在登录表单上添加验证码是不道德的吗？
在最近的一个项目中，我在登录表单上进行了验证码测试，以阻止可能的暴力攻击。
其他同事的立即反应是要求删除它，说它不适合这个目的，而且在那个地方看到验证码很奇怪。
我在注册、联系、密码恢复表单等上看到过验证码图像。因此，我个人认为在这样的地方放置验证码并不合适。嗯，它显然会稍微降低可用性，但这只是时间问题和习惯问题。
由于缺乏验证码测试，人们将不得不设置某种黑名单/帐户锁定机制，这也有一些缺点。
这对您来说是一个不错的选择吗？我是不是有点迷上了验证码，需要某种团体治疗？
提前致谢。
In a recent project I put a captcha test on a login form, in order to stop possible brute force attacks.
The immediate reaction of other coworkers was a request to remove it, saying that it was inapropiate for that purpose, and that it was quite exotic to see a captcha in that place.
I've seen captcha images on signup, contact, password recovery forms, etc. So I personally don't see inapropiate to put a captcha also on a place like that. Well, it obviously burns down usability a little bit, but it's a matter of time and getting used to it.
With the lack of a captcha test, one would have to put some sort of blacklist / account locking mechanism, which also has some drawbacks.
Is it a good choice for you? Am I getting somewhat captcha-aholic and need some sort of group therapy?
Thanks in advance.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
只需在给定用户登录尝试失败的情况下添加验证码测试即可。这是许多网站目前所做的事情（例如所有流行的电子邮件服务），并且侵入性要小得多。
然而，只要攻击者无法破解您的验证码，它就可以完全阻止暴力攻击。
Just add a CAPTCHA test for cases when there have been failed login attempts for a given user. This is what lots of websites currently do (all popular email services for instance) and is much less invasive.
Yet it completely thwarts brute force attacks, as long as the attacker cannot break your CAPTCHA.
这本身并不是不道德的。可用性很差。
考虑安全隐患：用户会认为登录非常耗时，并且会：
考虑其他形式的暴力攻击检测和预防。
It's not immoral per se. It's bad usability.
Consider security implications: the users will consider logging in to be time consuming and will:
Consider other forms of brute-force attack detection and prevention.
验证码并不是登录表单中非常传统的选择。针对暴力攻击的传统保护措施似乎是帐户锁定。正如您所说，它有其缺点，例如，如果您的应用程序容易受到帐户枚举的攻击，那么攻击者可以轻松执行拒绝服务攻击。
Captcha isn't a very traditional choice in login forms. The traditional protection against brute force attacks seems to be account locking. As you said, it has it's drawbacks, for example, if your application is vulnerable to account enumeration, then an attacker could easily perform a denial of service attack.
我倾向于同意你同事的观点。在您无需获得提交数据授权的表单上，验证码可能是必需的，因为否则垃圾邮件机器人会轰炸它们，但我看不出您通过将验证码添加到登录表单来防止哪种滥用？
验证码不提供任何形式的安全性，而其他选项（例如黑名单）则会提供这种安全性。它只是验证用户是一个人，并希望用户名/密码字段能够验证这一点。
如果您想防止暴力攻击，那么几乎任何其他形式的保护都会更有用 - 例如，如果请求太多，则限制请求，或者如果多次输入错误密码，则禁止 IP。
另外，我认为您低估了对可用性的影响。许多浏览器提供了许多实用程序来处理用户名/密码表单，如果添加验证码，所有这些实用程序都会变得毫无用处。
I would tend to agree with your co-workers. A captcha can be necessary on forms where you do not have to be authorized to submit data, because otherwise spambots will bomb them, but I fail to see what kind of abuse you are preventing by adding the captcha to a login form?
A captcha does not provide any form of securtiy, the way your other options, like the blacklist, would. It just verifies that the user is a human being, and hopefully the username/password fields would verify that.
If you want to prevent bruteforce attacks, then almost any other form of protection would be more usefull - throtteling the requests if there is too many, or banning IPs if the enter wrong passwords too many times, for instance.
Also, I think you are underestimating the impact on usability. A lot of browsers provide a lot of utilities to deal with username/password forms and all of these utilities are rendered useless if you add a captcha.
我想谈谈标题中的问题——道德问题。
在以下情况下，我认为验证码是不道德的：
它排除了那些有身体或精神障碍的人参与应用程序，而应用程序的主要部分和目的不会做出这样的排除。
验证码机制使用户接触到超出应用程序中通常预期的令人痛苦的语言或图像。
验证码机制使
向用户呈现的验证码机制在某种程度上具有欺骗性或误导性。
向用户呈现
如果验证码的目的是出于对非人类的偏见而排除真正有感知能力的机器智能参与，则也可能被认为是不道德的。当然，技术还没有发展到这个问题的水平，而且，当它确实成为一个问题时，我预计人类排除门将更加可行和普遍。
I would like to address the question in the title—the question of morality.
I would consider a captcha immoral under the following circumstances:
It excludes participation in the application to those with physical or mental challenges, when the main portion and purpose of the application would otherwise not make such an exclusion.
The mechanism of the captcha exposes users to distressing language or images beyond what would normally be expected in the application.
The captcha mechanism as presented to the user is deceptive or misleading in some way.
A captcha may also be considered immoral if its intent is to exclude genuinely sentient machine intelligences from participation for reasons of prejudice against non-humans. Of course, technology has not yet advanced to the level at which this is an issue, and, further, when it does become an issue, I expect human-excluding gates will be more feasible and common.
许多流行（最常用）的邮件服务器没有它？！
Many popular (most used) mail server doesn't have it?!