TOPIC:

So we have been using Google reCAPTCHA in some areas of the system since earlier this year.   We have just been using it in a passive mode to just see what it flags as a "problem" and not really taking any enforcement action based on its scoring of user interactions.

What are everyone's impressions so far?  What do we see as beneficial / problematic with using it?    My thoughts:

1.  It does seem to be less intrusive than other types of reCAPTCHA.
2.  It does seem to have problems with some types of login interactions.  I suspect that password fillers are causing some of these issues.  
3.  Some sort of additional authentication or verification step may be needed when the reCAPTCHA code flags user interactions as problematic.

A few months ago I received email notices that a couple member's site login attempts were flagged. They didn't raise any login issues with me and continued using the site regularly so nothing came of that. That's been the only captcha activity I've seen so far. I skimmed my archive email to see if I could find those notices. No subject lines jumped out at me and I don't recall the exact time frame.

I use 1Password and routinely enter my member and admin accounts back to back. I've seen no captcha issues with this.

The non-intrusive nature of this system is nice. Item #3 will be important as a site admin; if a member login attempt is blocked what tools will be available to deal with it.

Your expertise and efforts are always appreciated Steve!

My impressions so far, are very much like those reported by rhtaylor3. Little impact, and just one account warning, which turned out to be a false positive.
I've not been aware of any other intrusion attempts on our site other than this (but of course you as admins will be in a better position).
I use an admin account and a member account and use password fillers (Google), and I login to another FTH site, which sometimes confuses the filler I think.
So overall, it seems worth its impact so far.

Attached is what Google is reporting overall for the last 90 days.

It looks like the activity that has the most suspicious interactions is the new website request form.   I do see a "weird" category called TYPE... probably something I forgot to assign a category tag for.
 

V3 is certainly less intrusive but can be confusing when sometimes it asks you to choose images and sometimes not. I hadn't realised that robots "move" mice in straight lines rather than the curves used by people. No problem since I started moving the mouse around a bit more; if it gives an added level of security, I vote to keep using it. I like the idea of being able to see how appealing the site is to bots!

We do not use a CAPTCHA, or... at least, I never see one.
I found this forum post by an alter message when I first log in as an Admin of our FTH site.

QUOTE:

[Mon, 04 Oct 2021 15:15:58 UTC, FreeToastHost System Warning]

Google RECAPTCHA detected a suspicious activity likely initiated by a bot or automated script.

*** NOTE: FreeToastHost may block suspicious activities in the near future. ***

Details:

---

Club #: 816
Club Name: Woodfords Toastmasters Club
User's IP Address: 192.186.72.50
User's Host Domain:
Attempted Action: Website Admin Login ()
Google RECAPTCHA Score: (Mininum Acceptable: 0.5)
Other Information: [NO RECAPTCHA TOKEN RECEIVED]

If you have any questions about this warning, please visit support.toastmastersclubs.org

---

[2021-10-04 02:16:48 GMT, FTH Developer] We have been "trying out" the Google reCAPTCHA v3 technology since earlier this year in a "passive mode", just doing warnings. I would like to get some impressions of it from our users. One of things on my "to-do" list is to figure out what (if anything) to do next with this technology. (or should we drop it)

You can leave your thoughts and feedback here:

support.toastmastersclubs.org/2011-10-23...sense-of-impressions

Regards,

Steve James, DTM
FreeToastHost System Developer
support.toastmastersclubs.org


UNQUOTE.


I have no idea what the message is about, as we don not nuse a CAPTCHA.

Moreover, even if we were, I would oppose anything from GatekeeperGoogle as this becomes just one more way for that corporaiton to scrape private information about users to add to the dossier that that privacy-invading corporaton compiles for each IP.

3moCC wrote:

We do not use a CAPTCHA, or... at least, I never see one.
I found this forum post by an alter message when I first log in as an Admin of our FTH site.

QUOTE:

[Mon, 04 Oct 2021 15:15:58 UTC, FreeToastHost System Warning]

Google RECAPTCHA detected a suspicious activity likely initiated by a bot or automated script.

