Comments on: Google no Captcha + INVISIBLE reCaptcha – First Experience Results Review https://tehnoblog.org/google-no-captcha-invisible-recaptcha-first-experience-results-review/ phones ● computers ● audio ● video ● technology Mon, 28 Sep 2020 09:44:44 +0000 hourly 1 By: TehnoBlog https://tehnoblog.org/google-no-captcha-invisible-recaptcha-first-experience-results-review/#comment-705 Mon, 28 Sep 2020 09:44:44 +0000 http://tehnoblog.org/?p=582#comment-705 In reply to Captcha testing 123.

Thanks. Your spam message did not pass, simply because all comments here are human moderated.

Yes, spam messages from humans can pass, as they naturally do, but other processing layers in the chain can help fight them. Machine learning, traditional keyword/phrase matching, public or private services with scores, known spamming IPs, and so on can help reduce their impact to a point.

In addition, Google reCaptcha gets progressively more difficult when it detects brute force or frequent posting behavior. In another words, it is no longer ‘invisible’, or the returned spam score gets seriously downgraded.

]]> By: Captcha testing 123 https://tehnoblog.org/google-no-captcha-invisible-recaptcha-first-experience-results-review/#comment-704 Mon, 28 Sep 2020 09:32:30 +0000 http://tehnoblog.org/?p=582#comment-704 I have managed to send a spam message here despite the reCaptcha implementation on this webpage. I think the most important advantage of V2 visual challenge over V2 invisible or V3 is the annoyance factor. V2 invisible or V3 won’t stop a human spammer from just sending a bunch of messages to you. That’s a problem, because if you’re serious about customer support, you’ll have to read through such spam as well. Not to mention Blogs, which you’ll probably want to moderate anyway. The V2 visual challenge, on the other hand, will be annoying enough to deter repeated spamming by a random human spammers, which means less noise to go through.

I see no benefit in using invisible reCaptcha V2 or V3 in any real world application because it’s not just bots that you want to filter out and you definitely don’t want to filter out potential customers.

]]> By: TehnoBlog https://tehnoblog.org/google-no-captcha-invisible-recaptcha-first-experience-results-review/#comment-652 Mon, 29 Jun 2020 10:39:30 +0000 http://tehnoblog.org/?p=582#comment-652 In reply to Jek.

reCaptcha v3 loads on every page everywhere in the background, and this method is not even an option in that case.

]]> By: Jek https://tehnoblog.org/google-no-captcha-invisible-recaptcha-first-experience-results-review/#comment-651 Mon, 29 Jun 2020 10:37:08 +0000 http://tehnoblog.org/?p=582#comment-651 How To Boost Lighthouse Performance Score reCaptcha v3 on the site?

]]> By: TehnoBlog https://tehnoblog.org/google-no-captcha-invisible-recaptcha-first-experience-results-review/#comment-370 Fri, 25 Jan 2019 00:14:29 +0000 http://tehnoblog.org/?p=582#comment-370 In reply to [some website] loser.

There are many protections which use IP address blacklists and other methods to determine ‘dirty networks’, suspicious user behavior etc. and they operate on the server-side, thus, there is no way to know for sure which type of protection they use. Also, your Chrome version is a bit outdated (particularly, because Chrome uses auto-update by default and cannot be turned-off by ordinary users), many 3rd party protection scripts detect obsolete browsers as potential vulnerability vectors, and actively or passively prohibit their access. Of course, that field alone is not reliable security method at all (because it can be faked by clients), but it can be a signal that something is not right for that particular client.

After clicking on Show Contact Info reCaptcha was loaded using Ajax, so they do use it after all, just not right away (this is the reason why the code is not directly visible in the source, there is only a call to a JavaScript function that is executed once the user clicks on a button).

]]>