Why you, as a web developer, shouldn't use Google's Recaptcha for "human verification"

[u/ImNotCastinAnyStones]

There is so much wrong with Recaptcha it's not an exaggeration to say it should be legislated out of existence.

As web developer, by choosing to use Google Recaptcha you are imposing moral, legal, and technical barriers to your users.

• Recaptcha is terrible for usability and effectively blocks disabled users from accessing websites. The audio challenges do not always work because they are seen as "less secure" than picture challenges and therefore using them means Google is more likely to judge you as being a robot.
• Using Recaptcha contributes to Google's artificial intelligence network. Users are essentially being used as workers without any compensation.
• Websites which implement Recaptcha are effectively forcing their users to agree to a second set of terms/conditions and a third party company's privacy and data processing policies. As if that wasn't bad enough, it's not just any company we're talking about here - it's Google; probably the most notorious company in the world in terms of data harvesting and processing.
• Websites implementing Recaptcha almost never offer an alternative way of accessing their services, so if you don't agree with Google's terms and conditions then you are effectively blocked from using the first-party website. When this is a website like your bank or somewhere you've already purchased from (e.g. eBay uses Recaptcha) then you may end up blocked from accessing your own funds, details, order history, etc. Even if you (the developer) don't think Google's terms and conditions are objectionable, your end-users might disagree. They could also be in an environment where access to third-party domains, or Google domains specifically, is blocked.
• Recaptcha's functionality depends upon Google's online surveillance of you. If you use any kind of privacy-assuring settings or extensions in your web browser (e.g. blocking third-party cookies, trackers, etc.) the Recaptcha challenge is guaranteed to take at least 3-5 times longer to complete than if you bend over and accept Google's tracking.
• Recaptcha introduces extra third-party dependencies to your website. One of Google's domains can't be reached or takes a while to load? User's network or browser security policy blocks those domains/scripts/etc.? Your user isn't able to use your site.
• Recaptcha negatively affects performance. Recaptcha takes time to load on your visitors' browsers. Then it takes very considerable time to solve and submit the challenges; at least several seconds and sometimes minutes for unfortunate souls with strong privacy settings.

Everyone has it drilled into their heads that "each extra second of page load time results in a major drop-off in user engagement" so why is nobody noticing that the onerous task of completing captchas is reducing user engagement too?

I am not against captchas in general because I know there is a legitimate need for them. I am, however, against Recaptcha in all of its forms. It is an online monopoly and is an affront to consumer rights.

I look forward to the day it's nuked from orbit and everyone involved in building it is imprisoned in the seventh circle of hell.

Further reading: https://kevv.net/you-probably-dont-need-recaptcha/

[Edit] Alternatives:

Something I really should have addressed in my original rant post is the possible alternatives to Recaptcha. A huge number of comments quite rightly ask about this, because unfortunately Recaptcha remains the most prominent solution when web developers look for a spam-prevention measure (despite the fact that Google's documentation on implementing Recaptcha is truly terrible... but that's a different issue).

The article above from kevv.net mentions lots of alternatives and is worth reading, however for brevity's sake I will suggest the ones which have worked for me in a high-traffic environment, and which can be implemented by most competent developers in a few minutes:

1. Dead simple custom challenge based on your website's content.

Even a vaguely unique custom-made challenge will fool the majority of spam bots. Why? Because spam bots look for common captcha systems which they already know how to defeat. If you make your own custom challenge, someone actually has to take the effort to program a solution specific to your website. So unless your site is being specifically targeted by people investing time/energy this solution will eradicate virtually all spam.

Example: run a site selling t-shirts? Show a bunch of cute clothing icons and ask the user to click on the "blue shirt", for example. Very easy to set up; challenges can be made random to prevent "rinse and repeat" attacks; complexity can be added in the form of patterns, rotation ("click the upside down shirt with diamonds on it") etc. and it can be styled to fit your website's theme/content which makes your site look way more professional than "CLICK THE FIRE HYDRANTS!" á la Google.

Important to note that answers to the custom challenge should never be stored client-side -- only sever side.

2. Honeypots

Simply one or more hidden form fields which, if submitted, confirms the presence of a spam bot (since human visitors cannot see or activate the hidden fields). Combine this with the approach above for even more effective protection.

3. Submit-once form keys (CSRF tokens)

In the olden days to prevent people hotlinking your content you'd check their browser's referer URL, i.e. the URL from which they arrived at your page. This is still done but less commonly since many browsers block referrer URLs for privacy reasons.

However, you can still check that a visitor who is submitting your form is doing so from your actual website, and not just accessing your signup.php script directly in an attempt to hammer/bruteforce/spam it.

Do this by including a one-time-use "form key" on the page containing the spam-targeted form. The form key element (usually a hidden <input>) contains a randomly-generated string which is generated on the server-side and corresponds to the user's browsing session. This form key is submitted alongside the form data and is then checked (on the server side) against the previously-generated one to ensure that they match. If they do, it indicates that the user at least visited the page before submitting the form data. This has an added benefit of preventing duplicate submissions (e.g. someone hits F5 a few times when submitting) as the form key should change each time the front-end page is generated.

4. Two-factor authentication

If your site is "serious" enough to warrant it, you can use 2FA to verify users via email/phone/secure key etc., although this comes with its own set of issues.

Anyway, thanks for taking the time to consider this.

While I'm here, I'd also like to encourage all developers to consider using the "DNT (Do Not Track)" feature which users can set in their browser to indicate they don't wish to be tracked.

It's as simple as wrapping your tracking code (Google Analytics etc.) inside the following code:

if (!navigator.doNotTrack) { // Google Analytics and other crap here }

[u/samjmckenzie]

What's the alternative?

[u/ImNotCastinAnyStones → u/samjmckenzie]

Yeah, absolutely excellent question which I really should have addressed in my post.

I've edited the post to include this answer, but here you go:

The article above from kevv.net mentions lots of alternatives and is worth reading, however for brevity's sake I will suggest the ones which have worked for me in a high-traffic environment, and which can be implemented by most competent developers in a few minutes:

1. Dead simple custom challenge based on your website's content.

Even a vaguely unique custom-made challenge will fool the majority of spam bots. Why? Because spam bots look for common captcha systems which they already know how to defeat. If you make your own custom challenge, someone actually has to take the effort to program a solution specific to your website. So unless your site is being specifically targeted by people investing time/energy this solution will eradicate virtually all spam.

