4 ms·

Yes, an afternoon of coding to be able to post spam on exactly one website. Until they change the captcha.

krapp 14y ago
Unlikely but not impossible. I've seen forums get flooded for no other apparent rationale than some random skiddie had nothing better to do for an hour or two than irritate the admins. It being not worth anyone's time to break isn't actually a feature, but it being relatively easy for anyone with time to waste on it is a flaw.
bdc 14y ago
Actually, the captcha predicate is a GET request that looks like this: http://en.lichess.org/captcha/78pkfjgz?solution=e5+e4 http://en.lichess.org/captcha/78pkfjgz?solution=e5+e4 which returns 1 or 0. So the brute force captcha solution is to go through 8^4 (~4k) get requests, which you could code in five minutes and execute in a minute.
- MichaelGG 14y ago
  I would imagine it'd be fairly trivial to limit the number of requests.
brownbat 14y ago
OP may have been suggesting it's not actually a CAPTCHA in the first place, under the understanding that CAPTCHAs are at least nominally supposed to target something computers are bad at. Chess is even a particularly ironic implementation because it was one of the first traditionally human passtimes where computers excelled. A site can have a CAPTCHA that's so bad it's not actually a CAPTCHA even if no one bothers to attack it. My hidden forum could require a user to sum one thousand integers before seeing any posts. I probably wouldn't attract any spammers (because no one would join to read their spam), but that doesn't mean the so-called CAPTCHA is beyond reproach.
rorrr 14y ago
So you are, literally, arguing for security by obscurity. "Oh, my captcha is unique, therefore nobody will bother". There are easier to implement unique captchas, than chess.
- aethertap 14y ago
  I'd agree partially, but I'd comment that it's also security by diversity. If every site had a unique captcha solution requiring custom software for a defeat, the force multiplier effect of "write once, run everywhere" would be hugely diminished, and it would be much less cost effective to implement various types of spam. So, the particular security strategy here is indeed weak, but I would say that it might actually strike closer to the root of the problem than just making a really hard, but still universally applied, captcha technology.
  - rorrr 14y ago
    You are not making any sense.
    - aethertap 14y ago
      The economics of spam commenting makes sense if it can be done automatically at a massive scale. If only one or a very small number of "humanity tests" exist, then cracking those tests has a high payoff value. Having a huge number of different, ad-hoc authentication schemes would make developing automatic cracks unacceptably expensive for the actual level of benefit achieved by posting the spam comment. Therefore, being a site with a unique CAPTCHA system attacks the core value proposition of spam comments, which strikes the root of the issue. Another way to look at it is like the entire collection of CAPTCHAs on the Internet is really just one big CAPTCHA library, which tests a subset of "human" abilities. The larger the subset, the more difficult it will be to circumvent. Relying on one or two special abilities makes it easier for a machine to emulate those behaviors and gain access. I hope that clarifies the point I was making.
- danielweber 14y ago
  Obscurity can be a great tool for security. But you have to understand its limitations, and expect at some point it will fail. Custom captchas are probably a great use of this.

krapp 14y ago

Unlikely but not impossible. I've seen forums get flooded for no other apparent rationale than some random skiddie had nothing better to do for an hour or two than irritate the admins. It being not worth anyone's time to break isn't actually a feature, but it being relatively easy for anyone with time to waste on it is a flaw.

bdc 14y ago

Actually, the captcha predicate is a GET request that looks like this: http://en.lichess.org/captcha/78pkfjgz?solution=e5+e4 http://en.lichess.org/captcha/78pkfjgz?solution=e5+e4 which returns 1 or 0. So the brute force captcha solution is to go through 8^4 (~4k) get requests, which you could code in five minutes and execute in a minute.

MichaelGG 14y ago
I would imagine it'd be fairly trivial to limit the number of requests.

brownbat 14y ago

OP may have been suggesting it's not actually a CAPTCHA in the first place, under the understanding that CAPTCHAs are at least nominally supposed to target something computers are bad at. Chess is even a particularly ironic implementation because it was one of the first traditionally human passtimes where computers excelled. A site can have a CAPTCHA that's so bad it's not actually a CAPTCHA even if no one bothers to attack it. My hidden forum could require a user to sum one thousand integers before seeing any posts. I probably wouldn't attract any spammers (because no one would join to read their spam), but that doesn't mean the so-called CAPTCHA is beyond reproach.

rorrr 14y ago

So you are, literally, arguing for security by obscurity. "Oh, my captcha is unique, therefore nobody will bother". There are easier to implement unique captchas, than chess.

aethertap 14y ago
I'd agree partially, but I'd comment that it's also security by diversity. If every site had a unique captcha solution requiring custom software for a defeat, the force multiplier effect of "write once, run everywhere" would be hugely diminished, and it would be much less cost effective to implement various types of spam. So, the particular security strategy here is indeed weak, but I would say that it might actually strike closer to the root of the problem than just making a really hard, but still universally applied, captcha technology.
- rorrr 14y ago
  You are not making any sense.
  - aethertap 14y ago
    The economics of spam commenting makes sense if it can be done automatically at a massive scale. If only one or a very small number of "humanity tests" exist, then cracking those tests has a high payoff value. Having a huge number of different, ad-hoc authentication schemes would make developing automatic cracks unacceptably expensive for the actual level of benefit achieved by posting the spam comment. Therefore, being a site with a unique CAPTCHA system attacks the core value proposition of spam comments, which strikes the root of the issue. Another way to look at it is like the entire collection of CAPTCHAs on the Internet is really just one big CAPTCHA library, which tests a subset of "human" abilities. The larger the subset, the more difficult it will be to circumvent. Relying on one or two special abilities makes it easier for a machine to emulate those behaviors and gain access. I hope that clarifies the point I was making.
danielweber 14y ago
Obscurity can be a great tool for security. But you have to understand its limitations, and expect at some point it will fail. Custom captchas are probably a great use of this.