News for hackers. Stuff that matters.

A comment on hCaptcha now runs on fifteen percent of the internet. Parent comment

Re:hCaptcha now runs on fifteen percent of the internet by aftbit on Wednesday November 25, 2020 @03:24PM (#25213872)
There's a lot of arguments against captchas, but I do not agree with this one. You will always leak whether or not a password is correct based on how your app behaves - a correct password will grant entry to the application. If you only ask for a captcha when a user account exists but fail to ask if they use a made up username, that's an information leak.
[ Parent | on HN ]
Re:hCaptcha now runs on fifteen percent of the internet by 3np on Wednesday November 25, 2020 @07:11PM (#25215699)
The trick is to ask for captcha before validation.
[ Parent | on HN ]