This forum has a login system and for "Human"-Verification it asked (me atleast) to scan a QR-Code to get a key that then verifies that im a human. But first of all, if you have a bot it can easily scan the code itself with the help of some github repos

or even easier, you can just open the QR-Image in a new tab and the filename is the key. soooo.. I dont know if you guys already know/care about this but you can also just let it away because anyone who wants to bypass it, can easily do that.

The captcha is just to stop generic forum spam bots, people who run those won't bother adjusting their bot to solve this "simple" challenge to have their bots post a few messages that'll just get deleted.

Hello,
Just wondering how the QR code verification can prevent bots to register on the side when it can be bypassed in 2 steps.

1 - Get the image in html DOM and get the generated qr code image link.

2 - Enter the image name in answer input.

Done.

Edited December 29, 20213 yr by xCore