Hot answers tagged

72

This isn't really a great question for stackexchange as Google is keeping its algorithms secret so all we can really do is make guesses about how it works, but my understanding is that the new system will analyze your activity across all of Google's services (and possibly other sites that Google has some control over, such as websites that have Google ads). ...


67

The protections you describe are good ones that you should consider, but there can still be weaknesses: Many CAPTCHAS can be solved by robots, or you can easily pay people to solve them en masse for you (there are companies selling that service). Account lock out is a good idea, but if you do it based on IP someone with access to a botnet could retry login ...


58

Well, there could be a couple of concerns: Denial of service: In case the Google reCaptcha system somehow goes down, your users will probably not be able to authenticate anymore. This could also happen if they implement some kind of update, which breaks the whole system. External JavaScript libraries: when using Google reCaptcha, you need to include some JS ...


48

The way I've seen some large systems do it is to only require a captcha after sequential failed login attempts (ie: reset the count after a valid login). If you are worried about automated cracking, you could put the captcha at some high number of failures like 20, 50, 100 failed attempts. Almost no legitimate user will see the captcha, but an automated ...


47

Google tries to figure out if you are a bot or not. If it's in doubt, it serves you a CAPTCHA to check. Exactly how this is done is part of Google's secret sauce, and I don't think they will tell you. But here are some ingredients I guess that they mix together: Your IP: Has it been identified as a bot already? Is it a Tor exit node? The resources you load: ...


39

Maybe. it depends on how you define "brute force". A lockout after X incorrect attempts is great for protecting an account where an attacker is going after a single target. There's another scenario where the attacker has picked a few common passwords "password, password123, etc." And rather than attacking a single user, they try their 4 common passwords ...


36

Posting spam doesn't require hacking in any ways. Regarding the captcha, there is two possibilities: Either the captcha is automatable (I don't know for your website, but I still encounter a lot of websites bearing completely useless captchas). If the captcha is not automatable, then spammers can hire people to solve them for as low as $2 for a thousand ...


30

CAPTCHAs are a trade-off between the patience of the attackers, and the patience of the normal users. Even if they can be beaten, they still serve their purpose if they slow down attackers sufficiently to discourage at least some of them, while not frightening too many potential users. Of course, as is customary in IT, a lot of systems are used and deployed ...


23

Everything (everything) in security is balanced against cost. The purpose of CAPTCHA, just like the purpose of encryption, the purpose of physical security, the purpose of passwords, and the purpose of virtually every other security measure[*] is to increase the cost of circumvention, not to make circumvention impossible. The intention is, specifically, to ...


22

I also use to be amazed by this thing. So, what I did, in Chrome open incognito mode, then browse a site that has the new Google CAPTCHA and tick the box. Well, it didn't get me through, instead it shows a series of images and asked me to select images related to one image. This shows that Google is constantly tracking our behavior to determine if we are ...


20

ReCaptcha is great from a client side point of view, but it's not perfect. The mail technique that you mention is called account lockdown, and is a very effective deterrent against brute force attacks. I would implement it because it's an added layer independent of the client side completely. Another measure you can implement is throttling. It's ...


18

Yes, you are correct. The administrators running reCAPTCHA could request a CAPTCHA from your site and then perform a look-up to see which CAPTCHA was generated for your site and therefore the expected string which validates. The trade-off is that 1) they are probably trustworthy not to be doing this because of the potential damage to reputation if/when ...


17

Thinking outside the box... In most cases this applies: The business purpose for CAPTCHAs is to identify that the person accessing a page is a human being. The underlying reason for needing to know it it's a human is to prevent automated form submission, and the main reason for preventing that is to prevent brute force attacks. So the ultimate purpose ...


16

A relatively user-friendly way of mitigating brute-force attacks is delaying the minimum time between attempts. The first time your user enters wrong credentials, you let him wait 1 second before he can try again. The second time, you let him wait 2 seconds. The 3rd time, you make him wait 4 seconds. 4th time, 8 seconds, and so on. You also base this on the ...


16

It's unlikely he's hacked into your site. It's also unlikely he's doing this manually. If you run a Wordpress site, bots will eventually find it and spam the hell out of it. Captcha resolution can always be outsourced to someone in the third world for pennies, who literally does nothing but answer captchas all day. Since this is a personal blog, you ought ...


