force captcha challenge

[Hidde Kat]

Is there a way to force users to fill in a captcha challenge?
Is there a way to see if users got an "I am not robot" check box or a captcha?
Is there a way to see how many times a user failed the captcha challenge before they passed?

I would like to use re-captcha on my website, and only challenge users of which i already established they might be using automation scripts.
Unfortunately, Google will not be able to know this, if they only use automated scripts (for example imacros) on my website only. Bots or spiders are not the problem here, i'm dealing with registrered users which I don't want to bother with a captcha, unless necessary.

I've been able to automate re captcha myself before using Imacro's and a captcha solving service and just got the "I am not robot" check box even more often compared to filling it in by hand, so I would prefer it not to show up at all, so I can monitor the time a user needs to complete it, among other things, to filter out these captcha solving services and imacro's, which are mostly used.


So what other info can I get from Google Re-captcha, except a 'passed: true or false'?

[Seth Munroe]

When you implement reCAPTCHA, you get access to analytic information about daily activity. You only get to look at the last 7 days though.

Here's what the stats look like:

As far as deciding to not display a reCAPTCHA at all under certain conditions, that would have to be handled completely by your own code. There's no way that the API could handle that. You could design your pages so that you only render the html to display the reCAPTCHA when certain conditions are met or not met, but that's not really something that someone could tell you how to do without designing your site's page flow.

-Seth

[Hidde Kat]

I understand that I need to write my own code for this, however I would like to make sure someone really gets a captcha (and not a checkbox).

These statistics are very useless in my opinion, just a fun fact. Is there a way to track an individual user? If this would be the case, I would be able to give them more captcha's in case they only get a checkbox (which is not necessary if I could force re-captcha to not show this checkbox at all)

[Seth Munroe]

The point of the version 2 reCAPTCHA is to let google's evaluation decide whether there is enough information about the user to give a simple checkbox or if their activity either isn't proven or appears to be somewhat bot-ish. Google decides how complicated a captcha the user warrants. You as the implementer have no control at all over what type of challenge the user is presented with. You also have no way of knowing what type of challenge they passed.

As far as an individual user goes, you could keep track of times the user passed or failed when you do your validation of the token. You could use that information to decide whether or not the user needs to go through your reCAPTCHA. But you won't be able to know how difficult the reCAPTCHA was that they had to pass.

-Seth

[Hidde Kat]

Unfortunately that makes google recaptcha totally useless for my project :(
Guess it is a nice solution to stop spambots, but far to basic to implement it in a more complicated project. Too bad, because it's hard to automate it with software and would have been a nice captcha otherwise.

Op donderdag 22 september 2016 05:15:36 UTC+2 schreef Seth Munroe:

[kevin....@ccc.govt.nz]

I get that the point is for Google captcha to be less of a PITA in service but as a tester I need to be able to test what it is like for a user the first time they get presented with it. How can I force a full challenge when I need a full challenge. Google has decided it trusts my devices sufficiently that it never asks anymore.