[4.0b1] Currently ships with reCAPTCHA v2 - reCAPTCHA v3 is now available and the future

joomla / joomla-cms

Home of the Joomla! Content Management System

https://www.joomla.org

GNU General Public License v2.0

4.73k stars 3.64k forks source link

[4.0b1] Currently ships with reCAPTCHA v2 - reCAPTCHA v3 is now available and the future #29336

Closed PhilETaylor closed 4 years ago

PhilETaylor commented 4 years ago

see: https://developers.google.com/recaptcha/docs/v3

Maybe consider a v3 plugin? or move Joomla 4 to reCAPTCHA v3 exclusively?

Just a thought

brianteeman commented 4 years ago

reCaptcha v3 is a completely different beast and is not a drop in replacement

https://developers.google.com/recaptcha/docs/versions

PhilETaylor commented 4 years ago

Correct. It would be a great thing for Joomla 4 to have.

brianteeman commented 4 years ago

That's your opinion and as a developer you are more than able to submit a pull request to add it

PhilETaylor commented 4 years ago

Opinions have nothing to do with it. This is not about me. Yes I could submit a pull request and waste more of my time. But I will not be. Please refrain from commenting on my issues if you are just going to make it personal.

brianteeman commented 4 years ago

Nothing personal but I fail to see why you are so entitled that you expect others to jump at your suggestions and yet refuse outright to make any contribution yourself. I guess nothing has changed

PhilETaylor commented 4 years ago

I EXPECT NOTHING but abuse when I post here.

I am not entitled and I am not expecting anything. This is a RFC and you have made your comment, which is YOUR opinion. You dont speak for the project. The decision is not yours. You are just one voice.

I have not demanded or expected others to jump at my suggestion - its just a comment, in a public tracker, to gauge interest, and spark a conversation.

If the project is not interested then that's cool - there is a close button and the issue can be closed.

Just because Im a professional developer working full time as a developer doesn't mean I must contribute CODE to a project because that's the only contribution YOU would consider worthy or accept. Why do you feel so entitled to demand code from people all the time - pot kettle black.

Testing is contribution.

Commenting is contribution.

Engaging is contribution.

Im sorry that you fail to see my contribution, on this account or the multiple aliases I need to use on Github to protect myself from your continued abuse.

Nothing has changed. You still attack me for contributing or not.

Reported and Blocked once again.

conconnl commented 4 years ago

Phil is right about ReCaptcha!

We already have multiple discussions about this for our own websites (.org family) V2 (Normally or Invisible) is not stable anymore. We need to move forward to have a stable ReCaptcha future. If that means Google ReCaptcha V3, hcaptcha or whatever. There is something needed else we even need to switch ourselves to a different solution.

@zero-24 & @SniperSister can you please share your vision!

PhilETaylor commented 4 years ago

Thanks, but to be clear, it was never about being "right" or wrong :) its about progress, stability way into the future, and being ahead of the curve instead of releasing something and having to support it for the next 15 years :)

To quote google in 2019:

reCAPTCHA v2 is not going away! We will continue to fully support and improve security and usability for v2.

reCAPTCHA v3 is intended for power users, site owners that want more data about their traffic, and for use cases in which it is not appropriate to show a challenge to the user.

For example, a registration page might still use reCAPTCHA v2 for a higher-friction challenge, whereas more common actions like sign-in, searches, comments, or voting might use reCAPTCHA v3

Now that you have mentioned hCaptcha, that could also be something for the Joomla Project to think about - pre ship it with Joomla's API Keys (even see if hCaptcha want to partner with the project?) and sit back and see the FINANCIAL gain to the project by the displaying of captcha's on the millions of Joomla sites... again, just a thought, a comment, Im not demanding or expecting anything, just expressing a thought.

alikon commented 4 years ago

see #28798

conconnl commented 4 years ago

Thanks @alikon for sharing useful information. Seems we have progress to follow and help testing.

brianteeman commented 4 years ago

recaptcha 3 is not a drop in replacement it is a completely different thing as can be seen from their documentation

PhilETaylor commented 4 years ago

recaptcha 3 is not a drop in replacement it is a completely different thing as can be seen from their documentation

Correct. You have said that twice now. No one has said otherwise or disagreed with you.

I fully understand what reCapture v3 is and have deployed it on many production services, applications and websites to great effect. It is a different way of approaching bad actors and will allow more than just "form protection"

No one has suggested "replacing" recaptcha v2 plugin. Even google say v2 will be around for a while yet.

I simply asked:

Maybe consider a v3 plugin? or move Joomla 4 to reCAPTCHA v3 exclusively?

Two questions, to gather other peoples thoughts on the subject.

If there is a better way of gathering the consensus opinion on a future development idea then Im all ears, but I thought this was the place to discuss ideas as well as log issues. Thats certainly what others have been allowed to do.

I maintain my position that reCaptcha v3 would be a great feature for Joomla 4 to have.

Im not demanding Joomla 4 has it.

Rather than shooting down an idea, let others have their say.