Re: Account Lockouts
[email protected] Thu, 02 Dec 2004 12:52:34 -0500
| Newsgroups | gmane.comp.security.programming,gmane.comp.security.web-applications |
|---|---|
| Message-ID | <[email protected]> |
On Thu, 02 Dec 2004 15:10:21 +1100, Michael Silk said: > Hi, > > A pretty easy solution exists and is to use "http://www.captcha.net/" > images before locking the account. The obvious problem is that a visually-challenged user is screwed. The not-so-obvious problem is that although it "proves" the person is a person, it doesn't prove that the person who entered the response is the "alledged person or script" you sent the image to. Some spammers have found a way to deal with these - they grab the image, and pass it through to some *other* user as a captcha to get into a "free porn" site or similar. So the user sees it, types it in for the spammer, and then the spammer redirects the response to whoever originally sent it.
signature.asc
(application/pgp-signature, 226 B)
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (GNU/Linux) Comment: Exmh version 2.5 07/13/2001 iD8DBQFBr1ZhcC3lWbTT17ARAndvAKC3EMEJNxD7Q5iq0BJMifTwCFFh8ACg0yJr on6rmsg5YUBIKckbmPdiIOY= =FUp9 -----END PGP SIGNATURE-----