Re: Account Lockouts

Hi,

 If you are truly concerned about the visually challenged there could
be a link to a sound which they must play ... but then what if they
don't have speakers .. etc.

 The obvious solution here is to allow them to disable this seconday
confirmation via a call to the helpdesk.

 As to the not-so obvious problem ... yes, it's an issue to be
considered, but think about the problem that we are trying to solve
... IMO I wouldn't be concerned about this kind of attack.

-- Michael


On Thu, 02 Dec 2004 12:52:34 -0500, [email protected]
<[email protected]> wrote:
> On Thu, 02 Dec 2004 15:10:21 +1100, Michael Silk said:
> > Hi,
> >
> >  A pretty easy solution exists and is to use "http://www.captcha.net/"
> > images before locking the account.
> 
> The obvious problem is that a visually-challenged user is screwed.
> 
> The not-so-obvious problem is that although it "proves" the person is a person,
> it doesn't prove that the person who entered the response is the "alledged
> person or script" you sent the image to.
> 
> Some spammers have found a way to deal with these - they grab the image, and
> pass it through to some *other* user as a captcha to get into a "free porn"
> site or similar.  So the user sees it, types it in for the spammer, and then
> the spammer redirects the response to whoever originally sent it.
> 
> 
>