search

UndefinedOffset / silverstripe-nocaptcha

A spam protector and form field using Google's reCAPTCHA v2 or optionally a foundation v3 implementation
BSD 3-Clause "New" or "Revised" License
31 stars 37 forks source link

Invisible recaptcha v3? #57

Closed guyvanbael closed 4 years ago

guyvanbael commented 4 years ago

Any plans for integrating invisible recaptcha v3?

UndefinedOffset commented 4 years ago

Not at the moment, the main reason being that the v3 recaptcha requires allot of per-site actions and a decision by the developer whether a score is good enough or not, it's much more per-site context than just putting a captcha into a form.

Have a look at @chillu's comment here for more context. He does his usual great summing up of the issues and I fully agree with his rational. As he mentions "the v3 API just allows you to send "actions" such as "submitting contact form", and you get back a score. If that score indicates a bot, it's up to site devs to make the next step: There is no built-in explicit verification. Since this module doesn't know anything about the site context, e.g. to trigger a login or MFA, or is designed to record other user actions (separate from form submissions).". The same would apply here unfortunately.