Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [captcha]

Completely Automated Public Turing test to tell Computers and Humans Apart used in form validation to restrict access to humans only

2
votes
1answer
87 views

Can we use reverse image search to bypass image CAPTCHAs?

Has there been any group that managed to bypass the Image CAPTCHAs using reverse image search? Whats stopping people from writing a script that bypasses these CAPTCHAs by reverse image searching via ...
38
votes
8answers
13k views

Is brute force a probable threat even if you enable CAPTCHA and rate limit logins?

Let's assume CAPTCHA is enabled with account lock out control (after five continuous failed attempts, the account will be locked for 15 min) on a system. Is brute force still a probable threat?
4
votes
3answers
189 views

What benefit do Captchas provide?

I have researched and found the following sites which will break captchas: anticaptcha 2captcha (links not included to prevent promoting the sites) Given that these services can be used to break ...
4
votes
2answers
632 views

By using reCAPTCHA which information is Google collecting?

Wanting to avoid bots registering on a website, I might use reCAPTCHA by Google. Since the algorithm behind reCAPTCHA is not open source, I'm wondering what user information they actually collect ...
1
vote
1answer
73 views

How efficient are the old-good text-image-based capthas nowdays to prove that a form has been submited by a human?

With the rise of google re-Captcha that is known to be the most effective one because of the use of real images that are computational hard to get distinguished from a machine. In other words a human ...
0
votes
0answers
164 views

Why does Google's “identify a thing” captcha include a long waiting time between showing images?

One of Google's "Recaptcha" challenges asks users to identify a "thing" (typically a car or something similar) in a set of different small photos on a 3x3 grid: After clicking one of the "things", ...
-2
votes
1answer
104 views

Why do websites like Truecaller make you prove that you are not a robot after a limited number of searches?

I used Truecaller for searching for a number but after around 20 to 25 searches they started asking me to prove that I am not a robot. Is this for protecting their website from a DDoS attacks or is it ...
6
votes
0answers
771 views

How was Google recaptcha v2 bypassed several times?

There are multiple reports of a reᴄᴀᴘᴛᴄʜᴀ v2 bypass. Most of the time, the explanation is neural networks services provided by Google or ɪʙᴍ. But there is something I am failing to understand: for ...
1
vote
2answers
118 views

How can I protect the signup form in my website? Is special spam prevention needed?

I'm struggling to write a secure sign-up form for my website. (My site is some kind of an image gallery. I have knowledge in html, javascript, msql and php) I know there is a tactic to secure login ...
3
votes
0answers
63 views

Is there a security benefit to requiring a login before and after a captcha test?

On Stack Exchange, if you login with your email address and password and then get captcha tested, you have to provide your credentials a second time after passing the captcha. I've been trying to ...
0
votes
1answer
132 views

How to securely collect email addresses through a third party website

I would like to collect email addresses through a third party website and subscribe them to a Sendgrid mailing list. Flow: User goes to a website hosted by unbounce.com that uses my website's ...
1
vote
1answer
87 views

Should users need to complete a CAPTCHA upon changing their password in their account settings?

On Last.fm, I need to complete a picture-style ReCAPTCHA in order to change my password. I want to change my password because haveibeenpwned lists my account as appearing in the last.fm breach. I ...
8
votes
1answer
694 views

Can CAPTCHA-solving patterns be used to track/identify a person?

Captchas are everywhere. Suppose you're a big company offering Captchas on many sites and you can easily track a user across the web simply by setting a cookie everytime some site loads your captcha ...
6
votes
4answers
546 views

Are logins with button pushes more secure than normal form logins?

I recently moved to France and had to find a new cell provider, and I settled on Free Mobile. Their login page features a button-push login for the 'identifiant' (username), and a normal form field ...
1
vote
1answer
114 views

Might have been infected

I recently got redirected to a site which just made a loud beeping sound, when trying to just access a link in a YouTube video discription. My Anti Virus Program (Kaspersky Internet Security) ...
2
votes
1answer
50 views

Is sending recaptchaPublicKey & RecaptchaToken in the post request a potential security threat?

