w3c / apa

APA WG deliverables have been moved to individual repositories
Other
47 stars 38 forks source link

Description of Google recaptcha v3 fallback #11

Closed sophieschuermans closed 2 years ago

sophieschuermans commented 5 years ago

About Google recaptcha v3, the article states :

However, as the failure fallback remains the presentation of a traditional CAPTCHA, it remains imperative to do better by users who require alternative CAPTCHA options as also enumerated here.

After reading Googles documentation about recaptcha v3, I think that it is not entirely correct to say 'the failure fallback remains the presentation of a traditional CAPTCHA'. I understand that recaptcha v3 only sends a score back. It is up to the developer to decide what action to implement in case the score is under a certain threshold. So my impression is that this solution gives the freedom and the responsibility to the developer using this captcha to choose en accessible fallback.

JaninaSajka commented 5 years ago

Hi, Aaron:

I'm really glad to hear from you on our wide review draft. We were actually planning to ask our W3C colleagues from Google for your contact info because we are certainly concerned to be accurate in our Note. So, very glad to have your review.

In fact this issue has already been mentioned to us: https://github.com/w3c/apa/issues/11

We are editing by creating branches on rawgit around the several issues raised on our wide-review draft. For reCAPTCHA we have:

https://raw.githack.com/w3c/apa/recaptcha-captcha/captcha/index.html

We'll happily accept your edits there--or I can take another stab based on your email. Either way is fine.

Thank you for your review. It's very much appreciated.

Best,

Janina

Aaron Malenfant writes:

Hi Janina,

I just received this draft. I am the lead engineer for reCAPTCHA for Google and wanted to correct something in reCAPTCHA section before it is published. How can I best provide this feedback?

Specifically:

Late in 2018 Google released reCAPTCHA V3 https://webmasters.googleblog.com/2018/10/introducing-recaptcha-v3-new-way-to.html promissing to eliminate "the need to interrupt users with challenges at all." Obviously, this would be ideal, and we believe Google has adopted several strategies recommended here toward achieving that goal. However, as the failure fallback remains the presentation of a traditional CAPTCHA, it remains imperative to do better by users who require alternative CAPTCHA options as also enumerated here.

reCAPTCHA v3 https://developers.google.com/recaptcha/docs/v3 never presents a traditional CAPTCHA. We ask that sites use a secondary challenge that makes sense in the context of their site such as two-factor authentication, send the post to moderators, or combine the score with signals specific to their site to make a more informed judgement. The version that has a fallback is called reCAPTCHA v2 Invisible https://developers.google.com/recaptcha/docs/invisible and was released in 2017. One of the goals of reCAPTCHA v3 was to increase the accessibility of the web by removing traditional CAPTCHAs.

Thanks, Aaron

---------- Forwarded message --------- From: Shawn Lauriat lauriat@google.com Date: Fri, Feb 15, 2019 at 10:58 AM Subject: Re: FW: Updated "Inaccessibility of CAPTCHA" draft published for wide review To: Loretta Guarino Reid lorettaguarino@google.com Cc: Aaron Malenfant amalenfant@google.com, Liat Kaver lkaver@google.com, Cy Khormaee cyk@google.com, yt-caps-team yt-caps-team@google.com

I represent Google in the different, but similarly titled Accessibility Guidelines Working Group, rather than the Accessible Platform Architectures Working Group.

Aaron: This email thread has the entirety of the information I know about this. :-) You could try reaching out to Janina, who sent out the original email requesting comments, to see how best to offer that kind of feedback? I know that working groups tend to want to keep feedback all funneled through the same mechanism, but it can't hurt to ask.

Thanks,

Shawn

-----Original Message----- From: Janina Sajka janina@rednote.net Sent: 14 February 2019 19:26 To: public-wai-announce@w3.org Cc: W3C WAI Accessible Platform Architectures public-apa@w3.org; public-rqtf@w3.org; public-wai-cc@w3.org Subject: Updated "Inaccessibility of CAPTCHA" draft published for wide review

Dear Colleagues:

The Accessible Platform Architectures (APA) Working Group, with the strong assistance of its Research Questions Task Force (RQTF) has published an updated draft of "Inaccessibility of CAPTCHA." This newly revised and updated draft is available here:

https://www.w3.org/TR/2019/WD-turingtest-20190214/

We request wide review of this draft by 24 March. If reviewer comments indicate there are still issues with this draft, we will continue editing. On the other hand, if we have sufficiently addressed current issues with CAPTCHA related approaches used on the web today in the view of the preponderance of our reviewers, we will proceed to release this draft as Version 2.0 of a document first published as a W3C Note in 2005. It is for this reason that we ask you to read this document carefully and respond with your view by 24March.

Further details about this publication, including specific questions we would like reviewers to address, together with instructions for responding are provided in a blog post available here:

https://www.w3.org/blog/2019/02/captcha-accessibility-wide-review/

Please feel free to circulate this request and our draft widely.

Thanking you in advance for your time and consideration on behalf of RQTF and APA,

Janina Sajka, APA Chair

--

Janina Sajka

Linux Foundation Fellow Executive Chair, Accessibility Workgroup: http://a11y.org

The World Wide Web Consortium (W3C), Web Accessibility Initiative (WAI) Chair, Accessible Platform Architectures http://www.w3.org/wai/apa

--

Janina Sajka

Linux Foundation Fellow Executive Chair, Accessibility Workgroup: http://a11y.org

The World Wide Web Consortium (W3C), Web Accessibility Initiative (WAI) Chair, Accessible Platform Architectures http://www.w3.org/wai/apa

JaninaSajka commented 5 years ago

To Aaron

Thanks for your response on reCAPTCHA V3. Just a quick question. When you say 'we ask developers...' does this mean that it's mandatory that developers can't fall back to a traditional CAPTCHA, or that it's Google's position that they shouldn't do so? The reason I ask is that I've received conflicting accounts on recache V3 whereby developers are still able to use a traditional CAPTCHA as a fallback mechanism. if this is not the case that'd be great, but would be good to clarify if there's anything in place to ensure that your alternatives are being used.

