4 ms·
The trouble is, those sorts of captchas are trivial to bypass. They're good against an automated fly-by attack, but completely pointless against a targetted att
by mike-cardwell 16y ago
The trouble is, those sorts of captchas are trivial to bypass. They're good against an automated fly-by attack, but completely pointless against a targetted attacker. Not even a good targetted attacker, just somebody who knows how to write a script which submits a form.
I could probably get away with using the cat captcha on my blog, but Facebook or Google wouldn't be able to use it. But the thing is, for a site like my blog, I don't even need to use a cat captcha. I just need to make sure dumb bots can't submit anything, eg using hidden fields:
https://secure.grepular.com/Blocking_Comment_Spam_Using_ModSecurity_and_Hidden_Fields https://secure.grepular.com/Blocking_Comment_Spam_Using_ModS...
So where do these image captchas have a place? Not on big sites, and not on small sites...
- nollidge 16y agoI'm getting a certificate error from your link: secure.grepular.com uses an invalid security certificate. The certificate is not trusted because the issuer certificate is unknown. (Error code: sec_error_unknown_issuer) Edit: On both FF 3.6.6 and IE8 on Win7
- mike-cardwell 16y agoYep. The certificate is signed by cacert.org and their root doesn't exist isn't in your os/browser combination. I don't really want to turn this into a thread about my SSL setup so I will just say that if you want an explanation, you should read: https://secure.grepular.com/Why_Does_this_Website_Generate_SSL_Warnings https://secure.grepular.com/Why_Does_this_Website_Generate_S... Yes, I realise the irony about the explanation being behind the same certificate.
- Vivtek 16y agoThe problem with only screening for dumb bots is that it won't screen for the 25-cent-an-hour Ukrainian or African hired to submit spam with a human-driven browser.
- mike-cardwell 16y agoThat is a problem with all captchas