3 ms·
Or you don't do 'security' features client-side, and instead only send the hint data in response to the user's request for the hint. Wouldn't that be the 'righ
by lordsper 11y ago
Or you don't do 'security' features client-side, and instead only send the hint data in response to the user's request for the hint.
Wouldn't that be the 'right' way of doing this?
- Hamcha 11y agoYes, that's the proper way. It's not even that much of a cheat, really. I'm surprised they decided to make a full blog post on how they fight such a simple trick (incorrectly, even). It won't work that much anyway, a simple chrome extension that injects code can overturn their whole thing. How far can they fight cheating anyway? I remember making a javascript snippet in Chrome devtools that would bruteforce all the crypto questions (because they had predictable patterns, like all sentences involved "Anna" or some similar name). That seems way harder to fight.. will it deserve another blog post?
- NickNameNick 11y agoAlice, Bob and Eve the Eavesdropper?
- msravi 11y agoI'm guessing the idea is to have the hints available through spotty connections...
- hellofunk 11y agoI must admit also, I was reading this and wondering how their fix actually "solved" the problem, and even more confused that they thought it was a novel enough solution to actually blog about it. In reality, this blog post reveals further ignorance of the actual issue.