Based on the paper "Text-based CAPTCHA Strengths and Weaknesses" http://ly.tl/p22 yii's internal captcha generator is weak.
Measuring attack effectiveness.
Coverage is the fraction of captchas that the solver attempts to answer. Precision is the fraction of captchas answered correctly. A captcha scheme is broken when the attacker is able to reach a precision of at least 1% (1 in 100 attempts).
Design principles
The following principles apply to the design of the captcha core features:
Randomize the captcha length: Don’t use a fixed length, it gives too much information to the attacker.
Randomize the character size: Make sure the attacker can’t make educated guesses by using several font sizes / several fonts.
Using several fonts reduces the classifier accuracy and the scheme’s learnability.
Wave the captcha: Waving the captcha increases the difficulty of finding cut points in case of collapsing and helps mitigate the risk of the attacker finding the added line based on its slope when using lines.
Anti-recognition
Use anti-recognition techniques as a means of strengthening captcha security.
This issue has originally been reported by @xwz at https://github.com/yiisoft/yii2/issues/1100. Moved here by @samdark.
CAPTCHA Strengths and Weaknesses
Based on the paper "Text-based CAPTCHA Strengths and Weaknesses" http://ly.tl/p22 yii's internal captcha generator is weak.
Measuring attack effectiveness.
Coverage is the fraction of captchas that the solver attempts to answer. Precision is the fraction of captchas answered correctly. A captcha scheme is broken when the attacker is able to reach a precision of at least 1% (1 in 100 attempts).
Design principles
The following principles apply to the design of the captcha core features:
Anti-recognition
Anti-Segmentation