Scott.

Dr Scott Hollier Digital Access Specialist Mobile: +61 (0)430 351 909 Web: www.hollier.info   Technology for everyone   Looking to upskill your staff with digital access training? Fill the room for one flat fee.   Keep up with digital access news by following @scotthollier on Twitter and subscribing to Scott's newsletter.

-----Original Message----- From: Janina Sajka janina@rednote.net Sent: Tuesday, 12 March 2019 6:57 AM To: Aaron Malenfant amalenfant@google.com Cc: Aaron Stein steina@google.com; public-rqtf@w3.org; reply@reply.github.com Subject: Re: FW: Updated "Inaccessibility of CAPTCHA" draft published for wide review

Hi, Aaron:

I'm really glad to hear from you on our wide review draft. We were actually planning to ask our W3C colleagues from Google for your contact info because we are certainly concerned to be accurate in our Note. So, very glad to have your review.

In fact this issue has already been mentioned to us: https://github.com/w3c/apa/issues/11

We are editing by creating branches on rawgit around the several issues raised on our wide-review draft. For reCAPTCHA we have:

https://raw.githack.com/w3c/apa/recaptcha-captcha/captcha/index.html

We'll happily accept your edits there--or I can take another stab based on your email. Either way is fine.

Thank you for your review. It's very much appreciated.

Best,

Janina

Aaron Malenfant writes:

Hi Janina,

I just received this draft. I am the lead engineer for reCAPTCHA for Google and wanted to correct something in reCAPTCHA section before it is published. How can I best provide this feedback?

Specifically:

Late in 2018 Google released reCAPTCHA V3 https://webmasters.googleblog.com/2018/10/introducing-recaptcha-v3-ne w-way-to.html promissing to eliminate "the need to interrupt users with challenges at all." Obviously, this would be ideal, and we believe Google has adopted several strategies recommended here toward achieving that goal. However, as the failure fallback remains the presentation of a traditional CAPTCHA, it remains imperative to do better by users who require alternative CAPTCHA options as also enumerated here.

reCAPTCHA v3 https://developers.google.com/recaptcha/docs/v3 never presents a traditional CAPTCHA. We ask that sites use a secondary challenge that makes sense in the context of their site such as two-factor authentication, send the post to moderators, or combine the score with signals specific to their site to make a more informed judgement. The version that has a fallback is called reCAPTCHA v2 Invisible https://developers.google.com/recaptcha/docs/invisible and was released in 2017. One of the goals of reCAPTCHA v3 was to increase the accessibility of the web by removing traditional CAPTCHAs.

Thanks, Aaron

---------- Forwarded message --------- From: Shawn Lauriat lauriat@google.com Date: Fri, Feb 15, 2019 at 10:58 AM Subject: Re: FW: Updated "Inaccessibility of CAPTCHA" draft published for wide review To: Loretta Guarino Reid lorettaguarino@google.com Cc: Aaron Malenfant amalenfant@google.com, Liat Kaver lkaver@google.com, Cy Khormaee cyk@google.com, yt-caps-team yt-caps-team@google.com

I represent Google in the different, but similarly titled Accessibility Guidelines Working Group, rather than the Accessible Platform Architectures Working Group.

Aaron: This email thread has the entirety of the information I know about this. :-) You could try reaching out to Janina, who sent out the original email requesting comments, to see how best to offer that kind of feedback? I know that working groups tend to want to keep feedback all funneled through the same mechanism, but it can't hurt to ask.

Thanks,

Shawn

-----Original Message----- From: Janina Sajka janina@rednote.net Sent: 14 February 2019 19:26 To: public-wai-announce@w3.org Cc: W3C WAI Accessible Platform Architectures public-apa@w3.org; public-rqtf@w3.org; public-wai-cc@w3.org Subject: Updated "Inaccessibility of CAPTCHA" draft published for wide review

Dear Colleagues:

The Accessible Platform Architectures (APA) Working Group, with the strong assistance of its Research Questions Task Force (RQTF) has published an updated draft of "Inaccessibility of CAPTCHA." This newly revised and updated draft is available here:

https://www.w3.org/TR/2019/WD-turingtest-20190214/

We request wide review of this draft by 24 March. If reviewer comments indicate there are still issues with this draft, we will continue editing. On the other hand, if we have sufficiently addressed current issues with CAPTCHA related approaches used on the web today in the view of the preponderance of our reviewers, we will proceed to release this draft as Version 2.0 of a document first published as a W3C Note in 2005. It is for this reason that we ask you to read this document carefully and respond with your view by 24March.

Further details about this publication, including specific questions we would like reviewers to address, together with instructions for responding are provided in a blog post available here:

https://www.w3.org/blog/2019/02/captcha-accessibility-wide-revie w/

Please feel free to circulate this request and our draft widely.

Thanking you in advance for your time and consideration on behalf of RQTF and APA,

Janina Sajka, APA Chair

--

Janina Sajka

Linux Foundation Fellow Executive Chair, Accessibility Workgroup: http://a11y.org

The World Wide Web Consortium (W3C), Web Accessibility Initiative (WAI) Chair, Accessible Platform Architectures http://www.w3.org/wai/apa

--

Janina Sajka

Linux Foundation Fellow Executive Chair, Accessibility Workgroup: http://a11y.org

The World Wide Web Consortium (W3C), Web Accessibility Initiative (WAI) Chair, Accessible Platform Architectures http://www.w3.org/wai/apa