3 ms·

It truly is pervasive now, and the likelihood of being asked to select crosswalks or store fronts or signals subjectively seems to be rising. I question whether

by dpwm 8y ago

It truly is pervasive now, and the likelihood of being asked to select crosswalks or store fronts or signals subjectively seems to be rising. I question whether that would be the same if I capitulated and used Chrome. What would once be a certain no, I now question whether google is actively weaponizing reCAPTCHA in the new browser wars. After all, Chrome has such a large market share in the right places that I'd be surprised if the model didn't take into account user agent to determine non-automated users. The worst pattern I'm seeing now is when login forms decide to add it after just one incorrect password attempt. I completely understand registration forms -- but login forms?

elisaado 8y ago
On the login form thing: it's to prevent easy brute force attacks
- JeanMarcS 8y ago
  Isn’t it a bit lazy on the developers side ? Limiting the number of errors before sending a link to reset your password (for example, I agree there might be different ways to deal with that) is no rocket science, and being dependent on third party for such a trivial thing is, in my opinion, a bad idea.
  - dmurray 8y ago
    It really isn't trivial. Rate limiting is great, but not enough. If you lock people out after a certain number of failed login attempts, you allow an adversary to DOS your users by constantly trying to log in as them.
    - dpwm 8y ago
      > It really isn't trivial. Rate limiting is great, but not enough. Rate limiting alone isn't a solution. But it can be part of a solution that doesn't require reCAPTCHA. > If you lock people out after a certain number of failed login attempts, you allow an adversary to DOS your users by constantly trying to log in as them. That isn't how the pattern works. On next successful login you basically inform the user that they need to confirm it's them with an email token. It works well. ReCAPTCHA doesn't.
lkdjjdjjjdskjd 8y ago
I didn't even consider that it would be different on Chrome, but I guess that is because nowadays users are supposed to be "logged into Chrome"? I can only hope that firms will eventually figure out that reCAPTCHA is a bad user experience.

by dpwm 8y ago

elisaado 8y ago

On the login form thing: it's to prevent easy brute force attacks

JeanMarcS 8y ago
Isn’t it a bit lazy on the developers side ? Limiting the number of errors before sending a link to reset your password (for example, I agree there might be different ways to deal with that) is no rocket science, and being dependent on third party for such a trivial thing is, in my opinion, a bad idea.
- dmurray 8y ago
  It really isn't trivial. Rate limiting is great, but not enough. If you lock people out after a certain number of failed login attempts, you allow an adversary to DOS your users by constantly trying to log in as them.
  - dpwm 8y ago
    > It really isn't trivial. Rate limiting is great, but not enough. Rate limiting alone isn't a solution. But it can be part of a solution that doesn't require reCAPTCHA. > If you lock people out after a certain number of failed login attempts, you allow an adversary to DOS your users by constantly trying to log in as them. That isn't how the pattern works. On next successful login you basically inform the user that they need to confirm it's them with an email token. It works well. ReCAPTCHA doesn't.

lkdjjdjjjdskjd 8y ago

I didn't even consider that it would be different on Chrome, but I guess that is because nowadays users are supposed to be "logged into Chrome"? I can only hope that firms will eventually figure out that reCAPTCHA is a bad user experience.