search

aryehraber / statamic-captcha

Statamic Addon that protects your Statamic forms using a Captcha service.
MIT License
11 stars 8 forks source link

Recaptcha V3? #4

Closed gofish543 closed 3 years ago

gofish543 commented 3 years ago

Does this plugin support recaptcha v3?

aryehraber commented 3 years ago

Hey @gofish543, thanks for opening up this issue — someone else asked this earlier in the previous version of this addon for Statamic 2: https://github.com/aryehraber/statamic-recaptcha/issues/5

I am honestly not sure/convinced that Recaptcha V3 is useful, or even possible, as an easy-to-use captcha system for Statamic, but am curious to hear about other people's use cases/ideas... I asked a series of Qs in the earlier GH issue, but will copy those here and hope you (and others) can chime on the issue. Thanks!

Basically, what is it about Recaptcha V3 that you are waiting for that V2 can't already do?

In my research so far it seems like it's a worse experience on both sides (users and admins) for regular websites, depending on implementation:

  1. The user's submission is blocked because they were marked "risky" by Google and their score is below the allowed threshold. This would mean they literally can't submit the form, or it silently fails and submissions never arrive in an admin's inbox.

  2. We store all "risky" submissions in a spam folder and stop auto-emails from being triggered, but now the burden is put on the admin to go and check spam everyday and mark Google's incorrect "risky" submissions as not spam (triggering auto-emails, etc). Also worth noting that Statamic doesn't natively support a spam folder so this solution would be a much larger undertaking since that needs to be built and integrated, instead of the current solution which simply makes use of existing core features.

I can see V3's usefulness in larger applications where the score can lead users to an additional security flow before being allowed to take a certain action, but I just don't see that being a good solution for normal forms on a regular website.

To reiterate, I'm completely open to the idea but am currently not convinced about it in a Statamic context. For more complex Statamic projects it could be useful, but at that stage you probably want to control the actions that are taken for low/high scores meaning a generic solution like this addon wouldn't really be possible/useful.

Please share your ideas and vision for use cases, I'll happily change my mind!

gofish543 commented 3 years ago

I'm not convinced Recaptcha V3 is useful either. However, I was asked by my manager to add recaptcha to some Statamic forms; upon showing them the results they were disappointed to see that it wasn't Recaptcha V3. Why? Because the captcha wasn't "invisible". Does this singular item really necessitate v3? Probably not.

Personally, I'm against the invisible recaptcha for the same reasons you are and prefer v2.

aryehraber commented 3 years ago

Right ok, fair enough, thanks for sharing!

For now, I do not have plans (or time) to add support for Recaptcha V3 but am open to further discussion from others who are able to answer some of the key questions in my above comment — will leave this issue open for the time being.