Jumping reCAPTCHA dialog bug

[Jason Beaird]

I've seen this reported for our signup forms a few times and was finally able to reproduce it. 

If a challenge dialog appears when checking the reCAPTCHA box, it is placed below the reCAPTCHA box. If that placement extends below the bottom of the window, the script moves it to the top of the screen. This triggers a page resize that causes reCAPTCHA to attempt placing it below again...and the cycle continues. 

It happens in multiple browsers, but here's a screencap from IE11: http://cl.ly/0X0k1L1h3C1J

[reCAPTCHA Support]

Hi Jason

Thanks for your report.

Would you please try our public demo under the same environment? 

http://www.google.com/recaptcha/api2/demo

If it's not reproducible, probably it was due to the specific implementation of mailchimp.com. 

[Jason Beaird]

Hey reCAPTCHA team,

Thanks for the quick reply. The difference in MailChimp’s implementation is that our subscribe forms are centered with margin:0 auto, which is a pretty common convention. If I set the .sample-form div on http://www.google.com/recaptcha/api2/demo

 to margin:0 auto, I can get the same behavior as long as the page height is close to where the bottom of the dialog hits. Here’s a screencap showing this in Safari:

http://cl.ly/image/3Q0A1S1Z3k3v

Hope that helps and we’re huge fans of reCAPTCHA V2 here at MailChimp.

[bgrantland]

I have had that problem too, periodically. I'm not convinced it is caused by the page height, because I haven't changed the page height and it happens very sporadically.  It had been months since it last happened.  I was having trouble with it last night.  I failed the test because it was so hard -- a blurry picture that was hard to tell a street name sign from some other kind of sign.  I had to retake the test and it was just as difficult. When I failed it again it started jumping around.  I managed to click the report image link (a very difficult thing to do even for humans with it jumping around) and the jumping stopped. It isn't jumping around any more.

I think this is an intentional security feature built into the Recaptcha. Google's online security blog says that Recaptcha 2.0 uses advanced technology to add additional challenges to the test if it is having difficulty determining if you are a bot or not.  My sites have been bombarded by bots trying to register for the past couple of months, which probably led to Google piling on the additional tests.  I have installed additional web security, but I'm glad Recaptcha has this feature.