Google Introduces reCAPTCHA V3 With Scoring Instead of a Challenge

[engine]

Google has introduced reCAPTCHA V3 api which produces a score, instead of a CAPTCHA challenge. Once is use, V3 allows webmaster to select the most appropriate action depending upon the score.

eCAPTCHA v3 runs adaptive risk analysis in the background to alert you of suspicious traffic while letting your human users enjoy a frictionless experience on your site.

Google Introduces reCAPTCHA V3 With Scoring Instead of a Challenge [webmasters.googleblog.com]

[topr8]

1). as a user - i'm glad of this, those pictures drove me crazy and i often left sites because of them. so kudos for that!

2). as a webmaster though ... i have my own methods for blocking bots from filling in my forms .... which although i say it myself is reasonably accurate - without the need for a captcha or suchlike and i've been doing this for years (i'm all for making things as easy as possible for my users) ... i also don't consider myself to be super skilled or anything, so i think it is easy enough to do.

3). as a conspiracy theorist, i do worry at the way so many websites are reliant on google products (such as this) ... but i understand why people use them. eg. they are easy to impliment and they serve a purpose!

[justpassing]

1).)

Agreed.

2).

Agreed too.

3).

Will be fun , if one day Google applies the same strategy as with Google Maps :)

[graeme_p]

I get infuriated by sites that require recatcha to login. I really do not see why they do that. its not to prevent scraping as all of the information that might interest a competitor is public, its not a useful security measure (one site I use uses 2FA AS WELL!).

[heisje]

Worthless annoyances introduced by worthless third-rate web designers as "proof" to their clients they are worth their fees. Security? don't make me laugh. Childish amateurish gadgets, definite proof of a site's cheapishness. Serious sites with serious security concerns (ex. all major banks, etc financial institutions) never revert to such worthless annoyances. They know better not to be clowns.

Cheap rubbish.

.

[lucy24]

What puzzles me is when G### itself throws a “prove you’re a human” captcha at me in response to a search. And I don’t mean the elevent consecutive very similar search in a thirty-second period. What, exactly, are they protecting themselves against?

[keyplyr]

What, exactly, are they protecting themselves against?

Something you've done indicates there's a possibility you're a bot.

At times, I've even had my suspicions.

[heisje]

At times, I've even had my suspicions.

Did you suspect you were a bot at the time?
Was this eventually resolved?
.

[keyplyr]

Wonder if the CAPTCHA at the American Psychiatric Association is a Rorschach test.

[koan]

topr8, I have my own set of tricks over the years to protect public forms from abuse and it stops 99.999% of the automatic crap out there, however, once I had a dedicated abuser with a more advanced application capable of interpreting javascript that was targeting one of my form and giving me grief (to the point of considering dropping that feature on my site), the only thing that finally stopped him was integrating reCAPTCHA V3, so I'm pretty happy with it.

[bwnbwn]

Here is what is weird I have a form to request more information on a clients product It has been live for 10 years and not one bot spam request have I got from this. I get all the emails so what I say is fact. From time to time we do get a spam email from someone wanting to do the SEO or Google adwords. Go figure that.


Done correctly CAPTCHA is a waste of my time never have used it never will.

[justpassing]

not one bot spam request

I mostly operate forums, and at my surprise I never had a single spam bot posting either (whereas I do not require people to register before posting, but their posts are not going live until a human approve them). However, I have my own captcha-like solution, ready to be used in case one day bots starts posting at my sites.

I think that bots are targeting popular CMS, and are not "yet" smart enough to identify and use in-house CMS. They may not be able to identify forms within pages, or how to use them.

Some tips:
- do not use common form field names,
- add trap fields, with common names, if they are filled, then it's a bot :)
- inject form in javascript after page load, or, after a user action,

[JS_Harris]

Uh oh, people like me have been guessing at "Hydrant" pictures and intentionally adding a red car as a hydrant(you'll still be called human, don't worry) a bit too much, now we get graded... great.

Captcha is more about helping Google identify images of late and it's hard not to mess with that for many I suspect, just to see if it will consider a curb a storefront or a tail light as a traffic light etc. You'd be surprised at how often captcha says you pass while getting one wrong on purpose.

Buzzkills

[robzilla]

Captcha results [i]might[/i] feed back into the image classification algorithm somehow, but I wouldn't be surprised if they didn't. The point of those images is to test the user, so Google needs to be quite certain that the images it presents actually contain what they're asking you to identify. That you pass the test while getting one wrong, intentionally or otherwise, is probably more of an indication that there's a margin of error so that it's not too difficult. Something like [url=https://crowdsource.google.com/]Google Crowdsource[/url] is probably a much better data source for them.

What I don't like about the new reCAPTCHA is that you have to send it lots of data before you can use it reliably.