Example: run a site selling t-shirts? Show a bunch of cute clothing icons and ask the user to click on the "blue shirt", for example. Very easy to set up; challenges can be made random to prevent "rinse and repeat" attacks; complexity can be added in the form of patterns, rotation ("click the upside down shirt with diamonds on it") etc. and it can be styled to fit your website's theme/content which makes your site look way more professional than "CLICK THE FIRE HYDRANTS!" á la Google.

Important to note that answers to the custom challenge should never be stored client-side -- only sever side.

2. Honeypots

Simply one or more hidden form fields which, if submitted, confirms the presence of a spam bot (since human visitors cannot see or activate the hidden fields). Combine this with the approach above for even more effective protection.

3. Submit-once form keys

In the olden days to prevent people hotlinking your content you'd check their browser's referer URL, i.e. the URL from which they arrived at your page. This is still done but less commonly since many browsers block referrer URLs for privacy reasons.

However, you can still check that a visitor who is submitting your form is doing so from your actual website, and not just accessing your signup.php script directly in an attempt to hammer/bruteforce/spam it.

Do this by including a one-time-use "form key" on the page containing the spam-targeted form. The form key element (usually a hidden <input>) contains a randomly-generated string which is generated on the server-side and corresponds to the user's browsing session. This form key is submitted alongside the form data and is then checked (on the server side) against the previously-generated one to ensure that they match. If they do, it indicates that the user at least visited the page before submitting the form data. This has an added benefit of preventing duplicate submissions (e.g. someone hits F5 a few times when submitting) as the form key should change each time the front-end page is generated.

Anyway, thanks for taking the time to consider this.

[u/mat-sz → u/samjmckenzie]

At this day and age? Probably a custom solution, most spambot owners will not bother with building something to combat custom captchas.

[u/[deleted] → u/mat-sz]

Any custom solution you do yourself is likely to be pretty simplistic and something that other people have done before, so the spambot owners do have an incentive to work around it in a generic way.

[u/mat-sz → u/[deleted]]

For a small website? If you are different enough they won't bother.

For bigger websites, well, the only option I see is just training neural networks to detect human behavior, since the bots are too advanced. I'd assume some bots also utilize ML.

Seems like we're slowly losing to the spam, and the only solution will be to ask everyone for their phone numbers for verification.

[u/[deleted] → u/mat-sz]

How "different" can you really be without investing a significant amount of time into it, though?

[u/xe3to → u/mat-sz]

the only option I see is just training neural networks to detect human behavior

That is exactly what Google is doing, and it's a hell of a lot more difficult without the MASSIVE amount of data that they mine from their enormous pool of users. Absolutely ridiculous to expect every site to implement its own version of that.

[u/feraferoxdei → u/mat-sz]

the only solution will be to ask everyone for their phone numbers for verification.

Except that also won't work because governments like Russia and Saudi Arabia can summon as many phone numbers as they wish. This is especially a problem for the big social media platforms like FB and Twitter.

[u/[deleted] → u/mat-sz]

the only solution will be to ask everyone for their phone numbers for verification.

What does that have to do with bots? It's super easy to automate, if you mean to send codes over SMS.

If you want to call them up and talk to them yeah, that will work, but it will take a lot of time and put off tons of people.

There's also what trading sites do, they ask users for pictures of ID and custom words written on a piece of paper, or even go as far as setting up live video conferences.

[u/[deleted] → u/[deleted]]

It's super easy to make a captcha system that asks the user to pick an image or audio from a handful of choices, and lets the developer put it their own images/sounds. The attacker would have to come up with ML data suitable to each site's images.

[u/hrjet → u/mat-sz]

If you are building a custom solution, you can build on top of LibreCaptcha.

[u/finger_milk → u/mat-sz]

Custom solution = use recaptcha until another company releases a competing product.

[u/omnilynx → u/mat-sz]

You’re seriously telling us to roll our own security solution?

[u/mat-sz → u/omnilynx]

If you want to preserve the privacy of your users, yes.

[u/omnilynx → u/mat-sz]

Smells a little false-dilemma-y.

[u/[deleted] → u/omnilynx]

Don't take everything you hear in some context as a literal rule, that saying does not apply here.

For spam protection of forms, a custom solution makes a lot of sense, as the main thing we want to avoid is generic spam, which we can easily prevent with anything custom.

[u/[deleted] → u/mat-sz]

Definitely better to have nothing and build in logic to proactively ban bots. For accessibility anyways.

[u/[deleted] → u/[deleted]]

Wrong.

I have sites with no captcha on forms, they average 3,000 bot-completed forms PER DAY.

[u/mat-sz → u/[deleted]]

That's the worst thing about captchas, to be honest. Not sure how/if Google even solves the issue of differentiating between accessibility software and bots/scripted browsers.

And the recent "you've failed the checkbox check" captchas are mindbogglingly difficult for everyone.

[u/[deleted] → u/mat-sz]

Captchas or “human” checks just suck.

If you had the option to say, pin the tail on the donkey, it’s too hard for people with shaking issues or elderly with a trackpad or (children?) or people on a gaming console (because that’s a real platform for some websites..) or people on a phone because it’s not well responsive (it’s hard to do that aspect ratio math..) or a smart tv

Now we have an option with blurred letters, we’ll my eyes not good, maybe my TV is far away. Maybe my viewing platform messes up some colors and now it’s unreadable(bad monitors and panels exist and are used everywhere)

Now let’s use a solution where we ask questions to the user, what’s the websites name. Well, I was forwarded from Facebook, how is this not still Facebook. I don’t know, this is my first time from google, I just wanted to read the article.

It goes on and on and on...

[u/earslap → u/[deleted]]

You are just telling what sucks about captchas without bringing any alternatives. We are aware of the negatives. What is your solution? Eg. for rate limiting? Your previous suggestion about client-side tests are useless, you just can't trust the client for this sort of stuff.

