4 ms·

I see, I was thinking about reCAPTCHA v3, working invisible in the background.

by j3th9n 5y ago

tyingq 5y ago
Unsurprisingly, there are services for that now that provide a guaranteed minimum score.
chrismorgan 5y ago
reCAPTCHA v3 just gives you a score, and you have to decide what to do with it. This means that you should never under any circumstances use reCAPTCHA v3 as a gate with no alternative—otherwise you will certainly be preventing real users from using the system with no recourse, which will regularly have at least theoretically dire legal consequences. Also, I get the impression that reCAPTCHA v3 is waaaaay less smart than people think. At a small scale, it’s near trivial to tweak your browser so it’ll give scores at opposite ends of the spectrum.
- onara 5y ago
  reCAPTCHA is an accessibility and privacy nightmare. There are better alternatives like OOPSpam API that gives a score and works in the backend so no interaction with the user.
  - j3th9n 5y ago
    ReCAPTCHA v3 gives a score and works in the background too.
    - onara 5y ago
      That is not entirely true. If your threshold is low then it appears and you get accessibility issue. Not to mention tracking hell of out the users.
      - j3th9n 5y ago
        It doesn't appear automatically, it's programmable [1], you as a developer decide what to do with a low score, you could ask for extra verification for example. I agree with the tracking and privacy issues with ReCAPTCHA. [1] https://developers.google.com/recaptcha/docs/v3#programmatically_invoke_the_challenge https://developers.google.com/recaptcha/docs/v3#programmatic...
        onara 5y ago
        Thanks for the link. I didn't know the developer could prevent reCAPTCHA from appearing.
      - chrismorgan 5y ago
        You’re confusing multiple badly named products by Google. You’re thinking of Invisible reCAPTCHA rather than reCAPTCHA v3. reCAPTCHA v2 is the “I’m not a robot” checkbox widget followed by challenges if Google doesn’t like you. Invisible reCAPTCHA is reCAPTCHA v2 but the site initiates verification instead of the user being given an “I’m not a robot” checkbox widget to click; but if Google doesn’t like you, it’ll still trap you in the purgatory¹ of puzzle solving. Site operators can then blame Google, for all the good that does. “Invisible reCAPTCHA” is a bad name for the product, because it’s not invisible. reCAPTCHA v3 never presents a challenge for you to solve, but decides a score (in practice, I’ve only seen 0.1, 0.3, 0.7 and 0.9) where higher means Google’s feeling more friendly towards you, and it’s up to the site operator to decide what to do with that score—whether to simply deny access to people that Google doesn’t like (catastrophically bad and widely illegal, as it blocks legitimate users with no recourse) or to do something else. But now the liability for blocking real people is clearly with the site operator and not Google. But of course far too many people will ignore Google’s “don’t gate on this alone” direction and just see the higher version number and assume it must be better than reCAPTCHA v2. “reCAPTCHA v3” is a bad name for the product because it’s not a CAPTCHA, as there’s no challenge; it’s straight fraud detection. — ¹ Some hold it’s hell, rather than purgatory.
        onara 5y ago
        such a mess. As @j3th9n mentioned, reCAPTCHA v3 does have challenge and you can invoke it based on a score. https://developers.google.com/recaptcha/docs/v3#programmatically_invoke_the_challenge https://developers.google.com/recaptcha/docs/v3#programmatic...
- j3th9n 5y ago
  Not to rely on it, but I've implemented ReCAPTCHA v3 on a couple of websites and got under the impression spambots are detecting and skipping websites who have implemented it altogether.

I see, I was thinking about reCAPTCHA v3, working invisible in the background.

by j3th9n 5y ago

I see, I was thinking about reCAPTCHA v3, working invisible in the background.

tyingq 5y ago

Unsurprisingly, there are services for that now that provide a guaranteed minimum score.

chrismorgan 5y ago

reCAPTCHA v3 just gives you a score, and you have to decide what to do with it. This means that you should never under any circumstances use reCAPTCHA v3 as a gate with no alternative—otherwise you will certainly be preventing real users from using the system with no recourse, which will regularly have at least theoretically dire legal consequences. Also, I get the impression that reCAPTCHA v3 is waaaaay less smart than people think. At a small scale, it’s near trivial to tweak your browser so it’ll give scores at opposite ends of the spectrum.

onara 5y ago
reCAPTCHA is an accessibility and privacy nightmare. There are better alternatives like OOPSpam API that gives a score and works in the backend so no interaction with the user.
- j3th9n 5y ago
  ReCAPTCHA v3 gives a score and works in the background too.
  - onara 5y ago
    That is not entirely true. If your threshold is low then it appears and you get accessibility issue. Not to mention tracking hell of out the users.
    - j3th9n 5y ago
      It doesn't appear automatically, it's programmable [1], you as a developer decide what to do with a low score, you could ask for extra verification for example. I agree with the tracking and privacy issues with ReCAPTCHA. [1] https://developers.google.com/recaptcha/docs/v3#programmatically_invoke_the_challenge https://developers.google.com/recaptcha/docs/v3#programmatic...
      - onara 5y ago
        Thanks for the link. I didn't know the developer could prevent reCAPTCHA from appearing.
    - chrismorgan 5y ago
      You’re confusing multiple badly named products by Google. You’re thinking of Invisible reCAPTCHA rather than reCAPTCHA v3. reCAPTCHA v2 is the “I’m not a robot” checkbox widget followed by challenges if Google doesn’t like you. Invisible reCAPTCHA is reCAPTCHA v2 but the site initiates verification instead of the user being given an “I’m not a robot” checkbox widget to click; but if Google doesn’t like you, it’ll still trap you in the purgatory¹ of puzzle solving. Site operators can then blame Google, for all the good that does. “Invisible reCAPTCHA” is a bad name for the product, because it’s not invisible. reCAPTCHA v3 never presents a challenge for you to solve, but decides a score (in practice, I’ve only seen 0.1, 0.3, 0.7 and 0.9) where higher means Google’s feeling more friendly towards you, and it’s up to the site operator to decide what to do with that score—whether to simply deny access to people that Google doesn’t like (catastrophically bad and widely illegal, as it blocks legitimate users with no recourse) or to do something else. But now the liability for blocking real people is clearly with the site operator and not Google. But of course far too many people will ignore Google’s “don’t gate on this alone” direction and just see the higher version number and assume it must be better than reCAPTCHA v2. “reCAPTCHA v3” is a bad name for the product because it’s not a CAPTCHA, as there’s no challenge; it’s straight fraud detection. — ¹ Some hold it’s hell, rather than purgatory.
      - onara 5y ago
        such a mess. As @j3th9n mentioned, reCAPTCHA v3 does have challenge and you can invoke it based on a score. https://developers.google.com/recaptcha/docs/v3#programmatically_invoke_the_challenge https://developers.google.com/recaptcha/docs/v3#programmatic...
j3th9n 5y ago
Not to rely on it, but I've implemented ReCAPTCHA v3 on a couple of websites and got under the impression spambots are detecting and skipping websites who have implemented it altogether.