New answers tagged

0

If you are hashing and storing passwords correctly (regardless of whether you use PBKDF2 as your hashing function, or some other hashing funcion), then your server is doing the heavy lifting for each login attempt made at your site. Perhaps your engineer has a slight misunderstanding in the premise of how password hashing works, and he thinks that password ...


4

You are right that using PBKDF2 does not protect against brute-force attacks on web application login pages. Credentials submitted by users and attackers travel unchanged until the server, where PBKDF2 is then computed. PBKDF2 is therefore only meaningful for offline attacks which have direct access to the correct hashes. The only scenario where PBKDF2 and ...


-1

IP addresses can be allocated to countries. If someone from say Africa tries to enter a form in Canada on a website dedicated to supplying products in Canada, google might flag this as an anomaly to reduce the score. Sorry I was referring to Google reCaptcha v3 which states "reCAPTCHA uses an advanced risk analysis engine and adaptive challenges to keep ...


0

@Expectator has the right of it, but I wanted to elaborate a little bit on how third party CAPTCHA servers work and why your plan to bypass them would fail. In your plan, you say that you are "in control of the browser" ... but this is making an assumption that the only communication is between your client and the target server. This is a bad ...


2

The solution is to never trust clients to execute code. If everything is done server-side, there is no possibility of a MITM attack, since you can just cryptographically sign the token that says "Yes, User X did complete the CAPTCHA at this time". As soon as you add in authentication, MITM becomes incredibly difficult. You can substitute your own ...


1

Put bluntly, the standard requires a non-captcha method of access be available because captchas failing to distinguish a person's humanity is an accessibility issue. More to the point, you shouldn't be trying to determine if a visitor is human, but whether they are authorized user. Practically, this means that you can't gate login on a captcha solve -- which ...


Top 50 recent answers are included