https://redmine.documentfoundation.org/https://redmine.documentfoundation.org/favicon.ico?16960560022017-01-17T07:23:48ZThe Document Foundation RedmineInfrastructure - Task #2141: Replacing reCAPTCHAhttps://redmine.documentfoundation.org/issues/2141?journal_id=114772017-01-17T07:23:48ZFlorian Effenbergerfloeff@documentfoundation.org
<ul></ul><blockquote>
<p>Ask LibreOffice currently using reCAPTCHA for CAPTCHA, but this service<br />as well as many other Google services have been banned by PRC for a long<br />time, making this site not useful for their people, to avoid that, Ask<br />LibreOffice should replacing it by free and open source replacements.</p>
</blockquote>
<p>Do you know of a working alternative and have some hands-on experience <br />you can share with us? That'd be great! :-)</p> Infrastructure - Task #2141: Replacing reCAPTCHAhttps://redmine.documentfoundation.org/issues/2141?journal_id=131372017-08-23T15:12:24ZKrasnaya Ploshchad’shanshandehongxing@outlook.com
<ul></ul><p>Florian Effenberger wrote:</p>
<blockquote><blockquote>
<p>Ask LibreOffice currently using reCAPTCHA for CAPTCHA, but this service<br />as well as many other Google services have been banned by PRC for a long<br />time, making this site not useful for their people, to avoid that, Ask<br />LibreOffice should replacing it by free and open source replacements.</p>
</blockquote>
<p>Do you know of a working alternative and have some hands-on experience <br />you can share with us? That'd be great! :-)</p>
</blockquote>
<p>I have found some alternates can provide captcha without relying on Google’s online service, all of them are FOS:<br /><a class="external" href="https://github.com/mewebstudio/captcha">https://github.com/mewebstudio/captcha</a><br /><a class="external" href="https://github.com/dchest/captcha">https://github.com/dchest/captcha</a><br /><a class="external" href="https://github.com/Gregwar/captcha">https://github.com/Gregwar/captcha</a><br /><a class="external" href="http://dice-captcha.com/">http://dice-captcha.com/</a><br /><a class="external" href="http://jcaptcha.sourceforge.net/">http://jcaptcha.sourceforge.net/</a><br /><a class="external" href="http://www.phpcaptcha.org/">http://www.phpcaptcha.org/</a><br /><a class="external" href="http://www.sweetcaptcha.com/">http://www.sweetcaptcha.com/</a></p>
<p>Alternatively, we can also get source from Google to build our own captcha:<br /><a class="external" href="https://github.com/google/recaptcha/releases">https://github.com/google/recaptcha/releases</a></p> Infrastructure - Task #2141: Replacing reCAPTCHAhttps://redmine.documentfoundation.org/issues/2141?journal_id=131432017-08-24T11:22:42ZFlorian Effenbergerfloeff@documentfoundation.org
<ul></ul><blockquote>
<p>I have found some alternates can provide captcha without relying on <br />Google’s online service, all of them are FOS:<br /><a class="external" href="https://github.com/mewebstudio/captcha">https://github.com/mewebstudio/captcha</a><br /><a class="external" href="https://github.com/dchest/captcha">https://github.com/dchest/captcha</a><br /><a class="external" href="https://github.com/Gregwar/captcha">https://github.com/Gregwar/captcha</a></p>
</blockquote>
<p>Do you have experiences wrt. their detection rate? A properly working <br />captcha is quite important given the amount of spam we regularly see, so <br />if we have insight into their detection rate, that would avoid parts of <br />own tests. ;-)</p>
<blockquote>
<p>Alternatively, we can also get source from Google to build our own captcha:<br /><a class="external" href="https://github.com/google/recaptcha/releases">https://github.com/google/recaptcha/releases</a></p>
</blockquote>
<p>Would this be working in China, or is this blocked as well?</p> Infrastructure - Task #2141: Replacing reCAPTCHAhttps://redmine.documentfoundation.org/issues/2141?journal_id=131532017-08-25T13:31:08ZKrasnaya Ploshchad’shanshandehongxing@outlook.com
<ul></ul><p>Florian Effenberger wrote:</p>
<blockquote><blockquote>
<p>I have found some alternates can provide captcha without relying on <br />Google’s online service, all of them are FOS:<br /><a class="external" href="https://github.com/mewebstudio/captcha">https://github.com/mewebstudio/captcha</a><br /><a class="external" href="https://github.com/dchest/captcha">https://github.com/dchest/captcha</a><br /><a class="external" href="https://github.com/Gregwar/captcha">https://github.com/Gregwar/captcha</a></p>
</blockquote>
<p>Do you have experiences wrt. their detection rate? A properly working <br />captcha is quite important given the amount of spam we regularly see, so <br />if we have insight into their detection rate, that would avoid parts of <br />own tests. ;-)</p>