*** NOTE: FreeToastHost may block suspicious activities in the near future. ***

Details:

---

Club #: 816
Club Name: Woodfords Toastmasters Club
User's IP Address: 192.186.72.50
User's Host Domain:
Attempted Action: Website Admin Login ()
Google RECAPTCHA Score: (Mininum Acceptable: 0.5)
Other Information: [NO RECAPTCHA TOKEN RECEIVED]

If you have any questions about this warning, please visit support.toastmastersclubs.org

---

[2021-10-04 02:16:48 GMT, FTH Developer] We have been "trying out" the Google reCAPTCHA v3 technology since earlier this year in a "passive mode", just doing warnings. I would like to get some impressions of it from our users. One of things on my "to-do" list is to figure out what (if anything) to do next with this technology. (or should we drop it)

You can leave your thoughts and feedback here:

support.toastmastersclubs.org/2011-10-23...sense-of-impressions

Regards,

Steve James, DTM
FreeToastHost System Developer
support.toastmastersclubs.org


UNQUOTE.


I have no idea what the message is about, as we don not nuse a CAPTCHA.

Moreover, even if we were, I would oppose anything from GatekeeperGoogle as this becomes just one more way for that corporaiton to scrape private information about users to add to the dossier that that privacy-invading corporaton compiles for each IP.


 

As it is part of the website template and system code (I define that), you are using it.  (just like everyone else using FTH)  We are trying it out due to a need for increased system security approaches.  The message you cite above was from me.  The fact that you do not realize you are using it just underscores my point above that it is less intrusive. 

It is seemingly sending a warning about everyone who signs in, not suspicious activity - unless all activity is suspicious. doesn't seem to be a good thing.

Freddi wrote:

It is seemingly sending a warning about everyone who signs in, not suspicious activity - unless all activity is suspicious. doesn't seem to be a good thing.

I do not think that is happening.  (but maybe I am mistaken)  Where are you seeing that?
 

The only warnings that I saw on the two sites that I manage was from me logging in. Not sure why. I don't think I'm a suspicious person, but perhaps I'm wrong.

I've noticed the icon on the screen and had no issues with the flow.  I"ve not seen any issues from member interactions at this time.  It is much better than the periodic, find the crosswalk or bus scenario at the .org site.  Should I be expecting some reports or emails for suspect logins?  Thanks for your effort.
 

I am the site admin for multiple clubs in our area who do not have members with the needed computer skills or understanding to be site admin.  The CAPTCHA messages show up weekly during the site admin login, and always concerning our members who are visually impaired, not computer savvy, forget passwords, or mistype their passwords often.  If you begin blocking these users, it will be more complicated for the ones who have the most problems with basic logins.  The club site admin knows who the legitimate members are.  If you continue to use this service, I recommend you allow club site admin to verify legitimate users to eliminate weekly warnings about them.  Give club site admin the option to block or not to block questionable users to prevent legitimate members from losing access which may cause them to leave Toastmasters altogether.  The other option of selecting pictures with a certain feature is not desirable, since it prevents visually impaired members from gaining access.

Thank ytou for clarifying and explaiining.

Can yo confirm that there us no way the #GatekpeeerGoogle is
NOT scraping informaiton from pour members
such as IP and browser info?

Thanks..

The less intrusive, the better.  I don't like the CAPTCHA option that requires you to select squares containing a certain object.
Thanks for allowing me to give feedback.

Dan

Please make it go away.

The only people inconvenienced by it are the true members. 

Club 3660 
geospeakingtoastmastersclubsorg.toastmas...lubs.org/agenda.html

I am the President of Belvoir Club, Club #5786, and also our Web Admin.

CAPTCHA only makes it difficult for members and visitors to participate in our club. I can't imagine our club is being bombarded with enough bots to make this tool necessary. 

I frequently see problems with guests and members. This tool is a barrier to people who struggle with the log-in concept itself. This tool is a complete barrier to persons with visual impairments. 

Altogether, it is unfriendly way to encounter a website.

Please remove CAPTCHA.

If you decide to leave it, please give the Admin the ability to turn it off. 

Mary Phillips

First impression is that it sometimes causes members to just quit using the website.

Much the same as for others--1 suspect login (me, using a password filler), otherwise quite unobtrusive.