18 ms·

Yeah, but then again, so many times that I run into Captcha issues, it's on a site that really doesn't need Captcha to begin with. Why make me solve a Captcha

by capsha 7y ago

Yeah, but then again, so many times that I run into Captcha issues, it's on a site that really doesn't need Captcha to begin with. Why make me solve a Captcha to see static content? Why make me solve a Captcha to log in when I've already completed one to register? Why make me solve a Captcha to pay utility bills? Is there some underground group of deviants going around surreptitiously paying other people's utility bills? The monsters.

DownGoat 7y ago
> Why make me solve a Captcha to see static content? Fair point, I usually run into this when using Tor, or VPN when accessing content behind Cloudflare, and or similar services. This is some anti abuse stuff, but is often overly agressive with giving you captchas. > Why make me solve a Captcha to log in when I've already completed one to register? So attackers cannot password spray. This is typically after attackers has gotten access to the latest database breach, and are just blindly trying username/password combinations. > Why make me solve a Captcha to pay utility bills? Is there some underground group of deviants going around surreptitiously paying other people's utility bills? Sound like a strange place to have a captcha indeed. What information is needed in the form to submit it? Does it validate stuff that an attacker might want to scrape? I guess they added it for a reason.
- Elv13 7y ago
  > Sound like a strange place to have a captcha indeed. What information is needed in the form to submit it? Does it validate stuff that an attacker might want to scrape? I guess they added it for a reason. In the past, I used curl to get some billing info, add the money to a dedicated virtual prepaid card, then pay the bill, then send an email to a gmail (+paidinvoice) label. These day, at least for my bills, they have pre-approved withdraw directly from the bank. However I guess this is not widely deployed. If other people did this, but ended up doing it from an insecure machine and lost the credentials / got hacked, I can see why at least some orgs might want to prevent people from doing this. This is a classic over reaction, but a plausible scenario.
  - DownGoat 7y ago
    > If other people did this, but ended up doing it from an insecure machine and lost the credentials / got hacked, I can see why at least some orgs might want to prevent people from doing this. The measure is not really about protecting the user that is using the payment form, it is meant to "protect" the system that is validating the payment data. The payment form may be a target for attacker which has gotten a large batch of credit cards from somewhere else, and wants to validate the data. They then regularly exploit such forms, or other naive payment system to check if the credit card data is valid. CandyJapan owner wrote some blog posts about the subject. https://www.candyjapan.com/behind-the-scenes/how-i-got-credit-card-fraud-somewhat-under-control https://www.candyjapan.com/behind-the-scenes/how-i-got-credi... https://www.candyjapan.com/behind-the-scenes/candy-japan-hit-with-credit-card-fraud https://www.candyjapan.com/behind-the-scenes/candy-japan-hit... https://www.candyjapan.com/behind-the-scenes/fraudulent-transaction-warning-signs https://www.candyjapan.com/behind-the-scenes/fraudulent-tran...
- gwoplock 7y ago
  > > Why make me solve a Captcha to pay utility bills? Is there some underground group of deviants going around surreptitiously paying other people's utility bills? > Sound like a strange place to have a captcha indeed. What information is needed in the form to submit it? Does it validate stuff that an attacker might want to scrape? I guess they added it for a reason. Ive seen captchas on payment forms to prevent credit card checking. You can take a dump of CC details and try them all out on a site and get back the valid ones. I'd assume they charge $1 to the CC to test it before allowing you to continue and then you could cancel your order before they charge the full amount. However, assuming you have to be logged in to pay your bill that seems less reasonable.
