4

We have one client and a subset of their users who struggle with Google's reCAPTCHA. They report issues of not being able to solve the challenges.

Our issue is we don't have that problem. Even when purposefully failing the challenge by selecting an incorrect tile or not selecting enough tiles, the challenge either submits correctly or informs us that we're missing a selection.

The captcha is applied to a payment form, and we don't want to remove it as this client has had issues with bots in the past.

Is there any other bot-thwarting system or practice that might solve this problem?

We used to utilize honeypots in the past but as autofill has become better, we've had to phase that out.

  • Is it a case where the users can't solve the challenges because they're too difficult, or because they don't work correctly? – Kyle Applin Sep 6 '17 at 15:27
  • Wait I just read the question again and I misread it. Oops. Is the green tick appearing after submitting? – Kyle Applin Sep 6 '17 at 15:29
  • 1
    @Sonickyle27 The response has been that they're too difficult. Quote: "I just had to do another one to unsubscribe from a store's email list, and I did it wrong twice (how the heck am I supposed to know that's a road behind that building??? aaahhhhh)". So, they're able to submit eventually. – VampDuc Sep 6 '17 at 15:30
  • 1
    Yeah, reCAPTCHA can be quite picky with things like that. I once had to do 6 rounds of picking images before it would let me through. Google also does provide an "Invisible reCAPTCHA" which makes the reCAPTCHA box only appear for users who are suspected as being a bot. I don't know whether that'll help reduce the amount of challenges that appear for a user, but it might be worth a try. – Kyle Applin Sep 6 '17 at 15:41
  • @Sonickyle27 I've looked into the invisible reCAPTCHA. Unfortunately, it will not solve their problem. It basis its visibility both on the user (if logged into a Google Account) as well as the overall traffic of the site itself. This is a highly trafficked form, with users failing the challenges regularly, it seems. – VampDuc Sep 6 '17 at 16:42
1

reCAPTCHA v.3

Perhaps, Google reCAPTCHA v.3 would be an auxiliary solution for you. As it claimed in the documentation:

reCAPTCHA v3 will never interrupt your users, so you can run it whenever you like without affecting conversion. reCAPTCHA works best when it has the most context about interactions with your site, which comes from seeing both legitimate and abusive behavior. For this reason, we recommend including reCAPTCHA verification on forms or actions as well as in the background of pages for analytics.

It returns a value that represents a probability whether you're site is dealing with a bot or a human. It's possible to make use of that, at least to reduce the amount of encountered issues by means of reducing the number of users who have to enter a captcha.

Invisible reCAPTCHA v.2

If it's preferred to use reCAPTCHA v.2, its behavior can be improved as well utilizing it with the invisible parameter set to true.

It appears to be a considered option according to the comments. However, since the details are of it implementation is mainly unknown to the general public and hidden behind Google's risk engine, it looks like it may worth a try.

Custom Captcha Implementations Usage Caveat

It requires a bit of investigation and analysis of existing custom solutions. Many of them are even easier for bots than for humans, thus, provide no security from bots. This isn't limited to mathematical operations, but includes text recognition captchas as well. Such implementations from small vendors should be used with a great caution.

| improve this answer | |
  • That's neat! I'll keep an eye on when this comes out of beta. – VampDuc May 21 '18 at 14:54
0

Unfortunately, ensuring security in today's web apps has a become a compromise decision between tougher challenges (like Google's reCAPTCHA) and convenience (other easier CAPTCHA libraries or roll your owns). If you go for convenience option for your users, it will hamper the security slightly.

What you can do as an alternative is two things:

  1. As the other answer suggests, you can use any other open source CAPTCHA library instead of Google's. Gregwar's CAPTCHA library is widely used in PHP apps, for instance.

  2. Use a DDOS mitigation service such as CloudFlare or that of Amazon's. Any attempt to break your CAPTCHA is usually detected as DDOS attempt by these intelligent services and you might be able to mitigate the risk of using a laxer security mechanism to some extent.

| improve this answer | |
  • Unfortunately, using the "easier" caption isn't really an option anymore. – VampDuc Nov 21 '17 at 18:44
0

Have you tried Invisible reCAPTCHA? It doesn’t require the user to tick a box but does present the puzzle challenge if it thinks you’re a bot... so the majority of your users shouldn’t actually experience it.

Demo: http://google.com/recaptcha/api2/demo?invisible=true

| improve this answer | |
  • 2
    this is already in comments to the OP, and OP is not only aware about it, but specifically said it is not an option – Devin Dec 22 '17 at 0:32
-2

The solution is to recreate your own captcha that will replace that from google. for that your captcha will load from your system and even if your clients have a slow connection. for slow connection captcha from google seem to not load properly.

| improve this answer | |
  • The problem isn't loading times. It's that the client can't solve the challenges. At all. If we could make a captcha on par with Google's, just as effective, but easier, we'd have done it. – VampDuc Nov 19 '17 at 13:38
  • Why create a captcha per google's, create your own with another simpler idea but a little bit effective to that of google. – dean Nov 19 '17 at 13:42
  • 1
    Uh...no. I'm trying to protect my clients anonymity. Do you not know what captcha I mean? It's used on many sites. developers.google.com/recaptcha – VampDuc Nov 19 '17 at 13:54
  • 1
    You don't do web development, do you? There are several hundred languages we'd have to account for. But, more importantly, the captcha has to be accessible. You need an alternate captcha for the sight impaired. Our previous captcha was like your example, had an alternate sound option for the blind, and was STILL thwarted. – VampDuc Nov 19 '17 at 13:59
  • 1
    Nah, dude. This has gone on way too long in the comments. I had a clear question which you failed to understand before answering. – VampDuc Nov 19 '17 at 14:04

Not the answer you're looking for? Browse other questions tagged or ask your own question.