Welcome • User Guide
ToS • Privacy • Canary
Donate • Bugs • License

©2024 Poal.co

1.1K

Hoi,

When I try to log in, most of the time the server tells me, that I entered the wrong captcha. however, when I create a new circuit in tor, and resend the exact same data, I get logged in. Ergo, I entered the correct captcha in the first place, but my login was refused nonetheless.

I think this may have something to do with how your server manages session data, which leads to one thread not knowing about session data from another thread.

Hoi, When I try to log in, most of the time the server tells me, that I entered the wrong captcha. however, when I create a new circuit in tor, and resend the exact same data, I get logged in. Ergo, I entered the correct captcha in the first place, but my login was refused nonetheless. I think this may have something to do with how your server manages session data, which leads to one thread not knowing about session data from another thread.

(post is archived)

You are currently inside a comment thread.
Click here to see all the comments (14).
[–] [Sticky] • 1 pt

I think this may have something to do with how your server manages session data, which leads to one thread not knowing about session data from another thread.

Nothing to do with that. We have an anti-spam algorithm and you probably used a TOR exit that has been flagged as spam.

Just try another exit or simply use something else (most exits are run by the 3 letter agency, not that it matters)

[–] • 0 pt

Ah, okay. I thought that it might be anti-spam, but it looked like the error I've described without an error message. Then the report can be closed, I guess.

[–] • 0 pt

I have had the same issue and used the same workaround.

Just try another exit or simply use something else

Would be nice if the site told me my exit IP is blocked instead of tricking me into filling a thousand captchas.

To begin with I don't think blocking TOR exit nodes for spam makes sense. They should be exempt.

You could stop them spamming by making their browsers do some sort of proof of work pr. login/captcha attempt.

Verifying proof of work can be done instantly, but would bog down a spammer.