66
votes
Accepted
Is brute force a probable threat even if you enable CAPTCHA and rate limit logins?
The protections you describe are good ones that you should consider, but there can still be weaknesses:
Many CAPTCHAS can be solved by robots, or you can easily pay people to solve them en masse for ...
- 65.8k
38
votes
Is brute force a probable threat even if you enable CAPTCHA and rate limit logins?
Maybe.
it depends on how you define "brute force".
A lockout after X incorrect attempts is great for protecting an account where an attacker is going after a single target.
There's another ...
- 5,160
37
votes
I receive spam despite a captcha, has my wordpress blog been hacked?
Posting spam doesn't require hacking in any ways.
Regarding the captcha, there is two possibilities:
Either the captcha is automatable (I don't know for your website, but I still encounter a lot of ...
- 19.4k
17
votes
I receive spam despite a captcha, has my wordpress blog been hacked?
It's unlikely he's hacked into your site. It's also unlikely he's doing this manually. If you run a Wordpress site, bots will eventually find it and spam the hell out of it. Captcha resolution can ...
- 6,338
9
votes
How does Google's "No Captcha reCaptcha" work?
When you click on I'm not a robot it sends over an HTTP request to google with the whole bunch of useful information things like
Your IP Address
Your country
Timestamp
Information from your browser ...
- 6,971
9
votes
Accepted
Can CAPTCHA-solving patterns be used to track/identify a person?
This is absolutely possible. Whether or not reCaptcha itself or any other given captcha service does this, I don't know, but biometrics based on mouse movements are absolutely able to uniquely ...
- 67.3k
9
votes
Should I use ReCAPTCHA v2 or v3?
While the other answer describes the different types of reCAPTCHA that Google has, it does not address what I think may be the real issues. As I was wondering about this myself, I came across this ...
- 191
7
votes
Accepted
Are logins with button pushes more secure than normal form logins?
You almost answered your question yourself, I might just try to give some grounds for why it is actually less secure than regular log in forms.
Long story short, is this login method actually more ...
6
votes
Accepted
Why do websites like Truecaller make you prove that you are not a robot after a limited number of searches?
It's probably partly to limit load on the servers, be it from a malicious DoS attacks or just someone who makes loads of requests for legit reasons.
Another big reason is to stop people from scraping ...
- 65.8k
5
votes
Is CAPTCHA enough to prevent attackers from draining entropy pool?
I'm not aware of any publicly known attack on predicting future output of /dev/urandom, no matter how much previous data you have already seen from it. It would be possible in theory, that such an ...
- 810
5
votes
Is there any reason to include the remote ip when using reCaptcha?
When I compare my "scores" with different scenario, I see this:
without remoteip: variable scores between 0.7 and 0.9
With "good" remoteip: almost always 0.9.
with "wrong" remoteip: almost always 0....
- 151
5
votes
Accepted
What is the future of CAPTCHA?
According to this article this guy has made a simple ai to beat CAPTCHA.
Those are old CAPTCHA algorithms. Newer ones are harder.
With the development of AI, robots will pass the Turing test
That'...
- 1,230
5
votes
What benefit do Captchas provide?
"given that there are locksmiths, what's the point of locking your door?"
Just because something has limitations doesn't mean it's useless. Those services cost money, maybe more money than an auto-...
- 2,703
5
votes
What benefit do Captchas provide?
Your linked sources seem to be pay-to-solve captcha services. These certainly make captchas less effective, but they certainly don't make them useless.
Lets look at the numbers, since this is a ...
4
votes
Skill testing question in registration page
Bots are usually made generic.
There is no bot to register specifically at Celeritas.domain and post spam.
There is a bot to register at any generic Wordpress/xForum/yCMS site and post spam.
It is ...
- 6,011
4
votes
Accepted
Is captcha on nth login attempt is really stops bots?
Storing the number of failed logins in the session or in the cookie does not work. As you pointed out, the attacker can simply delete the cookie. A better way is to keep the number of failed login ...
- 34.4k
4
votes
What is most secure CAPTCHA system?
I question your premise. A properly implemented site should be made secure without a Captcha. Once you have accomplished the appropriate level of security you need, adding a captcha should be thought ...
- 9,232
4
votes
What is most secure CAPTCHA system?
Most secure is very subjective. Even Google's Captcha system has been known to be broken on ocassion, one example out of many. Treat Captcha as a speed bump to deter people from putting in a lot of ...
4
votes
How Recaptcha Detect Fake User-Agent
Certain browsers have certain features. The service runs JavaScript they provide you, so they can run a lot of feature tests in the actual browser. This can be used to validate your userAgent string.
...
- 2,703
4
votes
Do we use different CAPTCHAs with different difficulty to how sensitive the request is?
After many years of working in the information security industry, I have yet to come across such an implementation. This doesn't mean it can't be suitable for certain use cases, but it definitely isn'...
- 7,545
3
votes
Accepted
Is captcha the only thing preventing endless account creation
Prominent web services use second level confirmation to screen and obfuscated automated spam registration, to increase the cost of automated spam. E.g.:
email with a unique confirmation link
email ...
- 2,417
3
votes
How to defend against a virus that hides the payload by encrypting it?
From my understanding this question narrows down a more general question to a very specific single example. The more general question is: how can some analysis system (antivirus etc) detect that some ...
- 208k
3
votes
What is the future of CAPTCHA?
Even some of the new algorithms are broken as well as per this paper. https://cdn.elie.net/publications/text-based-captcha-strengths-and-weaknesses.pdf
Many marketing companies employ cheap labor for ...
3
votes
Accepted
Why does moving my mouse really quickly make recaptcha pass quicker?
I am assuming that you are talking about the No Captcha ReCaptcha here. This tick based ReCaptcha works based on javascript and a CSS styling element unlike the form input based conventional CAPTCHA. ...
- 3,951
3
votes
Is brute force a probable threat even if you enable CAPTCHA and rate limit logins?
It is a threat in a different sense. If you lock accounts for 15 minutes after 5 unsuccessful attempts, then you've effectively built-in a DoS mechanism.
Assume I don't really want to break in, but I'...
- 5,231
3
votes
Accepted
Captcha against Mitm attacks works?
It sounds like the site you were testing doesn't use HTTP Strict Transport Security (HSTS), or at least doesn't pre-load it. However, it's entirely plausible that the CAPTCHA service is hosted on a ...
- 52.1k
3
votes
Accepted
Can we prevent DDoS or spam form submission with client authentication?
tl/dr: Client authentication in the browser is useless because browser-based bots will automatically authenticate themselves, and
browser-less bots will get stopped by much simpler methods anyway.
...
- 31.7k
3
votes
Accepted
How do we verify a human agent in light of WCAG 2.2?
I don't think it outlaws every form of CAPTCHA based on the current text
Exception: When the cognitive function test is to recognize common
objects or content the user provided to the website.
- 146
3
votes
Accepted
Is there any way to guarantee real user registration?
No. There are no guarantees.
There are lots of things that can make it more difficult for bots to register, but as you said, you have to balance that against the inconvenience to your users.
The ...
- 132k
Only top scored, non community-wiki answers of a minimum length are eligible