« French election
QapTcha
Random idea: non-generic default avatars »

live627

  • Should five per cent appear too small / Be thankful I don't take it all / 'Cause I'm the taxman, yeah I'm the taxman
  • Posts: 1,670
QapTcha
« on April 19th, 2012, 06:41 AM »
http://www.myjqueryplugins.com/QapTcha

This is a very interesting take on user validation. It is a jQuery plugin that generates a random string and puts it into a hidden input. The widget looks and behaves much like the iPod control to unlock it right after you turn it on. Once you slide it to the right, it "unlocks" the form for submission. Once that happens, a session variable is injected and the input element is emptied.

There is one fundamental flaw with it, though: if javascript is disabled, you're out of luck. They even admit it! However, they also note that the server-side validation will then fail, unconditionally.

However half-assed this implementation is, it seems like a nice idea.
A confident man keeps quiet.whereas a frightened man keeps talking, hiding his fear.

Arantor

  • As powerful as possible, as complex as necessary.
  • Posts: 14,278
Re: QapTcha
« Reply #1, on April 19th, 2012, 01:13 PM »
You're actually relying totally on the bot not spotting this particular CAPTCHA because it is exceptionally to beat programmatically.

See, more fundamentally flawed than the requirement of JS on the client is the way it's implemented. The server portion generates a session value (which it's expecting to find later), and a hidden input is dropped into the page with that in it, and a randomised value to it.

When you drag the thing across, the input is left as it is - but the value is removed. The author is either reasonably clued up, or very lucky at this point, because spam bot behaviour in that case is to smush through forms with values for each field item and see what happens. So, relying on that field being empty is a smart move (and indirectly something Wedge already does, not that you'd know it without looking, heheh)

Consequently you'll have a big-ass input in the code:
Code: [Select]
<input name="FE4MfmzcGpGngehKeNC9TBqSHgNxrnzb" type="hidden" value="ku@3Msb">

Glancing back over the implementation notes, this is actually intentional behaviour, so the author is smart enough to know that bots just often hamfistedly fill in everything. But it's possible to detect use of this in a single line of code, and not a lot more effort to exclude it going forwards.


Maybe I'm being a bit harsh but I'm thinking: 9 out of 10 for imagination, 4 out of 10 for implementation.
When we unite against a common enemy that attacks our ethos, it nurtures group solidarity. Trolls are sensational, yes, but we keep everyone honest. | Game Memorial

live627

  • Should five per cent appear too small / Be thankful I don't take it all / 'Cause I'm the taxman, yeah I'm the taxman
  • Posts: 1,670
Re: QapTcha
« Reply #2, on April 19th, 2012, 10:52 PM »
Do bots have javascript enabled?

Arantor

  • As powerful as possible, as complex as necessary.
  • Posts: 14,278
Re: QapTcha
« Reply #3, on April 19th, 2012, 11:41 PM »
Does it matter? The input etc is pushed from PHP, meaning that the information including the key is available without JS.

All the JS is doing is essentially saying 'if the user moves this box to here, *empty out this input*'. There is nothing more that it is doing.

Nao

  • Dadman with a boy
  • Posts: 16,082
Re: QapTcha
« Reply #4, on April 20th, 2012, 07:54 AM »
Basically a bot could even implement it's own pseudo code to emulate whatever js does.
Too bad eh :)

This should be moved to a private place as it mentions Wedge specific security.

live627

  • Should five per cent appear too small / Be thankful I don't take it all / 'Cause I'm the taxman, yeah I'm the taxman
  • Posts: 1,670
Re: QapTcha
« Reply #5, on April 20th, 2012, 08:34 AM »
Quote
it mentions Wedge specific security
What the...? It does?

::edit: It does.My bad..

Arantor

  • As powerful as possible, as complex as necessary.
  • Posts: 14,278
Re: QapTcha
« Reply #6, on April 20th, 2012, 01:45 PM »
Quote
Basically a bot could even implement it's own pseudo code to emulate whatever js does.
Of course it could. Ultimately the state of play is that whatever request is sent back to the server can be fraudulently made, and it wouldn't be impossible at all for a bot to realise what's going on here.
Quote
This should be moved to a private place as it mentions Wedge specific security.
It does, yes, but it's not as if it's a measure that I'm overly bothered with hiding. A certain pragmatism in me says that the bad guys will go looking for it anyway, and there's no point in hiding this knowledge from white hats when the black hats will find it anyway.

PantsManUK

  • [me=PantsManUK]would dearly love to dump SMF 1.X at this juncture...[/me]
  • Posts: 174
Re: QapTcha
« Reply #7, on April 20th, 2012, 04:51 PM »
Quote from Arantor on April 20th, 2012, 01:45 PM
It does, yes, but it's not as if it's a measure that I'm overly bothered with hiding. A certain pragmatism in me says that the bad guys will go looking for it anyway, and there's no point in hiding this knowledge from white hats when the black hats will find it anyway.
Someone (might have been Bruce Schneier) said (and I'm paraphrasing) "if you aren't prepared to have your security tested in public, you've not got any security at all" - if you publish your entire security mechanism and it stays secure, it's secure...
« What is this thing you hoomans call "Facebook"? »

Arantor

  • As powerful as possible, as complex as necessary.
  • Posts: 14,278
Re: QapTcha
« Reply #8, on April 20th, 2012, 05:51 PM »
Well, this is the thing, it's security by obscurity, and a measure I'm prepared to accept because it isn't a measure that is secure all on its own - but as a facet of a more complex system.

PantsManUK

  • [me=PantsManUK]would dearly love to dump SMF 1.X at this juncture...[/me]
  • Posts: 174
Re: QapTcha
« Reply #9, on April 20th, 2012, 10:18 PM »
I understand (really, I do). The point I was/am trying to make is, don't be afraid to discuss a small part of your security, even in detail. :)

Arantor

  • As powerful as possible, as complex as necessary.
  • Posts: 14,278
Re: QapTcha
« Reply #10, on April 20th, 2012, 10:52 PM »
Oh, I'm not afraid. I just don't want there to be any illusions about whether this is a 'security' measure or not, you know?

It is a form of anti-bot measure.
« French election
Random idea: non-generic default avatars »