I have implemented reCaptcha in login form to slow down the potential brute force attack. However, the application sends recaptchaPublicKey & RecaptchaToken in the post request along with the ...
1
vote
1answer
127 views

How does a phone call / SMS message verify my identity

More and more I've been seeing online services that want to verify my identity using an automated phone call or text message. The trouble is - they ask me to provide the phone number! It seems the ...
0
votes
1answer
401 views

XSS attempt from Google Captcha at login.yahoo.net? (NoScript)

Recently I tried to login into my Yahoo mail account with Firefox ESR where NoScript showed me this warning when the captcha was shown at the login: NoScript filtered a potential cross-site ...
0
votes
0answers
99 views

Whether captcha (or reCAPTCHA) is good or bad [duplicate]

I know captcha/reCAPTCHA is good to prevent spam posts as bots normally cannot bypass the challenges given by captcha/reCAPTCHA and thereby prevents bots submitting forms automatically. Suppose there ...
-1
votes
1answer
240 views

Can this captcha be broken using OCR?

Can the captchas produced by captchas.net be defeated using OCR software that is currently available? Example: If it can, how easily is such OCR software available and at what cost approximately? I ...
14
votes
5answers
6k views

I receive spam despite a captcha, has my wordpress blog been hacked?

I have a wordpress blog under my own domain. It does not have special security. For the past 1 week, my blog got spammed by someone from Russia - I think the contents of my blog somehow angered him. ...
0
votes
2answers
188 views

Is captcha the only thing preventing endless account creation

I wonder whether or not there are mechanisms other than captcha that prevent a mallicious script from creating an indefinite number of accounts for a given service. If so, is this not a huge red flag, ...
0
votes
5answers
2k views

Is showing CAPTCHA after n failed attempts less secure? [duplicate]

My boss asked me how I would improve the login strategy they have implemented at the moment: introduce user, password and resolve a .NET captcha from the first attempt. An auditor security team said ...
2
votes
2answers
1k views

How to defend against a virus that hides the payload by encrypting it?

Recently I've started to learn more about the way antivirus and other anti malware products work, and I realized that most of them mainly use 3 different techniques to detect and stop malware: ...
3
votes
2answers
169 views

Is CAPTCHA enough to prevent attackers from draining entropy pool?

I'm working on a website which necessitates the use of server generated codes, which are displayed once to the user and then stored in a database. I plan on using /dev/urandom as a source of entropy ...
1
vote
2answers
270 views

Relay attack against Captcha

I am implementing a website that included my own text Captcha (I do not use any Captcha service - like reCaptcha). the Captcha code serves each challenge (i.e. image) only once for both display and ...
3
votes
2answers
241 views

Is captcha on nth login attempt is really stops bots?

I have a requirement to show google reCaptcha on 2nd attempt on login screen. But frankly speaking I consider it not the way to stop bots. Because on server side I cannot tell whether this is the ...
0
votes
1answer
115 views

Clean and cheap protection for user registration HTTP requests?

I am developing a website that has user registration. I already built some rate-limit protection techniques using nginx and at a lower level using iptables, but I am worried about real-world attacks ...
0
votes
3answers
2k views

What is most secure CAPTCHA system? [closed]

Artificial intelligence has now become a real security threat, some bots using advanced algorithms can solve even the most distorted of CAPTCHAS text at a high accuracy. Assuming that I'm ...
1
vote
2answers
654 views

What is the future of CAPTCHA? [closed]

According to this article this guy has made a simple AI to beat CAPTCHA. With the development of AI, robots will pass the Turing test, and bots will beat Google's reCAPTCHA, maybe already there are ...
2
votes
2answers
90 views

Skill testing question in registration page

I've seen some registration pages that have a "skill testing question" in addition to having a captcha. These skill testing questions are usually easy trivia, such as "what is 2 + 2" or "who invented ...
3
votes
2answers
363 views

Why does moving my mouse really quickly make recaptcha pass quicker?

