2

On Last.fm, I need to complete a CAPTCHA in order to change my password. I want to change my password because haveibeenpwned lists my account as appearing in the last.fm breach. However, the CAPTCHA appears to be impossible to solve, so I had to forfeit the account instead (deleting my account does not require a CAPTCHA). This made me wonder:

Why should one have to fill out a CAPTCHA in the first place, when one already logged in successfully and is just trying to change their password? What attack does it prevent?

  • 3
    It might marginally help prevent mass automated password changes after a breach. – AndrolGenhald Feb 21 '18 at 23:02
  • 2
    I genuinely suspect a security guy at last.fm said "we need to add a CAPTCHA to the password reset form" and by that he meant to protect the public password reset form against spam (the one where you enter your email address and get a reset link). But a dev instead implemented it for the authenticated reset form in the account settings where it doesn't really make a difference. – Arminius Feb 21 '18 at 23:13
  • CAPTCHA is required to avoid brute force attacks. Even though you have logged in but if you do not complete the captcha, it will look like as if you are a robot. It is not a best preventive, but still a good preventive. – tech_enthusiast Feb 21 '18 at 23:59
1

As mentioned by AndrolGenhald, it could be to provent automated takeover of accounts with compromised credentials. Even without the last.fm breach, I imagine that whenever credentials are breached for any site, robots try out the credentials on a bunch of different websites, possibly including last.fm (this is why it's bad to reuse credentials).

While last.fm, like other sites, could put a captcha on their login page, it would be much more inconvient since users typically log in much more often than they reset their passwords.

In the end, they are blocking robots from doing the thing that would be the easiest to automatically do to hacked accounts: reset the password

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.