Edgewall Software
Modify

Opened 16 months ago

Last modified 11 months ago

#13031 new defect

Text captcha does not obey order of operations

Reported by: dmr Owned by: Dirk Stöcker
Priority: normal Milestone: plugin - spam-filter
Component: plugin/spamfilter Version:
Severity: normal Keywords:
Cc: Branch:
Release Notes:
API Changes:

Description

This was reported by a tor user over irc.oftc.net #tor:

The text captcha asks a simple math question. For example:

six plus two multiplied by four

The correct answer is 6 + 2 × 4 = 6 + 8 = 15, due to order of operations, but the captcha system does not accept that and instead expects you to do (6 + 2) × 4 = 8 × 4 = 32. This is confusing to many users who do multiplication first, as they should. Please explicitly specify that order of operations is ignored, or do not ignore the order of operations. Or accept both answers to the ambiguous question (e.g. both 15 and 32).

They reported that they were not able to add a ticket here, so I'm proxying the ticket creation.

Attachments (0)

Change History (5)

comment:1 by Jun Omae, 16 months ago

Component: generalplugin/spamfilter
Milestone: plugin - spam-filter
Owner: set to Dirk Stöcker

comment:2 by dmr, 16 months ago

The correct answer is 6 + 2 × 4 = 6 + 8 = 15, … Or accept both answers to the ambiguous question (e.g. both 15 and 32).

The reporter further notes that they typo'd the bug report. They meant 14 instead of 15.

I asked them for clarification - whether they did the math wrong initially - and they confirmed that the typo is only for the bug report, not for the captcha answer they provided.

comment:3 by Dirk Stöcker, 16 months ago

Hmm. I'm not sure if fixing this ambiguity actually makes sense. This type of captcha is autosolved by most bots.

in reply to:  description comment:4 by Ryan J Ollos, 16 months ago

Replying to dmr:

They reported that they were not able to add a ticket here, so I'm proxying the ticket creation.

I see the attempts in the SpamFilter log. The user's IPs are blacklisted by multiple services and the user failed multiple captcha tries.

comment:5 by Ryan J Ollos, 11 months ago

#13102 closed as a duplicate.

Modify Ticket

Change Properties
Set your email in Preferences
Action
as new The owner will remain Dirk Stöcker.
The ticket will be disowned. Next status will be 'new'.
as The resolution will be set. Next status will be 'closed'.
The owner will be changed from Dirk Stöcker to anonymous. Next status will be 'assigned'.

Add Comment


E-mail address and name can be saved in the Preferences .
 
Note: See TracTickets for help on using tickets.