I'm intrigued that many sites use seemingly random numbers with a random operator as a security check to validate that you're not a bot. Forgive my ignorance in captcha technology, but what is stopping the bot from pulling the simple math problem and calculating it on the fly?

Here's a sample I've pulled from a website and brevitized:

<h4>Security Question</h4>
<label for="bp-security-check"> 4 + 8 = </label>
<input type="hidden" name="bp-security-check-id" value="548bb54471083">
<input type="number" name="bp-security-check" required="required">

CAPTCHAs are one area of computer security where "roll-your-own" can be a good idea.

In order to break a CAPTCHA, a bot needs to be programmed to recognize and solve the CAPTCHA. For low-volume, low-value sites, the cost to program a bot to handle even a trivial CAPTCHA such as this is greater than the expected value of breaking it. By the simple expedient of being different, the site operator has eliminated most automated attacks.

Note that a trivial system isn't sufficient to protect a site with any great value, but the benefit of being different remains: a bot operator can't spread the cost of breaking the CAPTCHA over multiple sites.

  • As an example, I did this once to stop spam from a forum website: During post or registration, disabled the submit button and delayed a code to insert a key and then enable the button after few seconds. That was enough as most bots will submit the form immediately but humans will take at least few seconds to fill it. That worked because of what Mark said. If that method became popular, it could be trivial to bots to break it. – lepe Aug 19 '15 at 0:58
  • 1
    Please not that "roll-your-own" method does not work if attacker targets to your site. – Hannes Karppila Mar 6 '16 at 14:44
  • 1
    @HannesKarppila, if you're being specifically targeted, roll-your-own can still work. It becomes a question of whether your CAPTCHA-writing abilities are better than their bot-writing abilities. – Mark Mar 6 '16 at 19:38

It does stop the most rudimentary bots which repeatedly POST the same form. As you have mentioned, a more sophisticated bot can evaluate the result and append the unique nonce to every request, thus defeating this system.The most sophisticated bots can even go one step further by performing optical character recognition(OCR) on captcha images and input the results.

Perhaps the programmer was lazy in this case, or perhaps the type of form does not require such a high amount of security. E.g. If the form simply adds an email address to a mailing list, there is no need to have sophisticated captchas. However, if the form is used to submit entries to a contest, then you might probably want to have a more sophisticated captcha since there is an incentive for someone to automate the process.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.