I've noticed that if I ever get recaptchas on websites if I move my mouse back and forward really quickly then it passes very quickly. Any idea why/if this is a possible
0
votes
2answers
280 views

How to lock out login attempts with SQL

I don't want by server to get brute forced but I don't want to use a CAPTCHA as they're not user friendly / I don't want to rely on another company - because I'm not going to implement my own captcha ...
3
votes
2answers
697 views

CAPTCHA code refreshing vulnerability

Question is not programmatic but rather conceptual. When a user is trying to fill in a contact form and then CAPTCHA code, if he/she accidentally refreshes the page or doesn't fill a required input ...
0
votes
3answers
201 views

Should we fear spammbots that write constructive and helpful posts? [closed]

When I found this comic: I just asked my self, what flaws might this have? The system is sticking up with comments that require more comments on, but it would only be a problem if it where decreasing ...
38
votes
2answers
38k views

What triggers Google's reCAPTCHA

I noticed that Google's "I am not a robot" reCAPTCHA forces me to check correct images on my computer. I installed a virtual machine and tried there. Same thing. Used proxy. Same thing too. Then I ...
2
votes
2answers
3k views

Bypass CAPTCHA form made with 100% JavaScript?

There is a website I have found where the JavaScript handles the response of the CAPTCHA and then proceeds to fire what I believe is an AJAX request. So the flow is as follows: Button -> ...
6
votes
2answers
136 views

Are photo recognition captchas a reliable way to distinguish humans from bots?

You all know captchas that require you to either type some letters displayed in an obfuscated way as image. Recently I started to see more and more captchas that show you a set of small photos and ...
8
votes
2answers
946 views

Using optical illusions as CAPTCHA

Would using the "flaws" in human perception of an optical illusion graphic allow a system to differentiate between humans and machines (using these pictures like a CAPTCHA)? Some examples are where a ...
0
votes
1answer
201 views

ReCaptcha Placement

I wish to use google's new version 2.0 reCaptcha on my website. My website displays some users' (public) information to other registered users. Where is the best place to place the reCaptcha? 1) On ...
23
votes
7answers
7k views

Are reCAPTCHA enough to prevent brute-force password guesses?

I was wondering if reCAPTCHA were strong enough to prevent BruteForce from bots or if I needed to add more security, such as sending a unique mail to the user every 5 tries that someone try to log on ...
1
vote
1answer
101 views

Can handwritten captchas be used?

Suppose a user has just created a new account on some site. You ask him to submit an image of a para of neat handwritten text, along with a typed version of the same text. Then this is kept secret. ...
2
votes
0answers
802 views

Best practices to implement a secure CAPTCHA [closed]

What are the best practices to implement a secure CAPTCHA? Also I want to know: What is the best way to identify an insecure CAPTCHA?
1
vote
1answer
582 views

Yii client side captcha validation

Apparently, Yii web application framework generates some kind of hash value from captcha codes it generates and sends it to the client side so it can be used for client side validation of the captcha ...
28
votes
3answers
10k views

Is there anything insecure about Google ReCaptcha?

In this question on software recommendations, the OP asks for an alternative to Google reCAPTCHA because "for a security reasons also we don't want to depend on any out side services". As far as I ...
1
vote
1answer
109 views

CAPTCHA on pages secured with login

My local mobile carrier (Play, Poland) and its paid SMS gate is the first example, that I recall in my entire Internet history, that forces users to fill out dully CAPTCHAs even on pages, which are ...
1
vote
3answers
1k views

How to prove ownership of a website?

We all know how banks identify themselves to users. No, not through TLS certificates. The users pay no attention to those. No, I'm talking about branding-- all those fancy logos and stock photos that ...
25
votes
9answers
13k views

Is it helpful to have a captcha on a login screen?

I introduced recaptcha to the login screen of a system. My goal was all about security things like dictionary/bots attacks or other thing of that type. The users now hate it, Some did not even ...
2
votes
2answers
2k views

Are captchas based on ASCII art secure enough? [closed]

I have just came across an ASCII art captcha, something that I have never seen before. It seems to be really easy to implement server side! Are ASCII art captchas secure enough?
0
votes
3answers
650 views

Is CAPTCHA necessary when I use an anti-CSRF token?

I wonder is it a good idea using captcha when using an anti-CSRF token on login page? I think it's impossible for robots to mess with login page because the token changes on every request.