We’re rewarding the question askers & reputations are being recalculated! Read more.

Hot answers tagged

65

The protections you describe are good ones that you should consider, but there can still be weaknesses: Many CAPTCHAS can be solved by robots, or you can easily pay people to solve them en masse for you (there are companies selling that service). Account lock out is a good idea, but if you do it based on IP someone with access to a botnet could retry login ...


60

This isn't really a great question for stackexchange as Google is keeping its algorithms secret so all we can really do is make guesses about how it works, but my understanding is that the new system will analyze your activity across all of Google's services (and possibly other sites that Google has some control over, such as websites that have Google ads). ...


55

Well, there could be a couple of concerns: Denial of service: In case the Google reCaptcha system somehow goes down, your users will probably not be able to authenticate anymore. This could also happen if they implement some kind of update, which breaks the whole system. External JavaScript libraries: when using Google reCaptcha, you need to include some JS ...


45

The way I've seen some large systems do it is to only require a captcha after sequential failed login attempts (ie: reset the count after a valid login). If you are worried about automated cracking, you could put the captcha at some high number of failures like 20, 50, 100 failed attempts. Almost no legitimate user will see the captcha, but an automated ...


44

Google tries to figure out if you are a bot or not. If it's in doubt, it serves you a CAPTCHA to check. Exactly how this is done is part of Google's secret sauce, and I don't think they will tell you. But here are some ingredients I guess that they mix together: Your IP: Has it been identified as a bot already? Is it a Tor exit node? The resources you load: ...


39

Maybe. it depends on how you define "brute force". A lockout after X incorrect attempts is great for protecting an account where an attacker is going after a single target. There's another scenario where the attacker has picked a few common passwords "password, password123, etc." And rather than attacking a single user, they try their 4 common passwords ...


36

Posting spam doesn't require hacking in any ways. Regarding the captcha, there is two possibilities: Either the captcha is automatable (I don't know for your website, but I still encounter a lot of websites bearing completely useless captchas). If the captcha is not automatable, then spammers can hire people to solve them for as low as $2 for a thousand ...


30

CAPTCHAs are a trade-off between the patience of the attackers, and the patience of the normal users. Even if they can be beaten, they still serve their purpose if they slow down attackers sufficiently to discourage at least some of them, while not frightening too many potential users. Of course, as is customary in IT, a lot of systems are used and deployed ...


23

Everything (everything) in security is balanced against cost. The purpose of CAPTCHA, just like the purpose of encryption, the purpose of physical security, the purpose of passwords, and the purpose of virtually every other security measure[*] is to increase the cost of circumvention, not to make circumvention impossible. The intention is, specifically, to ...


20

BY THE MAGICK POWER OF UNICORNS!!! Snark aside, CAPTCHA is a very poor solution for D/DoS protection. While it does have some effect, this is minimal, and easily compensated for by the attackers. CAPTCHA solves the wrong problem for this, and solves it badly. CAPTCHA does not try to rate-limit the connections; it is not intended to protect the login ...


20

ReCaptcha is great from a client side point of view, but it's not perfect. The mail technique that you mention is called account lockdown, and is a very effective deterrent against brute force attacks. I would implement it because it's an added layer independent of the client side completely. Another measure you can implement is throttling. It's ...


18

Yes, you are correct. The administrators running reCAPTCHA could request a CAPTCHA from your site and then perform a look-up to see which CAPTCHA was generated for your site and therefore the expected string which validates. The trade-off is that 1) they are probably trustworthy not to be doing this because of the potential damage to reputation if/when ...


17

Thinking outside the box... In most cases this applies: The business purpose for CAPTCHAs is to identify that the person accessing a page is a human being. The underlying reason for needing to know it it's a human is to prevent automated form submission, and the main reason for preventing that is to prevent brute force attacks. So the ultimate purpose ...


17

I also use to be amazed by this thing. So, what I did, in Chrome open incognito mode, then browse a site that has the new Google CAPTCHA and tick the box. Well, it didn't get me through, instead it shows a series of images and asked me to select images related to one image. This shows that Google is constantly tracking our behavior to determine if we are ...


16

A relatively user-friendly way of mitigating brute-force attacks is delaying the minimum time between attempts. The first time your user enters wrong credentials, you let him wait 1 second before he can try again. The second time, you let him wait 2 seconds. The 3rd time, you make him wait 4 seconds. 4th time, 8 seconds, and so on. You also base this on the ...


