kbwood / realperson Goto Github PK

Real Person forgoes the common captcha method of having a user recognize the text in an image and instead constructs the captcha out of asterisks and non-breaking spaces.

This leads to a captcha that is easily defeated by anyone that simply takes the time to write up a quick script to solve it, which is quite simple to do.

Hi,

There is an incompatibility with jQuery 1.9. Your plugin is using the live() function which has been removed in this version.

Regards,
Ryuja

The minified version seems not working... to be invesitgated/reminified from source..

Hi. I can't find the way to use captcha via ajax. Can you help me with it?

Because the hash is calculated client-side, it's incredibly easy to automate form entry on any form using this by simply filling out the hash field:

$(".hasRealPerson").val("ABSURD");
$(".realperson-hash").val($.realperson._hash("ABSURD"));

An attacker doesn't even have to use javascript for submits, they can just use _hash once to figure out one matching pair of values, and then pass that into whatever app to keep making POST requests.

Even if the hash was calculated & salted server-side and the captcha was also generated server-side, there's still the absurd fact that the captcha text is presented as a series of predictable, easy-to-interpret, plaintext asterisk characters!

I'm sorry, but this entire plugin is laughable.