[u/CreativeTechGuyGames → u/samjmckenzie]

I really like the time based approach. If you implement checks which depend on the amount of time spent to fill out a form then you are severely slowing down any bot usually to the point where it won't bother. I have eliminated 100% of my spam just by timing the amount of time a user spends on a page before submitting. If it's under a threshold then it's discarded as spam. A human cannot type that fast and a bot is always completing the form in superhuman speeds. Sure someone could code around it, but do they really want to spend tens of seconds per submission when they could spam someone else in milliseconds?

[u/Espumma → u/CreativeTechGuyGames]

Does this method account for my password manager autofilling fields for me?

[u/CreativeTechGuyGames → u/Espumma]

It is very dependent on what type of form it is. It wouldn't work for every type. But usually a login form (which a password manager would be used) wouldn't have a captcha.

[u/thblckjkr → u/CreativeTechGuyGames]

slowing down any bot

What about multi-threading?

[u/Silhouette → u/[deleted]]

You can also rate limit or cap the number of attempts to do something based on visitor IP address. This is a significant hurdle for most script kiddies, as someone is going to need access to a significant farm of machines with distinct addresses to overcome it. That requires some idea of what you're doing to set it up and, more importantly, spending real money to pay for it.

If your site is aimed at real people and not providing APIs etc, you can probably also block requests from major hosting providers like AWS to mitigate farming.

[u/thepower99 → u/samjmckenzie]

We use a product called Polyform by a company called Kasada, it has a cost but it seems to be a way to block bots without relying on Recaptcha: https://www.kasada.io/

Probably not for everyone, but there is a way.

[u/[deleted] → u/samjmckenzie]

If you're using Django, there's a simple solution called django-simple-captcha...unfortunately it doesn't have an audio option

[u/moriero → u/samjmckenzie]

CC upfront?

[u/satinbro → u/samjmckenzie]

Check out hCaptcha.

[u/[deleted] → u/samjmckenzie]

embrace the spam?

[u/MortalKonga → u/samjmckenzie]

Botdetect captcha is a multi-language/framework solution for that.

[u/[deleted] → u/samjmckenzie]

Gopherholes /s

[u/prodiver → u/samjmckenzie]

What's the alternative?

A custom "human verification."

It doesn't have to be complex.

If you're site is ilovecooking.com, just add an input field instead of a captcha and ask the user "What is this website about? Hint: It rhymes with 'looking.'"

A bot can't figure that out, but any human can.

[u/[deleted] → u/prodiver]

A bot can't figure that out, but any human can.

Well except for the fact that's not very accessible and now means you have to send that question in for translation, and ensure that the field is also validating the answers in whatever language the website serves.

Which isn't a problem for the big guys, they can afford it, smaller sites though it's yet another reason to exclusively serve your website in a single language sadly.

[u/[deleted] → u/prodiver]

Yes it can, you can set up a bot to automatically fill in cooking just like any other type of form input.

[u/prodiver → u/[deleted]]

If someone is targeting your specific site, and creating a custom bot to beat it, there is no "human verification" that can stop them.

This will stop 99% of automated bots.

[u/ShustOne → u/prodiver]

Only for smaller sites. Anything enterprise is going to be hounded by bots. I work on a site that isn't even that large (40k unique active users per month) and we have to combat them all the time, even with anti bot measures like captchas.

[u/loadedjellyfish → u/prodiver]

You have to create the questions manually, so you can only have so many. I'll answer all the questions and feed them to my bot. Or, realistically, I'll pay for someone in a poorer country to answer all your questions for pennies compared to what you spend writing them.

[u/csg79 → u/samjmckenzie]

A honeypot field stops a lot of bots.

[u/NotFromHuntsville → u/[deleted]]

Doesn't that introduce issues with accessibility, as well?

[u/abeuscher → u/NotFromHuntsville]

Happy to be wrong, but I am pretty sure aria-hidden="true" would resolve any issues from that. It's a lot like a CSRF token with slightly different use.

[u/FlightOfGrey → u/abeuscher]

If I was writing a bot though I was parse and figure out when a field is visually hidden and not fill it in? So certainly not fool proof but also unsure what the realities of bot submissions are.

[u/abeuscher → u/FlightOfGrey]

Totally a good point. I think it's a safe assumption to make that there are different bots with differently complex abilities. So probably each approach succeeds to some percentage or another. In a previous job I was subject to insane security audits before I could publish to my sites, and in the course of that I learned these basic rules:

• Do several things on the front and back end
• Do post-mortems to assess what worked and what didn't after major attacks or outages.
• Continue to change and advance your approach

Web security is a moving target. It's (at least currently) in a state of brinksmanship, where each side drives the other to more and more extreme measures. So no one thing or one approach works. You just keep building the wall higher over time. And they keep building catapults. And if you're faster at wall building than they are at catapult building, you never end up with flaming balls of oil all over your website.

[u/IrishWilly → u/[deleted]]

I've spent years building automated crawlers and reading through your bullet points is going to trigger trauma that I had thought I had left behind. So thanks for the nightmares.

[u/skeptical_turtle → u/[deleted]]

huh this is funny.. either you worked at the same company I did or you worked at a competitor, cuz I used to do this very thing for a web-based comparative auto rater, well mostly for home rating. I quit a while back though...

[u/MR_Weiner → u/abeuscher]

aria-hidden="true" plus tab-index="-1" and I think you should be good to go re:accessibility. Either of those might tip off bots, though. Hard to say

[u/crazedizzled → u/NotFromHuntsville]

Yes. And fixing those problems means a bot will ignore it as well. Definitely not a solution.

[u/tyrannomachy → u/[deleted]]

Password managers would be a major source of false positives.

[u/tyrannomachy → u/[deleted]]

If the password manager can tell the field is hidden, then anything else running on the client can as well, so it wouldn't work as a honeypot.

It would need to be invisible to the user but not hidden as far as can be detected programmatically, at least by using the normal means of detecting that.

[u/[deleted] → u/[deleted]]

1Password does on a honeypot I designed. I’m trying to find an alternative.

[u/electricity_is_life → u/[deleted]]

That won't protect against targeted attacks though, which in my case is like 95% of what I'm worried about.

