search

mozilla / donate.mozilla.org

Mozilla donation platform
https://donate.mozilla.org
Mozilla Public License 2.0
62 stars 47 forks source link

Release reCaptcha thoughts and checklist #1978

Open ScottDowne opened 6 years ago

ScottDowne commented 6 years ago

Some open questions I have, things I want to QA, or things I want people to starting thinking about before we can release the code I have here: https://github.com/mozilla/donate.mozilla.org/pull/1972

  1. How do we want to ensure it's working.
  2. How do we want to ensure it's not creating false positives.
  3. What happens with ad blockers. Nothing, should work.
  4. What happens on mobile sizes and mobile browsers. I'll spend time testing this today, and file any bugs I find.
  5. How do we want to display our terms and privacy policies around this. Document is here.
  6. How do we want to display reCaptcha's terms and privacy policies around this. Document is here.
ScottDowne commented 6 years ago

cc @cadecairos @stephaniemcv @WillatMozFdn

ScottDowne commented 6 years ago

Shoot, added the wrong name for alan @alanmoo

ScottDowne commented 6 years ago

Also feel free to add to my list.

cadecairos commented 6 years ago

How do we want to ensure it's working. How do we want to ensure it's not creating false positives.

It's going to be hard to measure the bounce rate due to failed Captchas. Is there a way to direct people who're being blocked by reCAPTCHA to our support inbox?

What happens with ad blockers.

I run uBlock Origin, and Google Captchas have never been blocked for me before - Not sure if other popular ad blocking tools would also block it.

How do we want to display our terms and privacy policies around this. How do we want to display reCaptcha's terms and privacy policies around this.

@stephaniemcv has a document with the approved updates to the FAQ and our privacy policy - do you have the link to it?

stephaniemcv commented 6 years ago

Document is here.

alanmoo commented 6 years ago

How do we want to ensure it's working.

Can we...throw a bot at it?

How do we want to ensure it's not creating false positives.

I'm not quite sure I understand what a false positive is in this case. Can you clarify?

What happens on mobile sizes and mobile browsers.

It seems to work, correct?

How do we want to display our terms and privacy policies around this.

Is this a design question or a legal one? @xmatthewx do any designers have some bandwidth to pitch in on this if necessary?

How do we want to display reCaptcha's terms and privacy policies around this.

Presumably with a link to them as a part of ours, but I'd leave that to legal/design.

Edit: it looks like the last 2 questions are answered by the doc Steph linked to, is that right?

ScottDowne commented 6 years ago

How do we want to ensure it's working. How do we want to ensure it's not creating false positives.

It's going to be hard to measure the bounce rate due to failed Captchas. Is there a way to direct people > who're being blocked by reCAPTCHA to our support inbox?

The more I think about false positives, the less I'm concerned about it. My guess is it's actually a pretty big fringe case. I think the worry here is something's not working right and everyone sees the captcha. Which I think if that happens we'll know pretty quick, and if we test this on a low traffic time, the risk is low.

How do we want to ensure it's working.

Can we...throw a bot at it?

I'm thinking not working in the sense of it's not stopping any fraud. Or even more cynical here, not working is Stripe not believing we implemented it, so how do we show them it's there?

alanmoo commented 6 years ago

We can always...send them a link?

xmatthewx commented 6 years ago

Scott, if @beccaklam says she has bandwidth, maybe easiest to sit side by side with her on how to present our terms alongside captcha? If not, let's loop in Kristina.

ScottDowne commented 6 years ago

@xmatthewx @alanmoo I read the doc from legal that steph linked, and it looks we don't need any design here, and are going with the stock recaptcha batch with no allowed customization, it seems. (which makes it super easy :) )