Home Messages Index
[Date Prev][Date Next][Thread Prev][Thread Next]
Author IndexDate IndexThread Index

Re: [wp-testers] WordPress 2.0.1 Remote DoS Exploit?

See that would make lots more sense, be accessible, and wouldn't require the amount of work to create and maintain a captcha that was both powerful and human readable.

Issues around that however are: core code text output needs to be able to be internationalized, so that's an extra bunch of work right there. Maths problems are better, but would be easy to script for. Plus any list of problems and answers would, as WP is OSS, be available and you could simply check against a list to find out what the answer was, which would be trivial for a script to do.

That is, if you consider any of this issue an actual problem, which I certainly don't. There are much better ways of doing a DoS attack if someone wanted to...

-- Greg


Roy Schestowitz wrote:
Give the visitor a simple math riddle instead. Or take the approach of Eric
Meyer, who *does* understand usability, and re-use Gatekeeper (a WordPress
plugin) to pose a trivial question.


Also see: http://www.trenholm.co.uk/?p=113


Also, aside from the more obvious problems, most capucha's can be defeated pretty easily if you actually want to devote some cpu cycles to it. They really only protect from really basic scripting attacks.


The following is a rather popular proof-of-contention page:

http://sam.zoy.org/pwntcha/

_______________________________________________
wp-testers mailing list
wp-testers@xxxxxxxxxxxxxxxxxxxx
http://lists.automattic.com/mailman/listinfo/wp-testers




_______________________________________________ wp-testers mailing list wp-testers@xxxxxxxxxxxxxxxxxxxx http://lists.automattic.com/mailman/listinfo/wp-testers

[Date Prev][Date Next][Thread Prev][Thread Next]
Author IndexDate IndexThread Index