Upgrade to recaptach v2

[SirVer]

I got a nag mail from google saying that we must update to recaptcha v2. The porting guide is somewhere at [2] or [3].

The new captchas are much better actually - no more typing of stupid text.

[1] http://googleonlinesecurity.blogspot.de/2014/12/are-you-robot-introducing-no-captcha.html
[2] https://www.google.com/recaptcha/intro/index.html
[3] https://developers.google.com/recaptcha/intro

[kaputtnik (franku)]

I will take a look at this...

[kaputtnik (franku)]

Just a reminder:

Testsite to see how it looks like: https://www.google.com/recaptcha/api2/demo
We need a new key/secret-key pair: https://developers.google.com/recaptcha/docs/faq#im-using-the-recaptcha-v1-now-how-do-i-upgrade-to-v2

[kaputtnik (franku)]

I am quite busy with normal work, so it could take some time to solve this (two weeks i think). If someone else get a solution earlier please tell it here.

[kaputtnik (franku)]

Forgotten possibly solution(s): http://stackoverflow.com/questions/29548574/how-to-validate-google-recaptcha-v2-in-django

[kaputtnik (franku)]

I have it half to run.... there are some failures:

1. The normal functionality with the small "i am no robot" button (like in the demo) does not work on widelands.org. So we have to use the fallback mode... this is much ugly as the demo :-§ In fallback mode the window with the food/whatever is shown directly and the user has to mark the solutions. After clicking on "confirm" a window with a long string is displayed which has to be copied in a text field. After that the user could "send" the account request.

2. Currently the return value from google is always "success = True". Because i am not the only one who has this problem it may be a problem from google...

I am currently using the test values from google for the "secret key" and "site key".

I am wiling to provide a branch if i made some cleanups and further tests.

[SirVer (sirver)]

Why is the "I am not a robot" not working on Widelands.org?

[kaputtnik (franku)]

I don't know. If i use the normal code and click on "I am not a robot" something is happen, but there is no popup window which shows the food pictures. If i wait until the timeout is gone ( 2 minutes i think) the whole process is reloaded and after that clicking on "i am not a robot" works (the "food" popup appears).

I think the description (https://developers.google.com/recaptcha/docs/display) is updated and i will make some more tests. Or should we use the third party app described in http://stackoverflow.com/questions/29548574/how-to-validate-google-recaptcha-v2-in-django?answertab=votes#tab-top ?

Personal i would like to understand the code and write our own code. But this would take some time (for me).

[kaputtnik (franku)]

I tested now the explicit displaying of the boxes (Seehttps://developers.google.com/recaptcha/docs/display#explicit_render). The result is the same: "If i click on I am no robot" no popup appears. The reason for that are malformed values for "left" and "top". By clicking on "i am no robot" the html get following code added:

  <div style="display: block; visibility: hidden; position: absolute; width: 106px; left: -10000px; top: -10000px;">
    <table dir="ltr" style="width:106px;" frame="void" rules="none" class=" gc-bubbleDefault pls-container" cellpadding="0" cellspacing="0">
    </table>
  </div>

Pay attention on the wrong "left" and "top" values which are "-10000px". After waiting until the captcha is reloaded and clicking again on "i am no robot" the values gets right:

  <div style="display: block; visibility: visible; position: absolute; width: 414px; left: 226px; top: 295px; height: 618px; z-index: 2000000001;">
      <table dir="ltr" style="width: 414px; height: 618px;" frame="void" rules="none" class=" gc-bubbleDefault pls-container" cellpadding="0" cellspacing="0">
      </table>
  </div>

In addition by the second click the html gets additional code:

  <ins style="position: absolute ! important; background-color: transparent ! important; left: 198px ! important; top: 388.767px ! important; width: 28px ! important; height: 28px ! important; z-index: -10000 ! important; display: none ! important;"></ins>

I don't know why google calculates the wrong values and why the additional code isn't loaded at first time.

[SirVer (sirver)]

Have you tried opening a bug on them?

[kaputtnik (franku)]

I don't know where to put bug reports (didn't found any link) except the discussion group: https://groups.google.com/forum/#!forum/recaptcha

And this discussion group seems not very serious. All together the code and the presentation "feels" not very serious. But my personal "feeling" is surely reasoned because i don't like google very much.

I've made a branch with my last state of tests: https://code.launchpad.net/~franku/widelands-website/new_captcha_test

Don't know where to put comments in there.... I leave many print statements, maybe they help to find failures.

Currently i didn't want to work further on this so i removed me from the assignee.Sorry, but this is to hard for me... A company i do not trust, a bad description and javascript code which refers to all google services. I am really sorry....

Is there no other possibility to reject spammers from the website? Something like honeypots or other (additional) possibilty(s)?

[SirVer (sirver)]

Don't worry and thanks for looking into that. It should also be enjoyable and to a chore to work on Widelands. Maybe somebody else can pick up where you left off.

> Currently i didn't want to work further on this so i removed me from the assignee.Sorry, but this is to hard for me... A company i do not trust, a bad description and javascript code which refers to all google services. I am really sorry....

Not sure if you knew, but I am employed by Google. And I must say that it is the most ethical place I ever worked before. Everybody always tries to do the right thing, from engineering to upper management.

> Is there no other possibility to reject spammers from the website? Something like honeypots or other (additional) possibilty(s)?

I do not know about other possibilities. Captcha was a transformative change for the Website: We had many bots spamming daily before establishing that sign up requires a captcha. Now the only spammers on the site are from sweatshops and actual humans. I doubt that you can do better than that, but if you have any suggestions we can certainly try them.

[kaputtnik (franku)]

I can't help doing it :-D I will ask in the discussion group... meanwhile i tested the third party app linked in #4 but it do not work because our django version is too old. It needs features from later django versions. We should really take a look on updating django.