3

Most of the sites will empty the password field when you fail the CAPTCHA, and often they reset all the fields as well.

Is there any security benefit on doing this?

Improve this question
3
  • A technical security benefit? Perhaps not. But if it annoys a spammer, they may move on to easier targets. Of course if it annoys a paying customer, they may also move on to a more friendly service provider as well.
    – John Deters
    Dec 6, 2013 at 4:29
  • 3
    Unless your service is mostly used by bots, you're going to annoy a LOT more legit users than spammers with such a measure.
    – Stephane
    Dec 6, 2013 at 10:49
  • I don't agree with the premise that it is common to reset all fields on CAPTCHA failure. My experience is otherwise similar to yours; the only field that is reset is the password field, if present.
    – scuzzy-delta
    Dec 6, 2013 at 21:42

2 Answers 2

Reset to default
2

Emptying the password field: yes, this is a standard feature for all form submissions, not just ones where CAPTCHA failure is involved. If you returned a page with the user's password in then would you have to worry about it being saved in the browser's disc/page/bf cache and being recovered by later access to the client machine.

Emptying other fields: no security benefit against an automated attacker. I doubt this is a deliberate measure. I would suspect the sites in question simply don't consider it a usability priority to ensure the form is preserved for the convenience of a user they believe to be an attacker. (They may have an inflated sense of confidence in their CAPTCHA and don't think a real user will fail very often.)

Improve this answer
0

It depends on how the data initially in the form is saved.

Suppose we had a form, which you had entered your password in. When you submitted this form, you failed the captcha verification.

What would you like the web application to do with your password from the initial form?

Either:

  1. Store the password from step one in some way or another (via your session cookie, or stored away somewhere)
  2. Use the data from the failed post request and append it to the form

Both options seem quite insecure to me, and hence I would think it is much more safe to simply reset the fields.

Improve this answer

You must log in to answer this question.