and make the CAPTCHA easier to beat, there shouldn't be any new security vulnerability as a result of doing so.

As for whether or not it's a good idea, in my experience users rarely accidentally refresh the page, and a good UI will highlight the required fields, so the most likely error during submission is the CAPTCHA itself, which you probably want to change after each attempt if the only error was the CAPTCHA (to prevent a bot from getting multiple attempts at the same CAPTCHA). I think you're fine though; the worst case scenario is a bot is slightly more likely to beat it. No big deal...

Answer 2

Instead of trying to fine-tune the behavior of CAPTCHAs on a form, consider that most users hate CAPTCHAs and you should look instead to solve the problem you are really trying to solve. Perhaps you can eliminate the CAPTCHAs entirely, which would make your users much happier than slightly less confusing CAPTCHA behavior.

CAPTCHAs are primarily used to reduce the number of problems caused by robot spammers. Some spammers use tools that seek out web page registration forms and attempt to register new accounts. Once a new account has been created and activated, the spammer posts links to their services in the hopes that Google will index their results, making their garbage seem more legitimate. The polite term for this spamming activity is "Search Engine Optimization".

Note that this is a "soft" use of CAPTCHAs. There are millions of sites out there, so the site owner only needs to raise enough of a hurdle to keep the spammers from easily abusing his.

If that is the primary reason for the CAPTCHA, consider other ways to defeat the spammers. Add ref=nofollow tags to all user comments so they won't get indexed by Google. Use a moderation system so that new posters comments are reviewed before being posted to all members. Perhaps ensure new users can't post actual links until they're approved. I've even seen sites with a check box on the comment page that says "check this box if you are not a spammer", and it's been almost as effective. Again, the goal is to raise the hurdles to keep the automated spammers away.

If the CAPTCHA is being used to protect something more valuable, such as trying to prevent scalpers from automatically purchasing hundreds of event tickets, you probably don't want to weaken the system at all.