Captcha not verified, am I a robot?

<baris>

We are looking into this, thanks for reporting.

julian

We've rushed out a fix

We also use hCaptcha here, not reCAPTCHA

gotwf

@julian Only now it is enforced. Some security necessity? While hCaptcha is preferable to reCapcha I am opposed to third party scripts in general.

julian

No, there's no security necessity, hCaptcha used to just be applied on registration, but while I was there fixing the plugin I added it to the login pages as well. It was to mimic how reCAPTCHA (in the same plugin) protects the login page as well.

gotwf

So if I understand correctly:

Not security related.
But yet there seems to be some need to "protect the login page".
So I need to tell my browser to allow yet one more 3rd party script that you may trust but I may not.
And then I need to engage in bunches of time consuming selecting this image and that and the other image clickery every time I login?

I do not use any of the big "social media" whizzbang thangs and may be 'out of touch' but this seems rather intrusive. Is this the new normal?

omega

It is... it's everywhere.

phenomlab

@gotwf said in Captcha not verified, am I a robot?:

I do not use any of the big "social media" whizzbang thangs and may be 'out of touch' but this seems rather intrusive. Is this the new normal?

hCaptcha respects privacy, unlike reCaptcha. Admittedly, it's another script, yes, but it's for the right reasons.

julian

@gotwf said in Captcha not verified, am I a robot?:

And then I need to engage in bunches of time consuming selecting this image and that and the other image clickery every time I login?

Well there's a good point you raise here... do we need to show the challenge to everyone.

There is an "invisible" mode that we could use for logins... https://docs.hcaptcha.com/invisible/

However this would still go against your desire to limit the scripts used on the site. As to whether that's acceptable... you'll have to make that determination on your own

julian

Update: Oops, looks like I need an enterprise account to enable passive/invisible mode. I've sent them a contact request, we'll see where this goes.

<baris>

Haha I have to admit it is a bit annoying, especially when getting to the admin page forces a relogin

julian

@baris @gotwf the fine folks at hCaptcha allowed us to try out the Pro plan so we can update the plugin and implement invisible/passive mode if the key supports it

<baris>

Thank god, I was tired of finding cupcakes and hats all week