8000 Field verification with SpamFilter · Issue #37 · altcha-org/altcha · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Field verification with SpamFilter #37

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
chrgthb opened this issue Jun 13, 2024 · 5 comments
Closed

Field verification with SpamFilter #37

chrgthb opened this issue Jun 13, 2024 · 5 comments

Comments

@chrgthb
Copy link
chrgthb commented Jun 13, 2024

The payload.verificationData "fields" doesn't contain the email field. So I can't verify if the e-mail has changed after the verification.

And please check if the API documentation is correct. At API\PoW Challenges #Validating Server Signature the API reference link refers to Verify Solution. So we don't have any info to do the Validating Server Signature with free API key.

Best regards,
christ
@chrgthb
Copy link
Author
chrgthb commented Jun 13, 2024

(Just another thought.. it will be good if the design could somehow prevent check the widget with automatized keyboard / mouse macro. I don't know the right solution, but now with TAB-TAB-TAB-SPACE or mouse macro robots can easily check the "I'm not a robot" checkbox within a second.)

@ovx
Copy link
Contributor
ovx commented Jun 13, 2024

Hi, the email is being processed separately from the fields, so would need to add an extra check for the email (simply to check the equality with submitted data, because the whole payload is signed). But it doesn't hurt if the email field is added to the fields as well, this would make it appear in the fields for easier verification. I'll update the widget to do that automatically.

To the other suggestion: the widget is and the PoW mechanism are designed to be accessible, this includes automated environments, and automated test frameworks. Such prevention would go against the core functionality and goals.

@chrgthb
Copy link
Author
chrgthb commented Jun 13, 2024

Yes, I saw the email field in the payload.verificationData, which contains the important part of the value (@example.com). I just thought it could be easier to check if the fields are untouched after verification, if all the fields and the hashed data is there. But I understand if that's not an important data.

Thanks!

@chrgthb chrgthb closed this as completed Jun 13, 2024
@ovx
Copy link
Contributor
ovx commented Jun 14, 2024

The email field is not added to the fields for simpler verification (version 0.5.0).

@ovx
Copy link
Contributor
ovx commented Jun 17, 2024 •
edited
Loading

The previous change from version 0.5.0 has been reverted in 0.5.1 due to unexpected behavior with the email field (the email is sent anonymized by default, thus it should not appear in the fields payload by default). To include the email field into fields, configure the list of input names using the spamfilter.fields: string[] option - docs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@ovx @chrgthb
0