reCAPTCHA on Key Redemption is evil
I literally spent around 15 mins doing image verification trying to redeem my keys for bloodstained and the DLC. Kept getting one after another. I couldn't use audio because it said I was sending too many requests from my network or something. I gave up using the client when the DLC failed to redeem twice and every retry made me go through another gauntlet of reCAPTCHAs and went to the webpage instead where there was no reCAPTCHA.
Maybe a different way to authenticate that we are human on the client other than the evil that is reCAPTCHA would be nice but I very rarely redeem keys so it is honestly very minor.
Posted Jul 13, 2019, 3:18 AM UTC
5323
That’s why reCAPTCHA is a nightmare that should be prohibited. That, and the fact Google’ use it to track users and train his AI.
I should have been paid for training that AI for 15mins, it was mainly crosswalks and stoplights. They are probably developing some AI for autonomous driving and if they succeed they will make a killing. I want a cut
No, no, no. The goal is to train the AI so it won't go around killing.
On a more serious note, that captcha system is the worst and I'm sorry you had to go through it
So what else is there that should be used then?
2FA should suffice if the real point is to verify your identity
[deleted]
CAPTCHAs don't stop bots either.
Why would you even need to stop a bot on a known user?
If it's an established account, several years old, with lots of games purchased over those years without trouble (no credit card disputes, etc.), then there's little reason to check if it's a bot. So they should be using nothing most of the time.
There are bots on Twitter snatching up Steam keys whenever they're posted in plain-text, so I'd say there is definitely some kind of use to having a captcha on key redemption.
The problem is that creating CAPTCHA challenges is hard. When you are a big target, like GOG, any homebrew CAPTCHA solution will be broken within days. Using Google's reCAPTCHA is not ideal for the reasons you stated, but at the same time, it's the most reliable solution.
There's a number of alternative solutions, both: open and enterprise, that don't work by employing your customers for Google.
Care to give some examples? I have looked into this a while ago, and remember that all the alternatives were lacking in some way.
Also, just noticed that GOG uses Google Analytics... (Even though that can be blocked by the browser easily, unlike CAPTCHA.) So if they wanted to really get rid of Google, they would need to start there.
They cost money, though. reCAPTCHA is free because it's providing useful data to Google.
It works well for blocking bots for the same reason: it only presents you with problems that bots can't solve.