0

Hi everybody I am developing an image captcha system as a side project something like hcaptcha/Recaptcha - image classification/object localization.

I have a few questions regarding the security of such a system.

  1. Is it acceptable to use pseudo-random number generators for choosing labels (e.g. crosswalk, car in Recaptcha) or shuffling images?

  2. Is it acceptable to send encrypted answers to the browser to remain stateless? I've been suggested with fernet encryption as a good baseline in another StackOverflow post. I could use a sticky session and generate an encryption key at the start of the process and the key might not be stored in another location than ram.

Damian Grzanka
  • 101
  • 1
  • For 2, it really depends on how you implement the encryption. If you don't change the key for every request, an attacker could solve one captcha and replay it infinitely many times. – nobody Feb 11 '22 at 18:20

0 Answers0