jQuery Qaptcha ：您认为这个验证码系统很容易被破解吗？
http://www.myjqueryplugins.com/QapTcha/demo
This plugin looks so user friendly
I'm afraid that once it gets popular it gets easily hackable.
Do you agree ?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
验证码是滑块部分吗？如果是的话，绕过就很简单了。
当您将滑块一直滑动到右侧时，它只会从隐藏表单字段“iQpatcha”中删除一些任意值。当您单击“提交”时，此内容（与表单的其余部分）将捆绑在一起并发布到服务器。
任何会提琴手的人都能够捕获有效的响应（带有空的 iQpatcha 字段）并使用不同的表单值重放它。
验证码的唯一安全形式是完全在服务器上处理的形式，生成图像（在服务器上）并在服务器端检查 POST 值以查看其是否匹配。我个人推荐 reCaptcha，许多知名网站都在使用它。
Is the captcha the slider part? If so yes, it would be trivial to bypass.
When you slide the slider all the way to the right it simply removes some arbitary values from a hidden form field "iQpatcha". When you click submit this (with the rest of the form) gets bundled up an POSTed to the server.
Anyone will fiddler will be able to capture a valid response (with empty iQpatcha field) and replay it with different form values.
The only secure forms of captcha are those that are dealt with completely on the server, an image is generated (on the server) and the POSTed value checked server side to see if it matches. I can personally recommend reCaptcha and lots of high profile sites use it.
我发现 Qaptcha 非常棘手。首先，为隐藏文本字段指定一个随机名称，并填充随机值。然后创建一个具有该字段名称的会话。验证期间，必须设置正确的 POST 名称，但不能填写。机器人必须知道不要完整填写表格，并且不能跳过表格直接到达目标。
我发现 reCaptcha 必须变得对普通读者来说越来越难以理解才能阻止机器人。在收到许多电子邮件抱怨访问者因 reCaptcha 而无法填写表单后，我尝试实施 Qaptcha。到目前为止，Qaptcha 在阻止可接受数量的垃圾邮件方面至少同样可靠，而且不会让人们感到困惑。
在这里阅读更多内容：http://www.myjqueryplugins.com/QapTcha
I find Qaptcha nicely tricky. First, a hidden text field is given a random name, and filled with a random value. Then a session with the name of that field is created. During validation, the correct POST name must be set, but not filled. Bots would have to know not to fill out the form completely, and could not skip the form and go straight to the target.
I have found that reCaptcha has had to become increasingly incomprehensible to the average reader to thwart the bots. Having received many emails complaining that visitors could not complete their form because of reCaptcha, I tried implementing Qaptcha. So far, Qaptcha has been at least as reliable in stopping an acceptable amount of spam without confusing people.
Read more here: http://www.myjqueryplugins.com/QapTcha