Has anybody run user tests on Google's new reCAPTCHA? My company is looking at using it and wants to run some tests before we implement.
If you haven't tested it, do you know of any places where it's implemented?
2
-
4It's already part of this site. Details here: meta.stackexchange.com/questions/244638/… You can test it by visiting this link: ux.stackexchange.com/nocaptcha– JonW ♦Commented Mar 6, 2015 at 15:46
-
I'm not sure if there is that much improvement. I had used it on my website before and spambots still keeps coming in.– JrossDCommented Apr 18, 2015 at 14:22
Add a comment
|
2 Answers
There is no reason not to replace your older CAPTCHAs with this.
CAPTCHAs are nasty things with terrible failure rates for legitimate users, even though they've been optimised to no end by security researchers. The first thing security engineers are told is not to serve CAPTCHAs when there's no reason to think a user is not legitimate.
The face value of CAPTCHA
Colleagues of mines are currently evaluating how people perceive, and ultimately prefer, three different types of CAPTCHAs. They asked their participants to rank the three proposed solutions, and added two other answers: "no CAPTCHA at all", "a different CAPTCHA".
Some participants did want to have a CAPTCHA (and poorly ranked "no CAPTCHA at all") but were not satisfied by the existing ones (so they chose "a different CAPTCHA"). Of course I won't give any numbers (ongoing testing, need more people before drawing conclusions, unpublished work, etc.) but the current trend suggests these participants associate websites that use CAPTCHAs with trustworthiness and caring about users' security (of course, there's no relationship between how much you nag your users with CAPTCHAs and how well you store their passwords and their personally identifiable information).
I was actually going, based on this hypothesis, to propose a student project where students would compare a CAPTCHA "spinner" to a real CAPTCHA to see whether we could get the security perception benefits of CAPTCHA without the user effort. Google's latest release superseded that project!
Privacy rumblings
If your website already exposes the privacy of your users to analytics and ad systems, then you might as well hand your users to Google so that you don't need to expose them to CAPTCHAs again.
However if the fact that your users visited your site could lead to problems for them (e.g. with law enforcement, or their company or relatives) then you should avoid both Google's reCAPTCHA (which uses browsing history as one source of evidence of legitimacy, and hence would store it and could possibly be forced by law enforcement to reveal it) or other third-party services.
answered May 3, 2015 at 10:13
We just incorporated it for security against fraud through our donation forms (at MobileCause), and it works very well. When a user IP is blocked because of potential fraud, instead of blocking the IP completely we require that the user go through reCaptcha to prove they're human. In testing it's worked very well.
Testing it was kind of a pain though (we were fortunate that we already had everything set up to make it as easy as possible). The types of "are you a human being" tests require that you not be logged in on a google account (aka open an incognito window to do all testing) and run through dozens of different scenarios because reCaptcha has a lot of different test types, such as name the sushi (we laugh about this one a lot), basic arithmetic, picture matching, and more. We don't know for certain if we tested them all, and we also had to test for mobile, which was...interesting.
That said, you can't test it on our platform unless you're willing to make some donations to charities. If you are, great! Just send me a message and I can work with you to show you how it works.
