Google introduces reCAPTCHA v3 - the new way to stop bots

[Brink]

Today, we’re excited to introduce reCAPTCHA v3, our newest API that helps you detect abusive traffic on your website without user interaction. Instead of showing a CAPTCHA challenge, reCAPTCHA v3 returns a score so you can choose the most appropriate action for your website.

A Frictionless User Experience

Over the last decade, reCAPTCHA has continuously evolved its technology. In reCAPTCHA v1, every user was asked to pass a challenge by reading distorted text and typing into a box. To improve both user experience and security, we introduced reCAPTCHA v2 and began to use many other signals to determine whether a request came from a human or bot. This enabled reCAPTCHA challenges to move from a dominant to a secondary role in detecting abuse, letting about half of users pass with a single click. Now with reCAPTCHA v3, we are fundamentally changing how sites can test for human vs. bot activities by returning a score to tell you how suspicious an interaction is and eliminating the need to interrupt users with challenges at all. reCAPTCHA v3 runs adaptive risk analysis in the background to alert you of suspicious traffic while letting your human users enjoy a frictionless experience on your site.

More Accurate Bot Detection with "Actions"

In reCAPTCHA v3, we are introducing a new concept called “Action”—a tag that you can use to define the key steps of your user journey and enable reCAPTCHA to run its risk analysis in context. Since reCAPTCHA v3 doesn't interrupt users, we recommend adding reCAPTCHA v3 to multiple pages. In this way, the reCAPTCHA adaptive risk analysis engine can identify the pattern of attackers more accurately by looking at the activities across different pages on your website. In the reCAPTCHA admin console, you can get a full overview of reCAPTCHA score distribution and a breakdown for the stats of the top 10 actions on your site, to help you identify which exact pages are being targeted by bots and how suspicious the traffic was on those pages.





Fighting Bots Your Way

Another big benefit that you’ll get from reCAPTCHA v3 is the flexibility to prevent spam and abuse in the way that best fits your website. Previously, the reCAPTCHA system mostly decided when and what CAPTCHAs to serve to users, leaving you with limited influence over your website’s user experience. Now, reCAPTCHA v3 will provide you with a score that tells you how suspicious an interaction is. There are three potential ways you can use the score. First, you can set a threshold that determines when a user is let through or when further verification needs to be done, for example, using two-factor authentication and phone verification. Second, you can combine the score with your own signals that reCAPTCHA can’t access—such as user profiles or transaction histories. Third, you can use the reCAPTCHA score as one of the signals to train your machine learning model to fight abuse. By providing you with these new ways to customize the actions that occur for different types of traffic, this new version lets you protect your site against bots and improve your user experience based on your website’s specific needs.

In short, reCAPTCHA v3 helps to protect your sites without user friction and gives you more power to decide what to do in risky situations. As always, we are working every day to stay ahead of attackers and keep the Internet easy and safe to use (except for bots).

Ready to get started with reCAPTCHA v3? Visit our developer site for more details.

Source: Official Google Webmaster Central Blog: Introducing reCAPTCHA v3: the new way to stop bots

 

[Lady Fitzgerald]

Great. V1 was bad enough. V2 was even worse. Now we are going to be stuck with yet another, and probably worse, pain in the "neck" to deal with when trying to log in.

Security is good when it keeps the bad guys out but it goes too far when it keeps the good guys out, too. The sad fact is, CAPTCHA doesn't stop determined hackers while making life a living hell for legitimate users.

 

[file3456]

A captcha was never meant to stop a hacker. They are to stop bots from creating accounts and posting spam. Among other things, automated responses.

Have a look at my "captcha." So far it's stopped bots. cyberpcforum.com Click on contact us or register and you'll see it.

 

[z3r010]

Great. V1 was bad enough. V2 was even worse. Now we are going to be stuck with yet another, and probably worse, pain in the "neck" to deal with when trying to log in.

Security is good when it keeps the bad guys out but it goes too far when it keeps the good guys out, too. The sad fact is, CAPTCHA doesn't stop determined hackers while making life a living hell for legitimate users.

V2 was much better - no stupid words to type, just click on a picture.

V3 isn't even a captcha in the standard sense that we are used to, it only scores the traffic and doesn't stop to challenge it.

 

[Lady Fitzgerald]

V2 was much better - no stupid words to type, just click on a picture.

V3 isn't even a captcha in the standard sense that we are used to, it only scores the traffic and doesn't stop to challenge it.

In my experience (and a lot of people have shared that online), V2 has been a nightmare for me. I usually got through V1 without too much trouble on the first try. V2 almost always takes me multiple tries and, occasionally, I can't get past the misbegotten thing at all.

V2 was hyped as being easier to use than V1. Based on that lie, V3 has me terrified.

 

[Lady Fitzgerald]

A captcha was never meant to stop a hacker. They are to stop bots from creating accounts and posting spam. Among other things, automated responses.

Have a look at my "captcha." So far it's stopped bots. cyberpcforum.com Click on contact us or register and you'll see it.

You're correct but that doesn't make CAPTCHAs any less odious.

I looked at the CAPTCHA on the registration screen of your forum. It doesn't look like it would be as bad as the ones that require you to interpret distorted or obfuscated words or, especially, those stupid pictures.

 

[Brds7t7]

Whilst I never had that much of an issue on a PC, trying to do those v2 picture CAPTCHAs on a mobile device drove me bloody nuts!

Often the pictures were fuzzy and difficult to see on a smaller screen. And there was always one where a slight corner of the picture would run over into another square and catch me out.

If it doesn't require a click and works how it should (we'll see on that one), then hopefully they'll be a lot less frustrating to use.

 

[file3456]

You're correct but that doesn't make CAPTCHAs any less odious.

I looked at the CAPTCHA on the registration screen of your forum. It doesn't look like it would be as bad as the ones that require you to interpret distorted or obfuscated words or, especially, those stupid pictures.

Yeah, it's really great and it has stopped many bots already. Although I have other means to stop bots as well. It's simple yet effective.

 

[file3456]

Google does have an invisible captcha. I'm not sure why site's don't use that.