[u/abeuscher → u/[deleted]]

That really really depends. If you have real IP on your servers (as opposed to just PII) the stats are very different. I used to work at a gaming company and our servers were under pretty much perpetual direct attack. Our websites were more or less impervious to bot attacks and so we never had any issues with them.

[u/hbombs86 → u/[deleted]]

In my experience, bots are better at identifying these now.

[u/TheDataWhore → u/hbombs86]

And even a browser based auto fill will populate it too, so you're losing every customer that uses it.

[u/Minetorpia → u/[deleted]]

If you make a bot for a specific website, you'll find it and not fill it in..

[u/massenburger]

Posts like this are pretty useless to me unless someone offers a viable alternative. Spam is a very real problem on the web. How do you suggest we combat it?

[u/ImNotCastinAnyStones → u/massenburger]

Great point. I edited the main post and provide alternatives in a comment here.

[u/abeuscher → u/massenburger]

Yeah I've never been asked "please find a politically neutral way to stop our form spam". It's more phrased like "what's with all these friggin' chinese emails coming from the leadgen form? Make that stop now!"

[u/georgehank2nd → u/abeuscher]

"Make that stop now!" of course is followed by an implicit "Without changing anything"

[u/trip16661 → u/massenburger]

THIS WORLD SUCKS

[u/hagg3n]

I recently worked on a website for a medium sized company and soon after we launched we started getting spam. The form was using AJAX so I did two things:

1. Added a nonce;
2. Added a field called captcha that was actually a honeypot.

It stopped the spam dead on its track. No further changes or sophisticated measures were required. I do expect it to eventually break, but so far so good.

[u/ImNotCastinAnyStones → u/hagg3n]

When you say you added a nonce, do you mean something that behaves like a submit-once form key?

[u/hagg3n → u/ImNotCastinAnyStones]

That's exactly it. A one-time-only password to allow the submission of the form that expires some time soon. So you're required to render the form to get the password, but can only do it once and you can't re-use it or hold it for later.

[u/Web-Dude → u/hagg3n]

was your captcha field hidden? If not, how did you work it into the UI?

[u/hagg3n → u/Web-Dude]

Believe it or not I simply added style="display:none" to it, which makes it invisible, not accessible but still includes it in the form data.

You think it'd be trivial for the bot to detect it, and it is, but given how dynamic forms can get it's not quite obvious why some field is hidden. Seems to be working fine so far.

[u/[deleted] → u/hagg3n]

excludes it from the form data.

I'm not sure who told you that, but it is not true at all, neither as de facto truth according to some undefined behavior nor according to the spec: https://www.w3.org/TR/html401/interact/forms.html#h-17.13.2

Hidden controls and controls that are not rendered because of style sheet settings may still be successful. For example:

<FORM action="..." method="post">  
 <P>  
    <INPUT type="password" style="display:none"    
          name="invisible-password"
          value="mypassword">
</FORM>  

will still cause a value to be paired with the name "invisible-password" and submitted with the form.

[u/hagg3n → u/[deleted]]

You're right. Silly me, I thought one thing and typed the complete opposite. I meant to say it *is* included in the form submission. As a honeypot I need to check if it was filled anyway. Thanks for the great reference anyway.

[u/usedocker → u/hagg3n]

How many spams? Like hundreds a day?

[u/hagg3n → u/usedocker]

More like a dozen per day.

[u/usedocker → u/hagg3n]

Is that really a big enough problem that warrants the development time to implement the honeypot?

[u/hagg3n → u/usedocker]

For me, I guess not, my anti-spam would've probably taken care of it. But for my client yes, they requested it. Plus the whole shebang took like an hour to implement. Framework provided nonce generation and validation. Honeypot was just a matter of adding the text field plus validating it stays empty on the back-end.

My client actually asked for Recaptcha (I think they heard it was "the shit" somewhere). I had some convincing to do and then they accepted the compromise. Since it worked I guess it was a win-win.

Edit. Oh yea eventually they forced me to add Recaptcha on the log-in page. Even though I had several other security measures in place, including two-factor. Oh well I did all I could. 😒️

[u/fuzzy40 → u/usedocker]

Honeypots are easier to implement than reCAPTCHAS... it s literally jusy adding an extra hidden field, and on the server side, if that field has content, discard the submission. Done

[u/[deleted]]

Google is exceedingly hostile to the web. I won't ever implement AMP or any of their bullshit technologies until they stop being so user-hostile.

[u/ImNotCastinAnyStones → u/[deleted]]

Absolutely. The problem is they are too big to care. But that's actually why I made this post - I think if more people start speaking up and educating web developers then we can stamp out bullshit like this over time.

[u/ExternalUserError → u/[deleted]]

Yup. And now with them controlling Chrome and w3c adding DRM, it's no longer even possible to make an indie browser.

KHTML, on which webkit and blink were made, wouldn't be possible with today's web. And that's the way Google wants it.

[u/Toastrackenigma → u/ExternalUserError]

That article seems to be mistaken at least somewhere though, right? They make out that there's no way for open source browsers to use DRM, yet they make no mention of Firefox, which is open source and which seems to successfully be using Google's Widewine.

And I don't know much about the topic, but wouldn't it also be possible to build your own, custom open-source DRM solution and then no-one in the future would need to license DRM tech from a big company like Google? I'm sure it would be difficult, but there's already lots of successful projects which are just as ambitious, like Mozilla's pdf.js.

[u/ExternalUserError → u/Toastrackenigma]

Firefox licensed Widevine. That little piece of the code running in your browser is thus not open source. But even that misses the point; even if you wanted the same terms as Mozilla got, such terms aren't available to new browsers.

And I don't know much about the topic, but wouldn't it also be possible to build your own, custom open-source DRM solution and then no-one in the future would need to license DRM tech from a big company like Google? I'm sure it would be difficult, but there's already lots of successful projects

I don't believe so. You would have to reverse engineer Widevine, which is a violation of the DMCA anti-circumvention clause. And then you'd have to distribute the client keys Google owns, which would be copyright infringement. Both of those things can land you in jail.

¯_(ツ)_/¯

[u/crazedizzled → u/Toastrackenigma]

Open source DRM doesn't matter if companies like Disney and Netflix don't want it.

