security issue with MSCAPTCHA - captcha

Question

I'm using MSCAPTCHA in one of my projects .
Now I Know that Captchas that their characters are dependent to their image url could be passed by hackers easily .
I mean if we copy the captcha image url and open it in new browser window and refresh it the same characters would be generated .
and hackers have ways to use this bug . How ? they write a small program that request our page except the captcha then they use that first captcha image url . and they pass the captcha . ( I've read this somewhere and I don't know details too )
Now any idea how to solve this ? or is there any captcha without this problem ?

Answer 1

I don't know MSCAPTCHA in particular, but you seem to have a misunderstanding of how captchas are solved. Yes, each captcha image has a unique URL. That's fine and irrelevant. The form that the captcha belongs to has some sort of information that requires the user to solve a specific captcha. A user cannot simply answer any random captcha he wants.
While preparing the form that is presented to the user, the server generates a captcha and saves the expected answer internally, in the user's session for instance. It then sends the link to the specific captcha image to the user with the form. If the returned answer is not what is expected, the solution is rejected. It doesn't matter if the user tries to look at some other captcha than the one sent by the server.

Answer 2

Perhaps something to sidestep the problem while still addressing underlying requirement of human vs robot verification that captcha fills?
I implemented something of my own which a human reader should be able to read. I'd ask them
"I have AA stones and I gather BB more. I now have [textbox_here] stones overall".
The pseudo code is like:
Random rand = new Random();
int intNums[] = {0,1,2,3,4,5,6,7,8,9};
string strNums[] = {"zero", "one", "two", "three", "four", "five", "six", "seven", "eight", "nine"};
int aIndex = rand.Next(0,4); // 0, inclusive, 5 exclusive
int bIndex = rand.Next(0,4);
// 1. use AA and BB below to print your HTML form
string AA = strNum[aIndex];
string BB = strNum[bIndex];
// 2. save/pass out "rightAnswer" to later verify
// the users answer from the textbox
int rightAnswer = aIndex + bIndex;
I prefer this since it's lightweight, no external dependencies and so far it's worked (no spam). You can also try an array of question and answers like
string questionArray[] = { "My mother has only one son. Am I male or female?", ... };
string answerArray[] = { "male", ... };
You get the idea ...
Hope it helps!