Most of the sites will empty the password field when you fail the CAPTCHA, and often they reset all the fields as well.
Is there any security benefit on doing this?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this communityMost of the sites will empty the password field when you fail the CAPTCHA, and often they reset all the fields as well.
Is there any security benefit on doing this?
Emptying the password field: yes, this is a standard feature for all form submissions, not just ones where CAPTCHA failure is involved. If you returned a page with the user's password in then would you have to worry about it being saved in the browser's disc/page/bf cache and being recovered by later access to the client machine.
Emptying other fields: no security benefit against an automated attacker. I doubt this is a deliberate measure. I would suspect the sites in question simply don't consider it a usability priority to ensure the form is preserved for the convenience of a user they believe to be an attacker. (They may have an inflated sense of confidence in their CAPTCHA and don't think a real user will fail very often.)
It depends on how the data initially in the form is saved.
Suppose we had a form, which you had entered your password in. When you submitted this form, you failed the captcha verification.
What would you like the web application to do with your password from the initial form?
Either:
Both options seem quite insecure to me, and hence I would think it is much more safe to simply reset the fields.