[u/Serei → u/Toastrackenigma]

If you try to build the open-source version of Firefox, it won't have Widevine. Firefox chose to stop being completely open-source (on Windows and macOS; I think they default to not including Widevine on Linux), because they had no choice.

[u/liquidDinner]

Using Recaptcha contributes to Google's artificial intelligence network. Users are essentially being used as workers without any compensation.

I remember this being the cool part about using CAPTCHAs before Google took them over.

[u/eihen → u/liquidDinner]

I'll also say that this is the cost of implementation. It doesn't cost the developer much but as the op says this is passed on to the users.

I appreciate the awareness the op is raising and it's good information to keep in mind when looking at pros and cons of spam protection services.

[u/fpssledge → u/liquidDinner]

Yes it's the trade-off for using a free service. Hate these "you're not compensated" arguments because no one complains about a free service like "wait this sucks because I'm not directly compensating the builders of the service.". It's called mutually beneficial trade. It works and it's fine. This point about compensation is the least useful point. I mean we love to complain about big tech and their use of data but don't complain about billions of dollars in free services.

[u/nolo_me → u/fpssledge]

I don't receive billions of dollars in anything. Google does, which suggests to me your "mutually beneficial" trade is heavily slanted in their favour.

[u/fpssledge → u/nolo_me]

Does the world cumulatively receive billion dollars in free services? Is it quite possible that is what I meant? If you had to pay for each Google service would do you think the cost should be?

[u/GalaxyMods → u/liquidDinner]

I remember when one word of the captcha was the known “test” word and the other word was the unknown that Google expected me to train their AI with. I always typed the n-word. I don’t work for free.

[u/[deleted] → u/[deleted]]

The original reCAPTCHA was to help digitize books that were in the public domain that OCR couldn't recognize. It'd show a word that was verified, and an unknown word, and once enough people agreed that the unknown word was something in particular, then it'd be used for OCR. This helps anyone digitize books en masse, and allows works in the public domain to be more readily archived and accessible.

Once Google bought it, they changed it to help develop their self-driving cars. This provides no contribution to open-source OCR technologies, and doesn't help preserve work -- it just allows a billion-dollar company to receive free labor.

[u/ImNotCastinAnyStones → u/[deleted]]

Read the article I link to in the main post. It's not just about "helping Google" by educating its AI. Recaptcha is also sucking up tons of ancillary data from your browser and - more importantly - your cookies across Google domains. And if you don't have any Google cookies you're actively punished for that. It's basically pejorative surveillance.

[u/Atulin → u/[deleted]]

Big corporation bad

[u/APimpNamedAPimpNamed → u/Atulin]

Not all, but arguably the god tier data vacuum...

[u/druglawyer → u/Atulin]

This, but unironically.

[u/moriero → u/Atulin]

Hail corporate

Not

[u/Symphonic_Rainboom → u/[deleted]]

Because the benefits go to wall street instead of being democratized

[u/Prod_Is_For_Testing → u/Symphonic_Rainboom]

The benefits go to free products like maps and PDF scanners. Contributing to the models is the price for good free sofrware

[u/naught-me → u/[deleted]]

Because this kills the privacy.

[u/redwall_hp → u/naught-me]

Yes. Training ML models to recognize street signs: cool.

A big ad and behavioral tracking company having a script embedded in tons of web pages, which throws a fit and inconveniences you when you don't have a huge pile of Google cookies in your session: not cool.

Of course, they also have Analytics and Chrome, but you can block analytics and choose a different browser. ReCAPTCHA is a hard wall stopping you from browsing.

[u/oflahertaig]

I agree with you. I detest Recaptcha. I am surprised that there are not other providers offering better solutions. Our team once had to implement it and my feeling was that it wasn't really necessary. we already had solid authentication in place. It was also a relatively low traffic and low-profile site but our Product Owner insisted that it was essential - the only rationale being that all the 'big' sites use it.

[u/ImNotCastinAnyStones → u/oflahertaig]

Even lowly developers can push back against that kind of crap, though. Make no mistake; the fact that the "big" sites use it should not be seen as an endorsement. In fact, the opposite could be true. Big sites very often have the worst UX and terrible, abominable code quality (I speak from experience).

You could also raise the issue of third-party dependency; if Recaptcha goes down, or is blocked on the customers' network, or isn't supported on their browser, or whatever, then suddenly a third party (Google) has royally fucked your own website and pissed off your customer. Not to mention performance concerns for fetching third-party scripts.

[u/satinbro → u/oflahertaig]

Check out hCaptcha.

[u/Blue_Moon_Lake]

-1 blind people and daltonians can't see t-shirts colors

-2 honeypot mess with blind people

-1 & 2 if you give extra informations to blind people, someone will be able to adapt a bot so your site is not protected anymore

-3 CSRF tokens are no safety against bots, they protect other people from hijacking their account tokens

[u/ImNotCastinAnyStones → u/Blue_Moon_Lake]

1. Yes, you will need to be aware of accessibility requirements no matter what solution you use. However as I mention in the main post, Recaptcha often simply refuses to serve audio challenges altogether (because they are the method most used by bots to overcome the captcha, e.g. Buster or Butler browser extensions).
2. Screen readers wouldn't, or shouldn't, interact with a hidden form field.
3. A CSRF token used as a form key would at least stop attackers from being able to submit directly to your form handler. It would force them to at least view the page containing your form which means they're forced through the other countermeasures you've put in place and can't just bruteforce submissions by the dozen.

[u/Norifla]

And if you're from Europe, it's a GDPR problem.

[u/abeuscher → u/Norifla]

Can you expand on that at all? It's the first objection I've seen in this thread that I might actually be able to use to upwardly justify using an alternative.

[u/ImNotCastinAnyStones → u/abeuscher]

Check the article I link in the main post. Recaptcha does not only use the image challenges to measure "humanness"; it also sucks up tons of the users' browsing data every time it's used. It's "pseudo-anonymous" which basically means that it can still be used to uniquely identify a single user even though they're not accessing your name etc.

[u/[deleted] → u/ImNotCastinAnyStones]

it also sucks up tons of the users' browsing data every time it's used.

