Hacker News new | ask | show | jobs
by lordsper 3957 days ago
Or you don't do 'security' features client-side, and instead only send the hint data in response to the user's request for the hint.

Wouldn't that be the 'right' way of doing this?

3 comments

Yes, that's the proper way.

It's not even that much of a cheat, really. I'm surprised they decided to make a full blog post on how they fight such a simple trick (incorrectly, even).

It won't work that much anyway, a simple chrome extension that injects code can overturn their whole thing.

How far can they fight cheating anyway? I remember making a javascript snippet in Chrome devtools that would bruteforce all the crypto questions (because they had predictable patterns, like all sentences involved "Anna" or some similar name). That seems way harder to fight.. will it deserve another blog post?

Alice, Bob and Eve the Eavesdropper?
I must admit also, I was reading this and wondering how their fix actually "solved" the problem, and even more confused that they thought it was a novel enough solution to actually blog about it. In reality, this blog post reveals further ignorance of the actual issue.
I'm guessing the idea is to have the hints available through spotty connections...