I am implementing a website that included my own text Captcha (I do not use any Captcha service – like reCaptcha). the Captcha code serves each challenge (i.e. image) only once for both display and verification process. Can anybody please tell me about the possible scenarios that may be used by an attacker to relay a Captcha image to a human solver (e.g. low-cost human labor); and what’s the defense ways against them, if any?
Please note that the image is removed from the server immediately after first retrieving by the user – so there is no way to retrieve it (i.e. redirect the image link) again by anyone.
Continue reading Relay attack against Captcha→