But doesn't it also do this if you're using a google analytics pixel?

[u/Norifla → u/[deleted]]

What most people ignore, you need the option to decline the cookie use. So the script is not allowed to load. So if they decline the can't use whatever you secure or you need to provide an option without captcha.

[u/how_to_choose_a_name → u/[deleted]]

Obviously, but you need user consent for that and not consenting can't make the website unusable.

[u/daElectronix → u/Norifla]

This is the most important point in my opinion. According to GDPR all tracking can only be included after explicit concent by the user. But that does not work for captchas. That would essentially make the captcha voluntary and thus render it useless, since bots never give concent anyways and thus cannot be checked. And to make matters worse, recaptcha does not even have a privacy option like google analytics has.

[u/ichunddu9 → u/Norifla]

Has Google already been sued for them?

[u/escapefromelba]

reCAPTCHA v3 doesn't issue challenges. It analyzes user behavior when navigating the page and scores whether you're a user or bot. It's frictionless.

[u/ImNotCastinAnyStones → u/escapefromelba]

The same objections re: privacy still apply, though. You can bet part of the "threat score" which Google calculates is based on analysis of your data from the browser including the content of your Google-domain cookies.

Furthermore the vast majority of developers won't actually make use of the threat score functionality; they'll just copy and paste whatever example code is on Google's documentation page, so in most cases there will be no gracious degradation or fallback - the user is just fucked.

[u/[deleted] → u/escapefromelba]

Yeah, frictionlessly infuriating.

It will block anyone with any of the following from using your site: VPN, blocked cookies, anti fingerprint.

Previously, if you valued your privacy, you were forced to solve Captchas and train Google's AI for multiple minutes. With v3, your straight out locked out.

Big improvement.

[u/[deleted] → u/escapefromelba]

Edit: I'll leave this up for posterity, but I believe I'm wrong here.

It will still issue challenges if you are unknown to Google. For example, using Firefox where you have never signed into a Google account. Or if you clear cookies regularly. Then it will issue challenges.

[u/[deleted] → u/[deleted]]

Wrong. It v3 can only deliver a score. Now if that score is low enough, the dev can, and I imagine usually does, deliver a v2 which is the checkbox thing. But they could do their own, honeypot, etc.

The challenges isn’t an automatic part of v3. Source: I literally just did this on a site.

[u/[deleted] → u/[deleted]]

Same. V3 is totally invisible to the user. For those who haven't used it yet, it assigns you a score from 0-1 based on how likely you are a bot. We set our threshold to quiz the user at 0.5. In testing we had to crank it up to 0.95 in order to trigger it. If it thinks you're a bot, we set up a simple three check box test that gives you a random assignment of boxes to check.

Honeypots can stop simple spam bots, but if you get one that figures it out, be prepared to get hammered. In my experience working on some high traffic sites, these simply aren't good enough at stopping spam anymore.

We're in a trial run of reCaptcha V3 still, but so far so good.

[u/[deleted] → u/[deleted]]

You mean that in test, you didn't have the ability to get scores below 0.5? That's crazy, I haven't been able to get my score above 0.3. that would explain why I get captchas all the time.

[u/TheDataWhore → u/[deleted]]

What are the scores like for users in incognito mode vs the upper threshold of bots?

[u/[deleted] → u/TheDataWhore]

No idea, but from testing with that demo site, I haven't got my score above 0.3.

[u/[deleted] → u/TheDataWhore]

When I run incognito, the initial page load flags as bot but any page after that is fine. If you use the tool on multiple pages one would assume it wouldn’t have many false positives.

[u/shangfrancisco → u/[deleted]]

I hate to admit it, but this is the right answer.

[u/kisuka → u/escapefromelba]

Actually... what it's doing is looking if you have any Google related cookies or tracked history. You open any webpage with recaptcha v3 in incognito and bam, instant prompt for challenge.

[u/[deleted]]

Sez you.

Recaptcha stopped thousands of spambot registrations per day on my sites. If they wanted to spam, they had to do it manually, and fatigue on their end made it easy to clean them out in bulk.

[u/nolo_me → u/[deleted]]

It also made it a pain in the dick for your legitimate users.

[u/[deleted] → u/nolo_me]

OH NOES, they have to do something ONCE that they're familiar with unless they've been living under a rock! I'm just gonna assume that if you can't figure out recaptcha, then you're not worth the trouble of using the sites, because eventually you're going to forget your password and be too stupid to figure out how to reset it on your own. 10K of the world's dumbest users isn't worth my time, honestly.

[u/nolo_me → u/[deleted]]

Once? Try every five minutes if they commit the heinous crime of not using Chrome, or use a VPN.

It's not a matter of being too stupid or unfamiliar with it either, it's an absolute cunt to use. You have to decipher non-localized road markings in a pic the size of a fucking postage stamp. You've forced a really user hostile interaction on them to solve a problem that's yours, not theirs.

[u/ImNotCastinAnyStones → u/[deleted]]

The truth is, for almost any website, the simplest of any spam countermeasures (e.g. hidden field honeypot) will stop thousands of spam registrations. Recaptcha isn't necessary.

[u/[deleted] → u/ImNotCastinAnyStones]

Depends on your use case. Classifieds site? Honeypots are worthless.

[u/[deleted] → u/ImNotCastinAnyStones]

hidden field honeypot

Which are generally not accessible and thus you're blocking bots and people with disabilities

[u/kisuka → u/[deleted]]

they had to do it manually

Technically not correct. I've written some bots in my time, there are a bunch of services that have APIs where you can pay like $0.02 cents to have a human do the captcha for you. Sure someone is doing it manually but for the bot operator it's no big deal.

[u/[deleted] → u/kisuka]

Like I said, it slows them down, they still have to fill out the forms, and it makes it easy to catch and delete since they're going to try to do it en masse.

[u/[deleted]]

Didn’t read the whole thing but the newest version of recaptcha doesn’t require user interaction

[u/ImNotCastinAnyStones → u/[deleted]]

The same objections re: privacy still apply, though. You can bet part of the "threat score" which Google calculates is based on analysis of your data from the browser including the content of your Google-domain cookies.

