Google CAPTCHA -- getting a sense of impressions

So we have been using Google reCAPTCHA in some areas of the system since earlier this year.   We have just been using it in a passive mode to just see what it flags as a "problem" and not really taking any enforcement action based on its scoring of user interactions.

What are everyone's impressions so far?  What do we see as beneficial / problematic with using it?    My thoughts:

1.  It does seem to be less intrusive than other types of reCAPTCHA.
2.  It does seem to have problems with some types of login interactions.  I suspect that password fillers are causing some of these issues.  
3.  Some sort of additional authentication or verification step may be needed when the reCAPTCHA code flags user interactions as problematic.

A few months ago I received email notices that a couple member's site login attempts were flagged. They didn't raise any login issues with me and continued using the site regularly so nothing came of that. That's been the only captcha activity I've seen so far. I skimmed my archive email to see if I could find those notices. No subject lines jumped out at me and I don't recall the exact time frame.

I use 1Password and routinely enter my member and admin accounts back to back. I've seen no captcha issues with this.

The non-intrusive nature of this system is nice. Item #3 will be important as a site admin; if a member login attempt is blocked what tools will be available to deal with it.

Your expertise and efforts are always appreciated Steve!

My impressions so far, are very much like those reported by rhtaylor3. Little impact, and just one account warning, which turned out to be a false positive.
I've not been aware of any other intrusion attempts on our site other than this (but of course you as admins will be in a better position).
I use an admin account and a member account and use password fillers (Google), and I login to another FTH site, which sometimes confuses the filler I think.
So overall, it seems worth its impact so far.

Attached is what Google is reporting overall for the last 90 days.

It looks like the activity that has the most suspicious interactions is the new website request form.   I do see a "weird" category called TYPE... probably something I forgot to assign a category tag for.
 

V3 is certainly less intrusive but can be confusing when sometimes it asks you to choose images and sometimes not. I hadn't realised that robots "move" mice in straight lines rather than the curves used by people. No problem since I started moving the mouse around a bit more; if it gives an added level of security, I vote to keep using it. I like the idea of being able to see how appealing the site is to bots!

We do not use a CAPTCHA, or... at least, I never see one.
I found this forum post by an alter message when I first log in as an Admin of our FTH site.

QUOTE:

[Mon, 04 Oct 2021 15:15:58 UTC, FreeToastHost System Warning]

Google RECAPTCHA detected a suspicious activity likely initiated by a bot or automated script.

*** NOTE: FreeToastHost may block suspicious activities in the near future. ***

Details:

---

Club #: 816
Club Name: Woodfords Toastmasters Club
User's IP Address: 192.186.72.50
User's Host Domain:
Attempted Action: Website Admin Login ()
Google RECAPTCHA Score: (Mininum Acceptable: 0.5)
Other Information: [NO RECAPTCHA TOKEN RECEIVED]

If you have any questions about this warning, please visit support.toastmastersclubs.org

---

[2021-10-04 02:16:48 GMT, FTH Developer] We have been "trying out" the Google reCAPTCHA v3 technology since earlier this year in a "passive mode", just doing warnings. I would like to get some impressions of it from our users. One of things on my "to-do" list is to figure out what (if anything) to do next with this technology. (or should we drop it)

You can leave your thoughts and feedback here:

support.toastmastersclubs.org/2011-10-23...sense-of-impressions

Regards,

Steve James, DTM
FreeToastHost System Developer
support.toastmastersclubs.org


UNQUOTE.


I have no idea what the message is about, as we don not nuse a CAPTCHA.

Moreover, even if we were, I would oppose anything from GatekeeperGoogle as this becomes just one more way for that corporaiton to scrape private information about users to add to the dossier that that privacy-invading corporaton compiles for each IP.