</blockquote>
<p>Then I’m out of idea.</p>
<blockquote><blockquote>
<p>Alternatively, we can also get source from Google to build our own captcha:<br /><a class="external" href="https://github.com/google/recaptcha/releases">https://github.com/google/recaptcha/releases</a></p>
</blockquote>
<p>Would this be working in China, or is this blocked as well?</p>
</blockquote>
<p>If you create your own captcha based on this, but not send any request to Google, it would be work and not being disturbed by GFW.</p> Infrastructure - Task #2141: Replacing reCAPTCHAhttps://redmine.documentfoundation.org/issues/2141?journal_id=131562017-08-28T10:10:35ZFlorian Effenbergerfloeff@documentfoundation.org
<ul><li><strong>Subject</strong> changed from <i>Replacing reCAPTCHA on Ask LibreOffice</i> to <i>Replacing reCAPTCHA with self-hosted version</i></li><li><strong>Assignee</strong> set to <i>Guilhem Moulin</i></li><li><strong>Target version</strong> set to <i>Qlater</i></li></ul><p>I'll assign this to Guilhem<br />However, not sure when we will find time for this - if a volunteer wants to look into it before, happy of course to give them access to our testing site :-)</p> Infrastructure - Task #2141: Replacing reCAPTCHAhttps://redmine.documentfoundation.org/issues/2141?journal_id=131582017-08-28T13:59:09ZKrasnaya Ploshchad’shanshandehongxing@outlook.com
<ul></ul><p>Florian Effenberger wrote:</p>
<blockquote>
<p>I'll assign this to Guilhem<br />However, not sure when we will find time for this - if a volunteer wants to look into it before, happy of course to give them access to our testing site :-)</p>
</blockquote>
<p>Thank you, I hope you can avoiding GFW soon.</p> Infrastructure - Task #2141: Replacing reCAPTCHAhttps://redmine.documentfoundation.org/issues/2141?journal_id=131922017-08-31T04:16:09ZKrasnaya Ploshchad’shanshandehongxing@outlook.com
<ul></ul><p>LO Extensions and Templates website should do it too for Registration form.</p> Infrastructure - Task #2141: Replacing reCAPTCHAhttps://redmine.documentfoundation.org/issues/2141?journal_id=133422017-09-13T13:37:05ZFlorian Effenbergerfloeff@documentfoundation.org
<ul></ul><p>Guilhem, I wonder whether that is some EasyHack and/or volunteer task to look into, or is it so trivial that it needs no investigating, but merely doing? (which then is limited to the admin group of course due to access requirements)</p> Infrastructure - Task #2141: Replacing reCAPTCHAhttps://redmine.documentfoundation.org/issues/2141?journal_id=136872017-11-06T10:12:55ZFlorian Effenbergerfloeff@documentfoundation.org
<ul></ul><p>Florian Effenberger wrote:</p>
<blockquote>
<p>Guilhem, I wonder whether that is some EasyHack and/or volunteer task to look into, or is it so trivial that it needs no investigating, but merely doing? (which then is limited to the admin group of course due to access requirements)</p>
</blockquote>
<p>Something for the next infra call?</p> Infrastructure - Task #2141: Replacing reCAPTCHAhttps://redmine.documentfoundation.org/issues/2141?journal_id=138012017-11-22T02:50:54ZGuilhem Moulinguilhem@libreoffice.org
<ul><li><strong>Priority</strong> changed from <i>Normal</i> to <i>Low</i></li></ul><p>We're currently using reCAPTCHA v2 as plugins to MediaWiki, Askbot, Plone (<a class="external" href="https://extensions.libreoffice.org">https://extensions.libreoffice.org</a>) and Silverstripe (<a class="external" href="https://libreoffice.org);">https://libreoffice.org);</a> switching to another captcha solution requires that we find and configure a working plugin, or possibly develop our own if there is no such plugin.</p>
<p>The WebSSO system uses a self-hosted captcha solution, and once we change the auth method of the above services their frontend for account creation will disappear. I'm thus lowering the priority per the Nov. 21 infra call. If there is a working plugin which can replace reCAPTCHA in Askbot I can offer to deploy it, otherwise I'd rather spend my time on the SSO migration than attempting to glue the various bits together :-P</p> Infrastructure - Task #2141: Replacing reCAPTCHAhttps://redmine.documentfoundation.org/issues/2141?journal_id=140222018-01-03T17:06:30ZKrasnaya Ploshchad’shanshandehongxing@outlook.com
<ul></ul><p>Still relying on Google server while answering, so I've to seek the way to fanqiang for this. :-(</p> Infrastructure - Task #2141: Replacing reCAPTCHAhttps://redmine.documentfoundation.org/issues/2141?journal_id=144002018-02-19T11:13:14ZFlorian Effenbergerfloeff@documentfoundation.org
<ul><li><strong>Related to</strong> <i><a class="issue tracker-4 status-5 priority-2 priority-default closed" href="/issues/2519">Task #2519</a>: Disable google service on ask.libreoffice.org for zh-cn</i> added</li></ul> Infrastructure - Task #2141: Replacing reCAPTCHAhttps://redmine.documentfoundation.org/issues/2141?journal_id=147222018-03-15T11:09:52ZFlorian Effenbergerfloeff@documentfoundation.org
