Security Question Bypass

[emlin]

This forum has a login system and for "Human"-Verification it asked (me atleast) to scan a QR-Code to get a key that then verifies that im a human. But first of all, if you have a bot it can easily scan the code itself with the help of some github repos

or even easier, you can just open the QR-Image in a new tab and the filename is the key. soooo.. I dont know if you guys already know/care about this but you can also just let it away because anyone who wants to bypass it, can easily do that.

[whozer]

The captcha is just to stop generic forum spam bots, people who run those won't bother adjusting their bot to solve this "simple" challenge to have their bots post a few messages that'll just get deleted.

[xCore]

Hello,
Just wondering how the QR code verification can prevent bots to register on the side when it can be bypassed in 2 steps.

1 - Get the image in html DOM and get the generated qr code image link.

2 - Enter the image name in answer input.

Done.

Edited December 29, 2021 by xCore