3

On Stack Exchange, if you login with your email address and password and then get captcha tested, you have to provide your credentials a second time after passing the captcha.

I've been trying to figure out what the possible security advantage is to this. It seems to me that by authenticating in the first instance, I've proven that I have possession of the credentials, and that by passing the captcha I've proven that I'm a human. These seem like independent tests to me.

Is there a security advantage and if so what is it?

  • 6
    Are you absolutely 100% sure that you entered the correct password the first time? I can only get the captcha to show by entering the wrong password several times, and it appears to be at least partially ip based as I haven't gotten it to show up since even when using another browser. – AndrolGenhald Mar 27 '18 at 19:26
  • @AndrolGenhald I'm about 90% - you have me doubting it now. Here's what I did: I typed my email address and clicked login accidentally with a blank password box. A red box popped up saying something like "there has been an error". I then entered my password by copy-pasting it out of a password manager (so no room for error). Then I got the captcha. Then I logged in again with the same paste. I will try to experiment further but as you noted it is not easy to trigger the captcha as and when you want it! – Jon Bentley Mar 27 '18 at 19:39
  • 1
    @AndrolGenhald Confirmed. I just carried out the following steps: 1. Switched to Chromium. 2. Deliberately entered a wrong password. 3. Entered the correct password with copy-paste. 4. Passed the captcha. 5. Required to login again. 6. Entered the same copy-pasted password from step 3, and logged in successfully. – Jon Bentley Mar 27 '18 at 19:42
  • 1
    Well...this is odd. I can reproduce now too, the reason I wasn't getting the captcha before was because I never entered the correct password the second time. It's a bit concerning that the captcha only seems to show up after a correct password attempt... – AndrolGenhald Mar 27 '18 at 19:52
  • Scratch that, I just got it to show up on an incorrect attempt too. It's very unclear to me what triggers it though. – AndrolGenhald Mar 27 '18 at 20:01
0

This could potentially be an additional protection measure against password-guessing botnets. As far as I can see, it is meant to confuse automated attackers even when they have a CAPTCHA farm, perhaps fooling them into detecting a rejected password attempt, although a correct password was given.

Due to this, it is likely designed to foil everyone except for a human who is highly confident that they have a correct password, which is to say, the authentic user.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.