Guest book security with C# and MS SQL

Question

I'm actually not sure where this question belongs.

I'm developing a guest book for my web site and am concerned about security. I don't want a bunch of spam or nonsense written to my guest book by way of some automated nasty-ware.

Typically the security I see uses images of letters and numbers that the visitor must duplicate before access is granted.

The way I'm envisioning doing this is through an array of images that rotate on the web site and a parallel array of what the decryption is. Seems simple enough (although I haven't started coding yet, and we all know how perceived simplicity can change as a project is fleshed out).

Ok finally, here's my question.

Why are images used?

Using JavaScript I can easily render a random string of characters to the browser that won't show up in the html or be available through "View source" and authenticate it also using JavaScript (hmm I have to think a bit about that authentication..) before it is submitted.

Has anyone out there tried this approach? All of my db backed apps have been behind firewalls with my company, so this is my first foray into the outside world and I want to do my best to be prepared.

TIA
Ken

Roei Bar · Answer

dude anything that is being rendered in Client Side can be grabed and manipulated for example by using Paros as a proxy i can hold the js command and manipulate the request code

Ken Barrett · Answer

.. really? .. and here I thought the threat came from web crawlers that looked at the html. So they are some how intercepting the data as it is rendered? Interesting. Any suggestions for further reading on this? If they are able to see the rendered data are they also able to see the content of images? TIA Ken

Ken Barrett · Answer

Actually it seems as if verification is simple and I don't see how anyone can grab the security code even if the javascript is embedded in the html doc. Here is a test html page I whipped together to verify this. Please give your opinions.. I much value them. Check this : http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd> content=text/html; charset=iso-8859-1 /> content=Ken Barrett /> JavaScript test security var word =  ; function setSecure() { var s = document.getElementById('secure') ; var a = ['A''B''C''D''E''F''H''J''K''L''M''N' 'P''R''T''U''V''W''X''Y'] ; for(var i=0 ; i var num = Math.floor(Math.random()*20) ; word += a[num] ; } s.innerHTML = word ; } function evalSecure() { var resp = document.getElementById('secResp').value ; var err = document.getElementById('secOk') ; if (resp == word) err.innerHTML =  Passed security  ; else err.innerHTML =  Failed security  ; } Enter the letters above here onclick=evalSecure(); />

Ken Barrett · Answer

I have to say thanks much for the reply. Would you mind if I learn by exploring this idea with you? If I use an external javascript file so it can't be seen that looks something like this : function setSecure() { var s = document.getElementById('secure') ; var a = ['A''B''C''D''E''F''H''J'] ; // just a subset of the alphabet for testing purposes var word =  ; for(var i=0 ; i var num = Math.floor(Math.random()*9+1) ; word += a[num] ; } s.innerHTML = word ; and the html document has this element : Wouldn't that work? The problem I see is the verification process...

Roei Bar · Answer

well the idea of using images is that you set up validity time that is much less then the needed amount of time to run a program to be able to understand the word and write it down it is impossible for robot apps to do that in such a short period of time if you only run javascript any robot that will learn this action will be able to hack the encryption and submit garbage in your system.