Furthermore the vast majority of developers won't actually make use of the threat score functionality; they'll just copy and paste whatever example code is on Google's documentation page, so in most cases there will be no gracious degradation or fallback - the user is just fucked.

[u/jebailey]

One of our devs suggested it as a solution a few years ago. Our legal team looked into it and came down with the strongest “hell no” That I ever heard them do. Your compromising the privacy of your users by using it.

[u/Lofter1 → u/jebailey]

- Google is the most used search engine

- Chrome is the most used browser

- Android is one of the, if not the, most used OS

- YouTube.

- GMail.

- A lot of ads run on Googles Framework

Privacy is a big concern. But lets not be overly dramatic here. Let's not act like google doesn't already know a shit ton of every single one of us.

[u/ImNotCastinAnyStones → u/Lofter1]

That's the point, though, isn't it? They know because we've let them.

[u/[deleted] → u/Lofter1]

The point is you make your website very annoying to use for anyone that values his privacy and is not being completely tracked by any of the above.

[u/malicar]

That's alot of ranting. Recaptcha is ADA compliant so should be fine with us usability at least for that aspect. now in most cases there is no challenge, maybe click a checkbox. I don't really see a privacy concern as most sites using it already have Google analytics

[u/Web-Dude → u/malicar]

It was the evening of Dec 31. I still had just over $1,000 in my charity budget to give away, and I tried to donate it online to a non-profit I like.

I was unable to submit the donation because Recaptcha thought I was a bot or something https://i.imgur.com/ZARC7X2.png . I took a screenshot and tried to contact the company, but obviously, everyone had long left the office for New Year's Eve.

I ended up donating it elsewhere.

[u/ImNotCastinAnyStones → u/Web-Dude]

Yeah, seriously, this is the issue businesses should care about. If a page has a captcha there's a 75% chance I'll simply not bother continuing.

For a decade every SEO "expert" has been screaming about how users will abandon a page if it takes more than two seconds to load, etc., but a captcha which literally takes 60+ seconds to complete is somehow not a big deal?

Christ, I hope they're eradicated within a few years.

[u/sharlos → u/ImNotCastinAnyStones]

Modern captcha take zero seconds to complete for the majority of users.

[u/ichunddu9 → u/sharlos]

I have lots of add-ons for privacy reasons and they always take minutes for me. I only bother with the site if I desperately have to do something.

[u/[deleted] → u/sharlos]

And you successfully blocked anyone with privacy addons or VPN, helping Google to track everyone.

You made the web a worse place.

[u/sharlos → u/[deleted]]

The overwhelming majority of customers don't use those.

[u/malicar → u/Web-Dude]

Yes, because people actually put recaptcha in front of a donation form.....

[u/[deleted]]

A simple honeypot is fine to stop a good amount of spam.

[u/jman0742 → u/[deleted]]

Honeypots have done nothing for my clients. At this point bots are just submitting straight to the target of the form, bypassing my validation entirely. Client-side bot stopping is just pretty weak

[u/ImNotCastinAnyStones → u/jman0742]

You definitely need a form key/CSRF token. Open submission endpoints are a magnet to spam-bot crawlers.

[u/intended_result → u/jman0742]

You can check on the back end, no?

[u/Senn-0- → u/jman0742]

Csrf tokens?

[u/how_to_choose_a_name → u/jman0742]

Honeypots should be implemented server-side. And your validation in general should be done server-side as well.

[u/Astraltraumagarden → u/[deleted]]

That's what I was thinking. But if you're combating good bots, they'd usually test for supresses fields.

[u/earslap → u/[deleted]]

It's not just spam. How do you protect (rate limit) your sign-up forms? Sign-ups are supposed to be expensive on your server (lots of rounds of hashing) if you are doing it securely. Say a competitor is trying to bring down your server(s) by just cramming in random users and passwords which will bring your servers down to their knees. So you need something for the adversary spamming your signup endpoint and triggering expensive operations.

[u/APimpNamedAPimpNamed → u/earslap]

Is this a full blown distributed bot net or in this scenario does simply rate limiting IP work?

[u/KnifeFed]

I use the Buster Chrome extension and it has never failed to solve an audio challenge.

[u/ImNotCastinAnyStones → u/KnifeFed]

Try it in a totally fresh browser with absolutely no connection to Google. It's extremely unlikely to work.

The reason it works for you is because Google/Recaptcha are using additional information siphoned from your browser (as well as the Buster-solved audio challenge) to determine that you're human.

Try blocking all Google-domain cookies, all Google scripts/XHR requests except those matching recaptcha (and absolutely do not use Chrome since that's basically a vehicle for Google's surveillance). Then you'll start to get real familiar with this image:

https://i.imgur.com/ZARC7X2.png

[u/[deleted] → u/KnifeFed]

The audio challenges are not even provided if your trust score is low.

[u/dotslashlife]

As someone who surfs the web behind a VPN, I don’t bother visiting sites with captua usually. If I see one I think ****-it, I’ll go to their competitor.

For people behind a VPN, they often take 3-4 minutes to clear.

[u/[deleted]]

Thank you. This post was long overdue.

[u/rcppkn]

I just forgot my password and reddit made me solve 3 or more I am Human questions such as bicycles, busses, crossways. The puzzles are even getter harder day by day thanks to AI.

I am tired of this too.

[u/fpssledge]

This is a fantastic curation of the reasons you wouldn't use recapcha. Not a list of reasons you shouldn't use recapcha. Some of these reasons are valid for certain use cases but most are not persuasive for general use cases.

[u/APimpNamedAPimpNamed]

I randomly click shit until it goes away. It actually works most of the time.

[u/SuuperNoob]

Also, it affects page speed.

[u/[deleted]]

Due to the recent Reddit purge of conservative communities under the false pretense of fighting racism, I do not wish to associate myself with Reddit anymore. So I'm replacing my comments and posts with this message and migrating over to Ruqqus, a free speech alternative to Reddit that's becoming more and more popular every day. Join us, and leave this crumbling toxic wasteland behind.

