隐形验证码
我在网站的表单提交中使用以下安全性（不可见验证码）以防止自动提交：
- 使用数字 x 上的固定盐生成 md5 结果并渲染它 在表单内部作为隐藏字段
- 生成 2 个隐藏字段 a 和 b，其中 a + b = x，a 和 b 是 提交时未加密
- ，使用 javascript 添加另一个普通隐藏字段 c 其中服务器端的 c=a+b
- 在 c 上应用 md5 和盐，将其与加密的进行比较 x
然而该系统在生产中被破解，一个人能够成功自动提交数千份表格。知道怎么做吗？
一种方法是，黑客已经知道该操作是+（通过观察javascript很容易找出），读取表单并添加a和b，创建一个带有额外c字段的新表单，其中c=a+ b.他必须首先阅读表格，然后创建一个用于提交。
我的问题是：
- 我上面提出的假设是否是破坏我的系统的可能方法？
- 如果是这样，我应该做什么来防止这种黑客攻击？
- 黑客可能使用哪些其他替代黑客手段？
我不想使用真正的验证码，因为它会降低用户体验。欢迎所有建议。
I'm using the following security(invisble captcha) for my site's form submission to prevent auto submission:
- generate the result of md5 with a fixed salt on number x and render it
inside the form as a hidden field - generate 2 hidden fields a and b where a + b = x, a and b are
unencrypted - upon submission, use javascript to add another plain hidden field c
where c=a+b - on server side apply md5 on c with the salt, compare it with encrypted
x
However such system is cracked in production, one person was able to auto-submit thousands of forms successfully. Any idea how?
One way to do it is, the hacker already knows that the operation is + (simple to find out by observation of javascript), read the form and add a and b, create a new form with the extra c field where c=a+b. He has to first read a form, then create one for submission.
My questions are:
- Is the hypothesis I presented above the likely way to break my system?
- If so, what should I do to prevent this kind of hack?
- What are other alternative hacks the hacker might use?
I don't want to use real captcha because it degrades user experience. All suggestions are welcome.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
我无法针对您的具体情况提供建议，但 Django 有一些不错的方法，如何在没有验证码的情况下抑制评论字段中的垃圾邮件： 这里的方法很好。
I can't give advice in your specific case, but Django has some nice approaches, how spam in comment fields could be supressed without captchas: Nice approaches here.
您的系统无法工作，因为攻击者只是自己执行您的 JavaScript。如果您想使用某种类似的方案来阻止自动提交，您需要为客户端设置一个工作负载因素。这不会阻止自动化软件提交到您的网站，但会减慢它们的速度并增加攻击成本。目标是增加成本并减慢攻击速度，使攻击变得不值得。与其尝试自己构建它，不如尝试使用此工作证明服务。
Your system is not working because the attacker(s) are just executing your JavaScript themselves. If you want to use a somewhat similar scheme that will prevent automated submissions you need to put a workload factor on the client. This will not stop the automated software from being able to submit to your site but it will slow them down and increase the cost of an attack. The goal is to increase the cost and slow them down enough that the attack is just not worthwhile. Instead of trying to build it yourself try using this proof of work service.
或者，黑客可以自己执行您的 JavaScript。
如果你想验证用户不是机器人，你必须让用户做一些机器人不能做的事情。真的就是这么简单。
Alternatively, the hacker could just execute your javascript themselves.
If you want to validate that the user isn't a robot, you'll have to get the user to do something a robot can't. It's really that simple.
进一步的步骤是增加所需的计算量；使提交表格的速度变得不可行。尝试查看HashCash。
A further step would be to increase the amount of computation required; make it infeasible to submit the forms too rapidly. Try looking at HashCash.