<ul><li><strong>Priority</strong> changed from <i>Low</i> to <i>Normal</i></li><li><strong>Target version</strong> changed from <i>Qlater</i> to <i>Q2/2018</i></li></ul><p>Let me try to prioritize that higher, it seems to be causing issues for many<br />Let's talk about this in a next team or infra call</p> Infrastructure - Task #2141: Replacing reCAPTCHAhttps://redmine.documentfoundation.org/issues/2141?journal_id=148172018-03-26T12:21:41ZFlorian Effenbergerfloeff@documentfoundation.org
<ul></ul><p>Got hinted at <a class="external" href="http://www.karlgroves.com/2012/04/03/captcha-less-security/">http://www.karlgroves.com/2012/04/03/captcha-less-security/</a> which might provide further insight</p> Infrastructure - Task #2141: Replacing reCAPTCHAhttps://redmine.documentfoundation.org/issues/2141?journal_id=148262018-03-28T15:47:18ZKrasnaya Ploshchad’shanshandehongxing@outlook.com
<ul></ul><p>Looks sad that reCAPTCHA has security holes.</p> Infrastructure - Task #2141: Replacing reCAPTCHAhttps://redmine.documentfoundation.org/issues/2141?journal_id=161442019-02-10T05:33:41ZKrasnaya Ploshchad’shanshandehongxing@outlook.com
<ul><li><strong>Priority</strong> changed from <i>Normal</i> to <i>Low</i></li><li><strong>% Done</strong> changed from <i>0</i> to <i>100</i></li></ul> Infrastructure - Task #2141: Replacing reCAPTCHAhttps://redmine.documentfoundation.org/issues/2141?journal_id=167812019-05-08T13:25:20ZFlorian Effenbergerfloeff@documentfoundation.org
<ul></ul><p>We had some discussion on this topic, but I don't recall the exact outcome. IMHO not all services support self-hosted ReCaptcha, and/or it was not as effective.<br />What are our options, what do other projects do in this regard?<br />Does it make sense to have something self-hosted for a set of services/IPs only?</p> Infrastructure - Task #2141: Replacing reCAPTCHAhttps://redmine.documentfoundation.org/issues/2141?journal_id=172302019-07-25T12:40:23ZFlorian Effenbergerfloeff@documentfoundation.org
<ul><li><strong>Target version</strong> changed from <i>Q2/2018</i> to <i>Qlater</i></li></ul><p>We discussed this recently in the team call, but there seems no real effective ReCaptcha alternative around<br />We should revisit the need for the ReCaptcha in the various sites (i.e. is there a concrete need to handle antispam that way), and disable where it's not required</p>
<p>Anyone has insight what other FLOSS projects do for ReCaptcha?</p> Infrastructure - Task #2141: Replacing reCAPTCHAhttps://redmine.documentfoundation.org/issues/2141?journal_id=173402019-08-21T09:14:17ZKrasnaya Ploshchad’shanshandehongxing@outlook.com
<ul></ul><p>If there are no good alternates to reCAPTCHA, and Google’s releases doesn’t works well on our server, we can close this task in favor of task <a class="issue tracker-4 status-5 priority-2 priority-default closed" title="Task: Using reCAPTCHA fallback service (Closed)" href="https://redmine.documentfoundation.org/issues/2774">#2774</a>.</p> Infrastructure - Task #2141: Replacing reCAPTCHAhttps://redmine.documentfoundation.org/issues/2141?journal_id=196762020-06-12T07:00:05ZKrasnaya Ploshchad’shanshandehongxing@outlook.com
<ul><li><strong>Subject</strong> changed from <i>Replacing reCAPTCHA with self-hosted version</i> to <i>Replacing reCAPTCHA</i></li></ul><p>Is there any site still relying on reCAPTCHA? I discovered a good replacement of that, and it doesn't be banned by Chinese Communist authority.<br /><a class="external" href="https://www.hcaptcha.com/">https://www.hcaptcha.com/</a></p> Infrastructure - Task #2141: Replacing reCAPTCHAhttps://redmine.documentfoundation.org/issues/2141?journal_id=201862020-08-04T16:18:15ZFlorian Effenbergerfloeff@documentfoundation.org
<ul><li><strong>Assignee</strong> deleted (<del><i>Guilhem Moulin</i></del>)</li><li><strong>Target version</strong> deleted (<del><i>Qlater</i></del>)</li></ul><p>Most services moved to SSO, so not relevant for these anymore<br />Relevant only for AskBot, which likely will be replaced in the near future as well<br />New extension site temporarily using it, will soon allow authenticated users to bypass</p> Infrastructure - Task #2141: Replacing reCAPTCHAhttps://redmine.documentfoundation.org/issues/2141?journal_id=228412022-09-19T12:52:55ZKrasnaya Ploshchad’shanshandehongxing@outlook.com
<ul></ul><p>This bug seems affect the LibreOffice Extensions website, which requires captcha for me before submit a comment, otherwise:</p>
<blockquote>
<p>Please answer the captcha, if you do not see the captcha please enable JavaScript</p>
</blockquote>