15

For this to be unethical there would need to be the potential for the information displayed to leak personal information. The numbers shown, while they have a small amount of background, do not show enough context for anyone to glean any extra information. The privacy issue of the source of these images, ie street view, is much more relevant as it allows ...


15

Because there could be a DNS/hosts reroute in place to allow the captcha to be parsed differently by a malicious user One possible scenario is farming cheap labour to manually solve captchas and then submit them back with the form. Since the recaptcha only will serve the image once this is the lazy way to farm this out. ( redirect the requested image to ...


14

To answer a bit more explicitly: Do I need to use captcha if I am using AntiForgeryToken in an MVC application. If automated submissions are a problem then yes. Does AntiForgeryToken prevents automated form submission? No. A CSRF token basically ensures that a user visits a page (eg. the one which contains the form) before another action takes ...


13

All text-based CAPTCHAs are trivial to break if the adversary is motivated enough. There are been relatively serious claims from different teams of being able to break common text-based CAPTCHAs (although no public code that I'm aware of), including Google and Vicarious. This is simply because computer vision tasks such as determining the regions of a 2D ...


13

I read somewhere that reCAPTCHAs use the movement of the mouse (only in their area) to determine if you are a bot or not. Try this use mouse keys on your computer (if it is windows use Left-Alt + Left-Shift + NumLock) to move the mouse straight up. This should trigger the image selection test.


12

This will probably not work for a long time because there is nothing inherent in these "flaws" which cannot be reproduced by a machine. The first problem you need to solve is to create an algorithm which produces such images which are easy to solve for most humans but hard to solve for current image recognition. Once you have this system in place to protect ...


10

Google has come up with a new technique called reCaptcha that is simpler and reportedly more reliable than existing solutions. It consists of a single checkbox, that when clicked, sends metadata to Google's servers, which in turn uses some proprietary AI to determine if the click originated from within a script, or a human. See this venture beat article ...


10

A CAPTCHA is normally intended to ensure that 'user' input is from a real person. While it could help to prevent automated attacks against a website login mechanism it is likely to negatively impact on the user experience (username, password and CAPTCHA) unless the system can be configured to only enable the CAPTCHA after one or two failed logins. The ...


9

When you click on I'm not a robot it sends over an HTTP request to google with the whole bunch of useful information things like Your IP Address Your country Timestamp Information from your browser such as the way you move your cursor just before entering the checkbox. How you are scrolling the page before the click. The time interval between different ...


9

It isn't clear from the OP's question, but it is possible that for security reasons the whole system is not able to communicate with third party networks. The OP may wish to have a system that he can implement server-side because the server, and potentially the clients too, are unable to connect to Google, or anywhere else on the Internet. The security ...


8

Captcha is not a solution at all! There is an overall captcha killer who could pass every captchas existing and even not already invented ! It's based on social engineering: Simple and easy, a 15 year old spammer student could build this: Build a trivial free puzzle captcha game site, looking harmless: Little funny game, playing with many captcha for ...


8

One alternative to a classic captcha is Microsoft Asirra (which I consider quite interesting). Instead of reading scrambled text, you have to select the cats from pictures containing either cats or dogs. They have over 3 million photos, so you should be safe against the more determined attackers. It is not very probable that someone will index all these ...


8

I am not going into basics of CAPTCHAs based security as you can read it from Wikipedia. But what interesting is how accurate they are and what are the evaluating parameters for them. To my knowledge CAPTCHAs has been broken in research with image processing techniques but still requires practical implementation and its just a matter of time i.e. you can ...


8

Yes it can be done. It's trivial. There are many ways for a user or an attacker to have multiple IP addresses - or to share IP addresses. Here's a list, off the top of my head. These all assume that the IP address of the target system is exposed to your server. Either you're running some code (like JavaScript) to detect the IP address, or the client ...


8

You almost answered your question yourself, I might just try to give some grounds for why it is actually less secure than regular log in forms. Long story short, is this login method actually more secure? For me, it doesn't seem so, and it's so annoying given that it doesn't work with my password manager. There is a rule, formulated in security....


Only top voted, non community-wiki answers of a minimum length are eligible