  - aczerepinski 7y ago
    I've even seen people beat captcha in bulk to get to a payment form. My best guess is something along the lines of mechanical turk or a room full of low wage workers doing it manually. I think the payoff of verifying stolen cards is worth enough to justify some kind of workaround. If you host a payment form that informs the user about whether payment was accepted, you're a target.
- Zak 7y ago
  > I guess they added it for a reason. This is not necessarily a reasonable assumption. People often do things because they heard it was a good practice, or because it solves a problem they don't actually have, but think they might, or arbitrarily without giving it much thought.
  - deleted 7y ago
    [deleted]
- Dylan16807 7y ago
  > So attackers cannot password spray. My password's not crackable, so it's annoying to be lumped in to that. I'd happily use a service-generated password to avoid login hassles.
  - therein 7y ago
    I imagine what you are proposing then is to record the entropy on the password when you first register and for accounts with sufficient password entropy to not ask for a captcha after few failed attempts. With that, the site gives away whether the account has a low entropy password or not.
    - yc12340 7y ago
      > I imagine what you are proposing then is to record the entropy on the password Or just generate secure high-entropy passwords and force users to use them. Making users look up SMS codes before each login is acceptable. Making them solve obnoxious, long, privacy-hostile riddles is acceptable. But forcing them to use pre-generated secure passwords?! That can't possibly work. They will revolt!
    - Dylan16807 7y ago
      > With that, the site gives away whether the account has a low entropy password or not. Sure, why not? Way more than half of passwords are low-entropy, so that doesn't meaningfully help them focus attacks. And they still have to keep solving captchas to make those attempts.
- lscotte 7y ago
  My electric company requires one to login - but only after a the browser session expires and I have to login again anyway.
- userbinator 7y ago
  So attackers cannot password spray. This is typically after attackers has gotten access to the latest database breach, and are just blindly trying username/password combinations. A simple ratelimit takes care of that. Plus, it's not like attackers would be easily defeated by a CAPTCHA anyway --- there are services selling batches of valid tokens, likely generated by actual humans or very close emulations thereof, for ReCAPTCHA.
  - atombender 7y ago
    Rate limit by what? IP? Botnet traffic will originate at random IPs.
    - basilgohar 7y ago
      By the account. 3 failed login attempts in a row, and you disallow further logins for 30 seconds. This should waste less time than reCAPTCHAs. I know it's not 1:1 in terms of pros/cons, but it gets a good subset of the advantages without the key disadvantages mentioned above.
      - hombre_fatal 7y ago
        So I can lock you out of your account with 3 attempts from any IP address?
        wolco 7y ago
        For a minute usually. Prevents flooding. Not a bad approach unless the account is constantly hit. In those cases two factor auth makes sense.
        DownGoat 7y ago
        This is obviously a bad idea. It costs nothing for an attacker to send 3 http requests, every minute, every hour, all day. They could lock your account basically forever. IP filtering and locking accounts are terrible ways of preventing password spraying.
deleted 7y ago
[deleted]
abawany 7y ago
The weirdest one I have ever seen is on frikking walmart.com - here is my cynical paraphrasing of their 'thought process': "We don't want your money! Go back to Amazon! No captchas there cause they are not stupid!" I persist because I don't want to go back to being a 2nd-class non-Prime Amazon citizen but the darned unnecessary captchas really ruin my walmart.com shopping experience to no end. If anyone from Walmart.com is reading, please please get rid of these useless captchas - it is an incredibly stupid thing that you do and unfortunately you do it too well as well.

