Hot answers tagged

4

After many years of working in the information security industry, I have yet to come across such an implementation. This doesn't mean it can't be suitable for certain use cases, but it definitely isn't an established design pattern. I have seen a decrease in the usage of CAPTCHAs during the last years, because UX experts hate them. CAPTCHAs are mostly used ...


2

Like 7, if the attacker is very lucky, or 70000, if the attacker is very unlucky. So whether this is "secure" depends on whether you limit attempts per IP, or per account, or how many attempts per second can be done in the first place, etc. It seems fairly obvious that with 9999 being the highest number, there are ten thousand possible values (since all ...


2

Running Firefox in private browsing, it will have enabled Tracking protection. With tracking protection enabled, it won't be loading recaptcha (since that serves as a tracker for Google). You should see a partial shield on the url bar noting that. Now, by not loading recaptcha, it is relatively common that the page doesn't even show a sign that there ...


2

tl/dr: Client authentication in the browser is useless because browser-based bots will automatically authenticate themselves, and browser-less bots will get stopped by much simpler methods anyway. This isn't really a surprise, because "client authentication" isn't really effective for browsers (and is only slightly effective for other "kinds&...


1

No. Cloudflare is a reverse proxy. When a site uses Cloudflare, the client (browser) never connects to the origin server. They can even help you hide the origin server, so an attacker cannot attack it directly. The client connects to a server in one of ~200 Points Of Presence they have around the world (server farms), the request is processed by the server ...


1

This is more of a User Experience question. But if you want to make sure the user is aware of what they are doing before performing a destructive operation and decide to do that by making that operation intentionally difficult to perform, then you should design those hurdles in a way which makes them more aware of what they are about to do. A regular captcha ...


1

Doing some research yields some interesting information: Probably the most easy to follow is the YouTube video "What is the probability of guessing a 4 digit pin code?" that explains how to determine the probability of guessing a 4 digit PIN (it's 1 in 10,000). There are other conversations about permutations reducing the potential combinations, but the ...


Only top voted, non community-wiki answers of a minimum length are eligible