Quote from: DarkKnight on April 04, 2014, 04:57:59 PM

Quote from: miaviator on April 04, 2014, 04:33:33 PM

Quote from: WireIT on April 04, 2014, 04:27:21 PM

Quote from: DarkKnight on April 04, 2014, 04:20:16 PM

However, I just tried to log in. Tell me if that looks wrong, because these were rejected as the wrong captcha.

You got it right. The problem is that the captcha is so good that the provisioning service can't recognize it's own code - proving it itself is a bot. Grin

Bah hahahhahahhha Angry

In all seriousness though, I've never had my captchas rejected that often. Nobody else is having problems?

You know, captchas are usually only used as a gateway to prevent bots from automated sign up, not to prevent *signing in*. The passwords are too ridiculously long to ever be cracked while relevant, so brute forcing isn't an issue. Why not just do away with it on the provider login?

Quote from: suchmoon on April 04, 2014, 05:22:14 PM

Quote from: DarkKnight on April 04, 2014, 04:57:59 PM

You know, captchas are usually only used as a gateway to prevent bots from automated sign up, not to prevent *signing in*. The passwords are too ridiculously long to ever be cracked while relevant, so brute forcing isn't an issue. Why not just do away with it on the provider login?

I agree. If bruteforcing is a concern add some throttling - a small delay, limit of 5 login attempts per minute, something like that.

I agree with both of you.

Also yes I've had the same issue with the captchas.

I believe once 2FA is required and the provider overhaul is complete we can remove the captcha or reduce it. I'll have to check with the devs to be certain though.

I'd guess captcha would only be required on registration at that point.