13

On registration screen there are 3 fields: Email, Password and Captcha.

User has entered valid email and password but has entered wrong Captcha.

Here an error message specific to the wrong Captcha field is displayed and the Captcha is reset.

Should the value in the Password field be reset to blank too?

Improve this question

4 Answers 4

Reset to default
14

If you clear the password field when you have a faulty password, then it should clear the password field on a faulty CAPTCHA too and it should not specifically state that it was the CAPTCHA that was wrong while the rest were valid.

Why?

In case of using CAPTCHA — i.e. you are expecting bots to come knocking on your door and you wish to turn them away — you should not let the bot glean any information from failed login attempts. This is especially important for the case of bots trying out passwords in order to hack into accounts. You do not wish to reveal that the password was actually correct.

In these days where people re-use passwords blatantly, and servers gets hacked, those that gain access to lists of usernames and passwords then feed those lists to bots and have the bots try them out on different sites all over the net.

So even if the bot fails to log in due to the CAPTCHA, it can still tell its hacker "Hey, sites A, B and C seem to work with these username/password combos". The hacker can then manually log in and enter the right CAPTCHA.

Improve this answer
7
  • Michael's answer is technically right, assuming that the application would feedback the correctness of the username and password. The primary reason to include a CAPTCHA field on a login form is to prevent brute force attacks. If this is not the case, I see no reason to clear those password fields, except for the reason that saving them plain text in the session might introduce security issues. It would be weird, especially if you use an AJAX-ified CAPTCHA field which doesn't require a page refresh.
    – Jan van der Burgt
    May 2, 2016 at 17:25
  • @MichaelKarnerfors: Interesting take. I would definitely consider above mention points. But from point of User behaviour, what do you suggest: Should the password field be cleared?
    – Aditya Durgude
    May 3, 2016 at 5:11
  • @AdityaDurgude That is probably a matter of taste and preference. Whether to clear or not is best suited as a separate question. And I suspect people have written treatises on that. :) I would recommend refreshing the CAPTCHA on a failed login in any case.
    – MichaelK
    May 3, 2016 at 5:16
  • @JanvanderBurgt Yes I know brute force bot attacks was the original reason for using CAPTCHA. But these days I would dare say that we have new bot-based threats to worry about as well, and not just brute force attacks. Well... you could say that bots probing websites with lists of gleaned usernames/password are a sort of brute force attacks. It is just not aimed at your site specifically, it is aimed at lots and lots of sites. But never-the-less it can cause a breach in the exactly same way that a directed brute force attack can.
    – MichaelK
    May 3, 2016 at 9:31
  • 1
    The question is asking about registration page. This answer is referring to login page, which is irrelevant.
    – wilson
    May 6, 2016 at 7:43
10

No, please don't

First of all, I'd try to study and test if I need a captcha. And I mean, test it thoroughly. While Captcha are an obvious enhance in security, they have severe issues in terms of usability. see the docs below:

This is just a small sample, but it would be useful for you to read them so you understand the pros and cons. However, if you don't want to read those docs, I'll simplify it: captchas are extremely annoying and disturbing and they affect usability and conversions

So, what to do?

Of course, you can use other methods like honeypots, but if you decide that you want to use a captcha, you should be aware you're adding friction for the user, whether you need it or not, this is an objective fact. So, adding yet more friction is getting into the anti-pattern realm.

Think about this:

User enters password properly User enters wrong captcha

FAIL

Now you delete the pass and user enters wrong password and correct captcha

FAIL

Now user has no idea what's going wrong, tries another pass

FAIL

Another try with another pass?

FAIL

At this point, if user is desperate, s/he will ask for a password remainder. Otherwise, s/he will simply abandon your site forever. Please note that the above is not a random flow, but a very common user flow. Also, if you're thinking in terms of security... well, you made the user enter all his passwords and variations. If this is a concern for you, you just provided a hacker with lots of REAL passwords.

In short

Do NOT create friction. Never. Just use the smallest friction possible within the specs and always try to find alternatives. Thus, if the password is correct, just leave it and let the user deal with the captcha alone. And again: unless your need for captcha is really extreme (eg you need a great deal of security), look for alternatives

Improve this answer
1
  • 1
    A CAPTCHA does not enhance security -- it is merely an inelegant way for the service provider to defend against bots. There are better ways to handle this (honeypots, as stated, being one). It's definitely not for the user's benefit. I agree with the general sentiment though.
    – Bill Dagg
    May 4, 2016 at 23:12
3

Never provide an attacker with any clue whatsoever to his only question: "What account credentials may be valid?" This is a problem comparable to the error message that one would show when a login fails.

You shoudl never state things like "Wrong password" or "Wrong username". Use phrases like "Wrong credentials" or "Wrong username/password combination".

Leaving your password field filled out if its correct will be recognized as a possible attack vector very fast. Your captach will be useless if you give bots a way to check credentials without using it.

Improve this answer
-2

As per my point of view, captcha and password fields are not related to each other. Because captcha means you are checking that details entered by human or machine(robot).

First decide that what's your priority password or captcha?

If you car giving constrain such like user can't login without correct captcha then there is no need to remove password field.

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.