How secure is a 4 digit numbers only captcha?
How many tries will take to be able to bruteforce that captcha?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Like 7, if the attacker is very lucky, or 70000, if the attacker is very unlucky. So whether this is "secure" depends on whether you limit attempts per IP, or per account, or how many attempts per second can be done in the first place, etc. It seems fairly obvious that with 9999 being the highest number, there are ten thousand possible values (since all zeroes is one of the options, 9999+1). If you guess randomly, you'll have a 1 in 10 000 chance of getting it right. After 10k attempts, you've got 50% chance of having guessed one right. There are a lot of questions on this site alone where these calculations are already done (looking for it is faster than waiting half an hour for someone to explain it yet again). How long this average of 10k attempts will take depends entirely on your circumstances. Furthermore, how difficult a CAPTCHA is, typically does not really depend on how many possible values there are, unless it's weirdly low like 4 digits and it actually might start to matter. Generally, it has to be quite unreadable before it cannot simply be determined (decoded from the image or audio file) rather than blindly guessed.
Doing some research yields some interesting information:
Probably the most easy to follow is the YouTube video "What is the probability of guessing a 4 digit pin code?" that explains how to determine the probability of guessing a 4 digit PIN (it's 1 in 10,000).
There are other conversations about permutations reducing the potential combinations, but the probability still seems to be the same.
The trick would be to limit the number of failed attempts in order to minimize the brute force potential.
Reference: Trefor Bazett's YouTube Channel, the specific video addressing the question is referenced above.