3 ms·
This! It's absurd for people to be required to do CAPTCHAs just for read access to a page. The experience of having to repeatedly perform CAPTCHAs the whole t
by adultSwim 10y ago
This!
It's absurd for people to be required to do CAPTCHAs just for read access to a page.
The experience of having to repeatedly perform CAPTCHAs the whole time is a real barrier.
- jgrahamc 10y agoThere's no such thing as "read access" when it comes to web security. People think there is but consider, for example, 1. Benign GET / repeated 1000 times per second. That's a DoS on the server 2. Shellshock. Looks like a benign GET / but nasty payload in User-Agent header 3. Simple GET but with SQLi in the URI All these are real examples. All seen through Tor (and, of course, without Tor).
- detaro 10y agoUnless they do fairly deep analysis of the page or force customers to configure it correctly, you don't know if the page will trigger "write access" later. And while it's easy to inject a CAPTCHA into the initial access, you can't do so easily in a later POST, especially if it is triggered by JS. Would be possible with cooperation of the site code, but I doubt many companies would be willing to go to that length.