Re: CAPTCHA image validation in web form

[Ralph Daugherty <rdjfc@xxxxxxxxxxxxx>]

   I don't want to belabor the point, I'll wait to hear pros/cons from 
others as well, but I need to correct something I said and then add 
something else.

   I said that resunmitting multiple times would eventually let the bot 
through. I forgot that we should be responding to a wrong answer with a 
different image and set of answers, so essentially starts over each time.

   I don't know that a bot would ever retrieve the URL in question, and 
if they did, that it would have any idea how to respond, but I do know 
that bots don't work through browsers, so "hidden" fields aren't hidden, 
and they can and will change any value in a cookie as programmed to 
crack a site with well known software.

   A lot of things we will get by on with custom sites through security 
by obscurity instead of being well known software.

   On the other hand, maybe one of us will end up writing well known 
software? :) Let's hope so.

 rd



Guillermo Andrades, CPI Software wrote:
> as you note each image need an caption in each language, then depending the
> user language the captions to show is simply depending on the array index
> (i.e. 1=english  2=spanish  3=french and so on).
> of course making multilanguage apps are complex, so into this complexity is
> a natural function, everithing depending of the language.
>
> also using the transaction-id assigned to the client (cookie or hidden
> field) there are easy to admit only one or even none selection error.
> putting the idea in pause for pro/cons.
>
> Thanks,
> Guillermo.
>
>
>
> On Tue, Sep 2, 2008 at 1:27 AM, Ralph Daugherty <rdjfc@xxxxxxxxxxxxx> wrote:
>
> >    not too simple at all, Guillermo. That would do nicely. I think
> > there was a language requirement not being English, though? Maybe not. I
> > get confused easily.
> >
> >    Anyway, even if there were, some buttons for different languages
> > which would redisplay with captions in selected language. But then
> > following pages would have to be in that language as well.
> >
> >    Of course the foil here is that a resubmit wuth a different
> > selection each time will get through, but no bot is going to be
> > programmed for that for a custom page.
> >
> >    Simple but effective.
> >
> >  rd
> >
> >
> > Guillermo Andrades, CPI Software wrote:
> >  > maybe simple, or maybe useful idea:
> > > the program shows an html with an image,
> > > but the image is not an captcha, the image is an small photo: a boat in
> > the
> > > sea.
> > >
> > > below the image, the question: please select the image:
> > > and an select/combobox or check/radio with several possibilities:
> > > _ ICE  _ BOAT  _ GIRL  _ THE MOON  _ FLOWERS  _ GUITAR  _ THE SUN
> > >
> > > you get the idea, the user click in BOAT and voila,
> > > only human can select the adecuate? ocr is unable at least.
> > >
> > > maybe an low number of images are enough,
> > > this can be made using RPG, no js code required.
> > >
> > > too simple?
> > >
> > > Regards,
> > > Guillermo.