Recaptcha: reCaptcha seems to loop indefinitely when third party cookies are disabled

[raphj]

Issue description

I'm one element of the gigantic set of users of the Web hindered by reCaptcha's existance. Also see issue #286. Google does not have any easy way of submitting bugs for their products as someone suffering collateral damages because of people picking them so here it is.

reCaptcha seems to loop indefinitely when third party cookies are disabled and trackers are blocked.

Environment

I don't use recaptcha as a developer myself.

Reproducing the issue

Disable third-party cookies in your browser and try passing reCaptcha's maddening traffic lights and front stores.

Additionally, add ".google." as a blocking rule in uBlock Origin (on Firefox) to be sure to reproduce my setup with high precision, and block any kind of trackers with privacy lists.

Expected Behavior

reCaptcha should at least tell the user to get lost when something obviously does not work as expected instead of letting them die before an endless stream of front stores and traffic lights in the cold.

[pshah123]

I'm experiencing the same issue. Also, this seems to be expected behaviour, as they'll just allow me to solve 12-15 captchas before saying "Something went wrong" every single time. I'm pretty sure they're just using this as a training loop. There doesn't seem to be any workaround if you don't want to share browsing activity with Google, and surprisingly since the data they forcibly collect is not PII they're allowed to block content indefinitely/have you solve their captchas indefinitely.

I doubt you'll get a reply since @rowan-m in the other thread marked this with a pseudo-WONTFIX:

This repo is for the client code for developer that need to verify their response to the API. I understand that the challenges can be frustrating. You might want to consider contacting the sites where you're experiencing this to advise them to update to the v3 version of the service which presents a confidence score rather than blocking with a challenge.

For what it's worth, as a web developer who would like to add captcha to my technology, it's an enormous antipattern for recaptcha to fail quietly and not provide any user feedback as to the failure so that they can adjust. This is not made clear by error messages provided either.

[grahamperrin]

… an enormous antipattern for recaptcha to fail quietly and not provide any user feedback as to the failure so that they can adjust. This is not made clear by error messages provided either.

+1

The lack of clarity can be hugely frustrating for end users and a big waste of time for support staff.

[grahamperrin]

https://github.com/google/recaptcha/issues/155#issuecomment-409589834:

This isn't directly related to the PHP code which is what this repo focuses on. However, …

[vertigo220]

Been posting in another issue, not directly related to this, but definitely part of the annoyance that is reCaptcha. While the cookie situation is likely partially innocent, i.e. a way to have a good idea of whether a "user" is a human or a bot, I'm convinced it's also at least partially designed to force Google cookies on systems regardless of other settings (blocking 3rd-party cookies, deleting Google cookies, etc) in order to prevent the massive time waste of having to do captchas all the time, and spend 3+ minutes on them each time. I'm also convinced they are, both in general and especially in these cases, using people to train their systems. Anyways, as discussed in the other issue, I have serious concerns about v3, and suspect it will be even worse than v2, since it will quite likely simply block people instead of offering them the ability to prove they're human (even if that does take FAR longer than it should and still often fail). And it seems to me the requirement for users to have Google cookies on their systems just to use a number of unrelated sites, not to mention the fact said cookies aren't even disclosed, is in violation of GDPR and possibly (though, sadly, unlikely) FTC rules.

[hellimod]

I would recommend the project be canceled. This kind of poorly coded application with google sponsorship can cause real damage to the internet as a whole.

[theAntiBob]

I really didn't anticipate having my (limited) time wasted by an unquestionably inappropriate neglect to ask my permission before being used to unnecessarily retrain (detrain, in my opinion) proprietary routines under the guise of humanoidal verification as an assumedly independent 3rd party service.

I seriously doubt the quality of data being collected on frustrated and confused (unwitting unwilling and unconsenting) users could be useful for anything other than anticipating patience loss thresholds. Nice work, gladOS.

Comments like:
"...waste of time for support staff"
"aren't even disclosed, is in violation of GDPR and possibly (though, sadly, unlikely) FTC rules"
and "poorly coded application with google sponsorship can cause real damage to the internet as a whole"
are incredibly valid with this type of violation of trust and are, unfortunately, too rarely voiced by the supposed "consentee"

due to an obvious gap in the current levels of technical capability posessed by end users, a clear and valid disclaimer is obviously needed to avoid having the term "intentional misleading" be so applicable to this behavior as well.

[danhash]

When trying to log in to JimmyJohns.com, which uses reCAPTCHA, with third-party cookies disabled in Firefox, clicking Login does nothing. As soon as I enable third-party cookies, clicking Login works. I've already reported this issue to Jimmy John's, who will likely do nothing, but the real culprit is Google's reCAPTCHA requiring third-party cookies. This dependency needs to be removed.

[efimBistrov]

When this bug will be fixed?

[grahamperrin]

Firefox

If I recall correctly, there's no problem with enhanced tracking protection at its _Standard_ level.

Don't prefer the _Strict_ level unless you're prepared to deal with some breakage; this may include reCaptcha functionality.

There's a forewarning:

(I do prefer the strictness.)

[raphj]

Strict privacy / anti-tracking settings should not prevent people from accessing websites, especially because of a CAPTCHA technology. Telling computers and humans apart certainly does not require tracking.