Re: Account Lockouts

Hi,

 If you are truly concerned about the visually challenged there could
be a link to a sound which they must play ... but then what if they
don't have speakers .. etc.

 The obvious solution here is to allow them to disable this seconday
confirmation via a call to the helpdesk.

 As to the not-so obvious problem ... yes, it's an issue to be
considered, but think about the problem that we are trying to solve
... IMO I wouldn't be concerned about this kind of attack.

-- Michael


On Thu, 02 Dec 2004 12:52:34 -0500, valdis.kletnieks@vt.edu
<valdis.kletnieks@vt.edu> wrote:
> On Thu, 02 Dec 2004 15:10:21 +1100, Michael Silk said:
> > Hi,
> >
> >  A pretty easy solution exists and is to use "http://www.captcha.net/";
> > images before locking the account.
>
> The obvious problem is that a visually-challenged user is screwed.
>
> The not-so-obvious problem is that although it "proves" the person is a 
> person,
> it doesn't prove that the person who entered the response is the "alledged
> person or script" you sent the image to.
>
> Some spammers have found a way to deal with these - they grab the image, and
> pass it through to some *other* user as a captcha to get into a "free porn"
> site or similar.  So the user sees it, types it in for the spammer, and then
> the spammer redirects the response to whoever originally sent it.