New answers tagged

0

There is no good way to implement a CAPTCHA. They're bad, really bad, for usability. The latest Google text CAPTCHA to be used before this picture puzzle was apparently easier to solve by bots than humans. I know I could spend dozens of tries before succeeding. Up to 40% of users allegedly failed to solve these when they were taken out (though I've lost the ...


3

Captcha is inherently not user-friendly, as it is a barrier to content that has no relevance on the user experience. Trying to roll your own captcha process is going to not achieve what you are trying to accomplish, for a few reasons: Users already have a defined mental model of what to expect when using captcha. This is due to the widespread use of ...


2

Never provide an attacker with any clue whatsoever to his only question: "What account credentials may be valid?" This is a problem comparable to the error message that one would show when a login fails. You shoudl never state things like "Wrong password" or "Wrong username". Use phrases like "Wrong credentials" or "Wrong username/password combination". ...


7

No, please don't First of all, I'd try to study and test if I need a captcha. And I mean, test it thoroughly. While Captcha are an obvious enhance in security, they have severe issues in terms of usability. see the docs below: Usability of CAPTCHAs - Or usability issues in CAPTCHA design Recent Findings On Captcha & The User Experience CAPTCHA Can ...


10

If you clear the password field when you have a faulty password, then it should clear the password field on a faulty CAPTCHA too and it should not specifically state that it was the CAPTCHA that was wrong while the rest were valid. Why? In case of using CAPTCHA — i.e. you are expecting bots to come knocking on your door and you wish to turn them away — ...


-1

As per my point of view, captcha and password fields are not related to each other. Because captcha means you are checking that details entered by human or machine(robot). First decide that what's your priority password or captcha? If you car giving constrain such like user can't login without correct captcha then there is no need to remove password field. ...



Top 50 recent answers are included