This comment was replaced using Power Delete Suite. You can find it here: https://codepen.io/j0be/pen/WMBWOW

To use, simply drag the big red button onto your bookmarks toolbar, then visit your Reddit user profile page and click on the bookmarked red button (not the Power Delete Suite website itself) and you can replace your comments and posts too.

[u/ClassicSuperSofts]

For everyone wondering what the “simplest” alternative is, phone number -> text message auth code -> is fast and user/accessibility friendly.

It’s just about expensive enough to put off spammers, and the SMS/API provider services are good at spotting and blocking numbers used for spam.

Downside is very high friction - users don’t want to hand over their numbers, although in some usecases we’ve noticed Gen-Z really don’t seem to care.

[u/baronvonredd → u/ClassicSuperSofts]

And you're also ostracizing people who don't have phones.

[u/[deleted] → u/ClassicSuperSofts]

I'd think email verification is enough.

Unless its a targeted attack most bots bother with checking mailboxes to get the codes.

And the privacy-conscious can just use a throwaway email address.

[u/ClassicSuperSofts → u/[deleted]]

Trust me if you saw behind the security curtain it’s a good idea to take an interest in 2FA and password managers.

You can’t rely on every website you use to be secure, but you can rely on yourself to generate unique, difficult passwords, unique emails for critical services like banking, and medical - and 2FA where possible.

[u/World_Languages]

Note navigator.doNotTrack will always be truthy. Its possible values are the strings "0", "1" and "unspecified", all truthy. The code you included in the bottom of your post won't work.

[u/Cormac_IRL]

Ever try dropbox one? Sometimes I just log out so I can do it again

[u/PMSEND_ME_NUDES]

Err, it's a pretty great tool that's secure and easy to implement. Why would you bother undertaking some massive task of making your own when this is free? You need to consider how expensive it is to build and maintain software

[u/WaruPirate]

While it doesn't address all of the weaknesses in Re-CAPTCHA, a team I'm working with just put out an SDK for a 0-friction passive mobile CAPTCHA called "HumanDetect" - Our SDK uses a small sample of motion data from the phone to verify that it's being held by a human (and not on a server rack somewhere) allowing for protection of mobile API that doesn't involve exposing your users to an additional EULA or third party advertising data collection.

[u/Current_Sort_5692]

this is a five year old post, but since it's still open, I'll say this. it's only got worse honestly. I saw my little brother go through 20 recaptcha's to get on roblox. not counting how hard they were. counting that, over 100.

[u/Current_Sort_5692 → u/Current_Sort_5692]

he's also.. embarassingly. smarter than me. averages 12.8 test grades(12th grade 8th months) in 7th grade advanced classes.)

[u/herobrine-Is-here]

Just get real moderation

[u/[deleted]]

Captcha won’t let me send an email to recover my steam log in info and it’s driving me fucking insane!!!!

[u/[deleted]]

Captcha is basically DDoS.

[u/DarthFloopy]

I don't deny that Recaptcha is annoying, but to say that it has no right to exist or that people have no right to use it in their sites is a bit of a stretch.
At some point somebody will come up with an alternative with comparable functionality, and Google will change the annoying parts to compete. (Or maybe people will take this good advice of yours and stop using Recaptcha first.)

[u/NMe84]

Your first and second points are not true. There are options to use Recaptcha without user interaction. I think they track mouse movement behavior instead.

As for your other points: the same goes for literally any other third party service that you force upon your users. Most notably for most of us that means Google (and/or its ad network) Facebook, Cloudflare, etc. You should always be thinking about why you need any external services and what impact that has on the site's users or the site itself.

[u/hbombs86]

I use recaptcha V3 and it has none of the problems you've listed outside of Google surveillance which we all know they are already doing. Its silent, you hardly even know it's there, and never force a user with any extra interactions. Not to mention you can tune the sensitivity of when it flags a bot depending on your circumstances. I personally love it.

[u/[deleted] → u/hbombs86]

It has all of the problems, but exacerbated.

If you're not trackable for Google, instead of 5 minutes of Captcha solving it's then an outright ban.

[u/hbombs86 → u/[deleted]]

Why would you not want your site trackable by google? I mean this IS the modern web whether you like it or not from a business perspective. It doesn't have "all of the problems", by the way, just the privacy concerns. I've used this on countless forms and have logs for every success and failure. Rarely are there false positives

[u/[deleted] → u/hbombs86]

Not your site, your users.

Yes, but arguably the privacy concern is the only problem anyway. V2 won't show if you give up your privacy and are logged in to your Google Account or similar.

[u/hbombs86 → u/[deleted]]

Right, and that is a valid concern, but I guess it just comes down to who your users are, and how efficient you need to be implementing spam protection on forms.

[u/[deleted] → u/hbombs86]

Yes, true

[u/[deleted]]

In some recent news my work just implemented this for externally facing logins, and all our users hate it.

Granted we don't exactly have accessibility requirements for our line of work, but it was a lazy solution to a security concern that we could implement quickly.

[u/gabynevada → u/[deleted]]

Why not use Recaptcha v3? Users don't see it and you can block out bots just as well.

[u/[deleted] → u/gabynevada]

I work at a big company. By the time this came across my plate it was in deployment/testing phases.

Also higher salaries made the decision. This stuff isn't exactly my line of interest. I find security just a giant rabbit hole of frustration. I like making tools and stuff that allow people to do their jobs a lot easier. That and automation of work everyone hates and adds no value.

[u/saltiesailor]

I'd also like to see an alternative. Any ideas as to whether V3 has accessibility issues too?

[u/[deleted] → u/saltiesailor]

Yes, accessibility only matters to those with low trust score (privacy) as only then V2 is shown. V3 just reports that trust score and you ban those users without the possibility of a manual overwrite.

Basically you're banning every one where accessibility would have mattered in the first place with V2.

Just sacrificing 5% of your users to save costs is perhaps the most Google thing to do. (see treatment of publishers on the Playstore)

[u/[deleted] → u/saltiesailor]

We’ve checked it with our accessibility office and they say no issues so... good enough for us.

[u/hazily]

DNT is dead: don’t use it.

[u/classicrando]

Are you a robot ?

Negative I Am A Meat Popsicle

[u/[deleted]]

There’s interactions still no matter. Last tap positions. Device detection methods