Frage

I made ​​this simple captcha but I was told that it is very useful and well done. I would like some advice and guidance on how to improve it in terms of security but most of all I would like to understand why it is not good and not safe.

War es hilfreich?

Lösung

This won't work because I can simply submit a form with all zero values and it will pass; that's because you mistakenly trust the user input based on what they can see, but a bot will not bother with that.

A slightly better alternative is to keep those two random values in a session and only compare the submitted result; an additional challenge is to use number words, e.g. "What's five plus nineteen?" ... of course that means you have to accept number words from legit users as well :)

Better yet is to use reCAPTCHA or similar services, simply because smart people have solved this issue for you, already.

Lizenziert unter: CC-BY-SA mit Zuschreibung
Nicht verbunden mit StackOverflow
scroll top