by capsha 7y ago

DownGoat 7y ago

> Why make me solve a Captcha to see static content? Fair point, I usually run into this when using Tor, or VPN when accessing content behind Cloudflare, and or similar services. This is some anti abuse stuff, but is often overly agressive with giving you captchas. > Why make me solve a Captcha to log in when I've already completed one to register? So attackers cannot password spray. This is typically after attackers has gotten access to the latest database breach, and are just blindly trying username/password combinations. > Why make me solve a Captcha to pay utility bills? Is there some underground group of deviants going around surreptitiously paying other people's utility bills? Sound like a strange place to have a captcha indeed. What information is needed in the form to submit it? Does it validate stuff that an attacker might want to scrape? I guess they added it for a reason.

Elv13 7y ago
> Sound like a strange place to have a captcha indeed. What information is needed in the form to submit it? Does it validate stuff that an attacker might want to scrape? I guess they added it for a reason. In the past, I used curl to get some billing info, add the money to a dedicated virtual prepaid card, then pay the bill, then send an email to a gmail (+paidinvoice) label. These day, at least for my bills, they have pre-approved withdraw directly from the bank. However I guess this is not widely deployed. If other people did this, but ended up doing it from an insecure machine and lost the credentials / got hacked, I can see why at least some orgs might want to prevent people from doing this. This is a classic over reaction, but a plausible scenario.
- DownGoat 7y ago
  > If other people did this, but ended up doing it from an insecure machine and lost the credentials / got hacked, I can see why at least some orgs might want to prevent people from doing this. The measure is not really about protecting the user that is using the payment form, it is meant to "protect" the system that is validating the payment data. The payment form may be a target for attacker which has gotten a large batch of credit cards from somewhere else, and wants to validate the data. They then regularly exploit such forms, or other naive payment system to check if the credit card data is valid. CandyJapan owner wrote some blog posts about the subject. https://www.candyjapan.com/behind-the-scenes/how-i-got-credit-card-fraud-somewhat-under-control https://www.candyjapan.com/behind-the-scenes/how-i-got-credi... https://www.candyjapan.com/behind-the-scenes/candy-japan-hit-with-credit-card-fraud https://www.candyjapan.com/behind-the-scenes/candy-japan-hit... https://www.candyjapan.com/behind-the-scenes/fraudulent-transaction-warning-signs https://www.candyjapan.com/behind-the-scenes/fraudulent-tran...
gwoplock 7y ago
> > Why make me solve a Captcha to pay utility bills? Is there some underground group of deviants going around surreptitiously paying other people's utility bills? > Sound like a strange place to have a captcha indeed. What information is needed in the form to submit it? Does it validate stuff that an attacker might want to scrape? I guess they added it for a reason. Ive seen captchas on payment forms to prevent credit card checking. You can take a dump of CC details and try them all out on a site and get back the valid ones. I'd assume they charge $1 to the CC to test it before allowing you to continue and then you could cancel your order before they charge the full amount. However, assuming you have to be logged in to pay your bill that seems less reasonable.
- aczerepinski 7y ago
  I've even seen people beat captcha in bulk to get to a payment form. My best guess is something along the lines of mechanical turk or a room full of low wage workers doing it manually. I think the payoff of verifying stolen cards is worth enough to justify some kind of workaround. If you host a payment form that informs the user about whether payment was accepted, you're a target.
Zak 7y ago
> I guess they added it for a reason. This is not necessarily a reasonable assumption. People often do things because they heard it was a good practice, or because it solves a problem they don't actually have, but think they might, or arbitrarily without giving it much thought.
- deleted 7y ago
  [deleted]
Dylan16807 7y ago
> So attackers cannot password spray. My password's not crackable, so it's annoying to be lumped in to that. I'd happily use a service-generated password to avoid login hassles.
- therein 7y ago
  I imagine what you are proposing then is to record the entropy on the password when you first register and for accounts with sufficient password entropy to not ask for a captcha after few failed attempts. With that, the site gives away whether the account has a low entropy password or not.
  - yc12340 7y ago
    > I imagine what you are proposing then is to record the entropy on the password Or just generate secure high-entropy passwords and force users to use them. Making users look up SMS codes before each login is acceptable. Making them solve obnoxious, long, privacy-hostile riddles is acceptable. But forcing them to use pre-generated secure passwords?! That can't possibly work. They will revolt!
  - Dylan16807 7y ago
    > With that, the site gives away whether the account has a low entropy password or not. Sure, why not? Way more than half of passwords are low-entropy, so that doesn't meaningfully help them focus attacks. And they still have to keep solving captchas to make those attempts.
lscotte 7y ago
My electric company requires one to login - but only after a the browser session expires and I have to login again anyway.
userbinator 7y ago
So attackers cannot password spray. This is typically after attackers has gotten access to the latest database breach, and are just blindly trying username/password combinations. A simple ratelimit takes care of that. Plus, it's not like attackers would be easily defeated by a CAPTCHA anyway --- there are services selling batches of valid tokens, likely generated by actual humans or very close emulations thereof, for ReCAPTCHA.
- atombender 7y ago
  Rate limit by what? IP? Botnet traffic will originate at random IPs.
  - basilgohar 7y ago
    By the account. 3 failed login attempts in a row, and you disallow further logins for 30 seconds. This should waste less time than reCAPTCHAs. I know it's not 1:1 in terms of pros/cons, but it gets a good subset of the advantages without the key disadvantages mentioned above.
    - hombre_fatal 7y ago
      So I can lock you out of your account with 3 attempts from any IP address?
      - wolco 7y ago
        For a minute usually. Prevents flooding. Not a bad approach unless the account is constantly hit. In those cases two factor auth makes sense.
        DownGoat 7y ago
        This is obviously a bad idea. It costs nothing for an attacker to send 3 http requests, every minute, every hour, all day. They could lock your account basically forever. IP filtering and locking accounts are terrible ways of preventing password spraying.

deleted 7y ago

[deleted]

abawany 7y ago

The weirdest one I have ever seen is on frikking walmart.com - here is my cynical paraphrasing of their 'thought process': "We don't want your money! Go back to Amazon! No captchas there cause they are not stupid!" I persist because I don't want to go back to being a 2nd-class non-Prime Amazon citizen but the darned unnecessary captchas really ruin my walmart.com shopping experience to no end. If anyone from Walmart.com is reading, please please get rid of these useless captchas - it is an incredibly stupid thing that you do and unfortunately you do it too well as well.