46 ms·
Not if it required a captcha.
by lancefisher 15y ago
Not if it required a captcha.
- eurleif 15y agoThe XSS could change the text explaining the CAPTCHA and socially engineer people into solving it.
- jQueryIsAwesome 15y agoBut then the 'evil script' would select all his friends minus one; or maybe just send messages one by one. The only real way to eradicate this problem is what he is already trying to do: educate the users.
- callahad 15y agoBut at that point, you're already working with a user that's fallen victim to social engineering. The script could likely find a way to present the captchas that would similarly fool the user into completing them.
- mkjones 15y agoThey could just tell the user that the captcha is part of the "security check" the user must do to see if they're in the 2% or whatever. Users will do almost anything if you instruct them well enough.