16

It's unlikely he's hacked into your site. It's also unlikely he's doing this manually. If you run a Wordpress site, bots will eventually find it and spam the hell out of it. Captcha resolution can always be outsourced to someone in the third world for pennies, who literally does nothing but answer captchas all day. Since this is a personal blog, you ought ...


15

For this to be unethical there would need to be the potential for the information displayed to leak personal information. The numbers shown, while they have a small amount of background, do not show enough context for anyone to glean any extra information. The privacy issue of the source of these images, ie street view, is much more relevant as it allows ...


13

To answer a bit more explicitly: Do I need to use captcha if I am using AntiForgeryToken in an MVC application. If automated submissions are a problem then yes. Does AntiForgeryToken prevents automated form submission? No. A CSRF token basically ensures that a user visits a page (eg. the one which contains the form) before another action takes ...


13

All text-based CAPTCHAs are trivial to break if the adversary is motivated enough. There are been relatively serious claims from different teams of being able to break common text-based CAPTCHAs (although no public code that I'm aware of), including Google and Vicarious. This is simply because computer vision tasks such as determining the regions of a 2D ...


12

Because there could be a DNS/hosts reroute in place to allow the captcha to be parsed differently by a malicious user One possible scenario is farming cheap labour to manually solve captchas and then submit them back with the form. Since the recaptcha only will serve the image once this is the lazy way to farm this out. ( redirect the requested image to ...


12

I read somewhere that reCAPTCHAs use the movement of the mouse (only in their area) to determine if you are a bot or not. Try this use mouse keys on your computer (if it is windows use Left-Alt + Left-Shift + NumLock) to move the mouse straight up. This should trigger the image selection test.


11

A captcha prevents an attacker from performing more database-intensive operations that may cause a DoS via CPU or memory exhaustion. However, this is only the case when the CPU and memory consumption caused by generating the captcha image must be less than that of the normal page request. One way to ensure this is to use an off-site captcha service, such as ...


11

It is easier/faster to check if a CAPTCHA is correct than to lookup a user in the database (this may include new connections, hashing and more). A server first check the CAPTCHA, if it is correct then process the rest of the login, if not return an error. It is important to note that making of a CAPTCHA image requires some processing, but this can be done ...


11

This will probably not work for a long time because there is nothing inherent in these "flaws" which cannot be reproduced by a machine. The first problem you need to solve is to create an algorithm which produces such images which are easy to solve for most humans but hard to solve for current image recognition. Once you have this system in place to protect ...


10

Neither method is foolproof at blocking automated requests, but both have been effective for me in the past. Let me explain: Automating a response to an email is fairly easy, and thus cannot be taken as assurance that the client is not a bot. Similarly, captcha is easily broken (not even using humans). For instance, the hacker group DC949 recently released ...


10

A CAPTCHA is normally intended to ensure that 'user' input is from a real person. While it could help to prevent automated attacks against a website login mechanism it is likely to negatively impact on the user experience (username, password and CAPTCHA) unless the system can be configured to only enable the CAPTCHA after one or two failed logins. The ...


9

It isn't clear from the OP's question, but it is possible that for security reasons the whole system is not able to communicate with third party networks. The OP may wish to have a system that he can implement server-side because the server, and potentially the clients too, are unable to connect to Google, or anywhere else on the Internet. The security ...


8

One alternative to a classic captcha is Microsoft Asirra (which I consider quite interesting). Instead of reading scrambled text, you have to select the cats from pictures containing either cats or dogs. They have over 3 million photos, so you should be safe against the more determined attackers. It is not very probable that someone will index all these ...


8

I am not going into basics of CAPTCHAs based security as you can read it from Wikipedia. But what interesting is how accurate they are and what are the evaluating parameters for them. To my knowledge CAPTCHAs has been broken in research with image processing techniques but still requires practical implementation and its just a matter of time i.e. you can ...


8

They both solve different problems. CAPTCHA prevents automated signups. Email verification proves that the email address is valid. As such, you should use both. However, a determined spammer will simply outsource image based CAPTCHA solving to 3rd world countries, or get unsuspecting users to solve them via phishing attacks. The best type of CAPTCHA is ...


Only top voted, non community-wiki answers of a minimum length are eligible