Reputation: 393
I made this simple captcha but I was told that it is very useful and well done. I would like some advice and guidance on how to improve it in terms of security but most of all I would like to understand why it is not good and not safe.
Upvotes: 0
Views: 376
Reputation: 173602
This won't work because I can simply submit a form with all zero values and it will pass; that's because you mistakenly trust the user input based on what they can see, but a bot will not bother with that.
A slightly better alternative is to keep those two random values in a session and only compare the submitted result; an additional challenge is to use number words, e.g. "What's five plus nineteen?" ... of course that means you have to accept number words from legit users as well :)
Better yet is to use reCAPTCHA or similar services, simply because smart people have solved this issue for you, already.
Upvotes: 1