Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
SubZer0
Contributor

Google reCAPTCHA on Mobile Access

Did anybody add Google Captcha to Mobile Access page? I fond this CheckPoint document: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_MobileAccess_AdminGuide/Cont...

If you used did you have any problems?

0 Kudos
6 Replies
PhoneBoy
Admin
Admin

Moved this to the Remote Access space (which is also for Mobile Access Blade)

0 Kudos
Matthias42
Participant

There are huge problems with the google captcha. 

Ok, the technical details of this captcha are googles trade secret, so i can only describe an informed guess about what i observe.

The captcha claims some sort of "behaviour based" response. That seems to be just a misleading name for using all sorts of advertising trackers as input to the captcha process.

If a user cares for his privacy and uses Ad blockers, cookie managers, Javascript-filters, etc. Google will fight this and punish him. The captcha will never end, Google will deny access to your service.

On the other hand, if a careless user has a huge footprint on googles tracker databases, the captcha will not even show up and just pass the user.

So in the end, by using the captcha, you are rewarding carelessness, and punishing responsible behaviour.

This is not a "I am not a robot" thing, this is a "track me now" thing.

 

SubZer0
Contributor

Is there any other option to secure or. block after 5 attempts? 2FW is already in use but customer get brute force everyday.. so I want to stop this. ATM I block everyday new IP address.

0 Kudos
Matthias42
Participant

I implement this in the radius server. Depending on environment, i block a user after x attempts, and unblock after y hours later. Or "tarpit" function, that is make every successive failed attempts excessively slower.

You can also use the SRC Ip adress of the request as a criteria, i think for that to work you have to enable the sending of extra radius attributes. Search knowledgebase for "Framed IP Address". 

 

0 Kudos
PhoneBoy
Admin
Admin

You can configure a SmartEvent Automatic Reaction for this:

image.png

SubZer0
Contributor

Thanks for this. What are best practice config? I am thinking to set up after 5 connections in 10 seconds to block.

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events