2

I have previously analysed an online contest and found that it was trivial to reverse engineer the handshake process since it was all done in javascript. As a result, it was possible to code an automated client that submits entries repeatedly and cheat the contest. The nature of the contest hinges on submitting as many entries as possible to get a higher chance at winning.

Details of the contest are found here : https://limbenjamin.com/articles/cheat-and-win-samsung-ssd-contest

I would like to know if there is a more secure way to conduct such a contest.

Thanks.

4
  • seems more like a "how do i program right" - issue, no? Nov 27 '14 at 7:05
  • i think its more of a security architecture design than coding problem Nov 27 '14 at 7:10
  • yes, indeed. one solution to slow down automated submissions would be logins, or using unique emails for registering results. Nov 27 '14 at 7:21
  • I could easily simulate human behaviour by getting the script to pause 20-30 secs between submissions. it would be very difficult to tell if it is a script or an actual human who has been clicking for the past 4 hours. Yep, for that contest, each submission is actually tied to an email address. However, since users are allowed to submit multiple entries to increase thier winning chances, unique emails wont work. Nov 27 '14 at 7:29
4

Encryption is not a good way to ban automated clients, because if a browser is able to decrypt the content of the contest, a good bod is able to to the same.

But for the sake of completeness:

A very easy way to eliminate automated scripts would be something only a human can solve.
A very popular way of doing this is a Captcha. From Wikipedia:

A CAPTCHA [...] is a type of challenge-response test used in computing to determine whether or not the user is human

There are many different types of captchas, some of them are nearly impossible to solve for computers, some of them are relatively easy to solve.
A very good system is recaptcha from Google. It even has a fallback for people who are blind or don't see very well. And by solving a captcha from recaptcha the user even does something good by helping digitizing books.

Sure it is a little bit more work for the human user, too, if there is always a captcha to solve but unfortunately there is not really a good alternative to it.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.