How to handle captchas properly

[pastspot7938]

So I'm reaching out because I feel there needs to be a better way to handle this than what I've been doing so far. Or maybe there's a feature request in here somewhere.

Captchas are annoying at best and they're worse with a hardened browser as they appear more often. So I flirted the idea of globally nooping (I use medium mode) captcha domains. But google, as they know better, serve recaptcha from their main google.com domain. So you get recaptcha and all the goodies from google, which I obviously don't want. So I don't do it and go through the cumbersome process of allowing them and refresh the page everytime.

But there's another thing that could be done eventually that would make this a little easier. Some sites I've browsed only use captchas on login pages. I might noop google.com to login and then remove it. But maybe there could be a way to only allow captchas like that on specific URLs so I could persist them instead of doing it every time I login there (I clear session data on exit)?

Open to suggestions and feedback obviously.

[gothic-bum]

on specific URLs

You can use dynamic URL filtering: https://github.com/gorhill/uBlock/wiki/Dynamic-URL-filtering

[pastspot7938]

Hmm, interesting. That is useful, thank you. It allows me to only allow https://www.gstatic.com/recaptcha/ and https://www.google.com/recaptcha/ which is definitely an improvement. I was not aware of this feature, thanks!

If I may provide some feedback though, I think the UX could be slightly better, at least to have a visual indication of URL filtering in the popup (I can't see anything there after having added those rules). Because it makes it difficult to glance what's being blocked or not.

Also, I guess this only partially satisfies that use case I mentioned where recaptcha is only used in a long page? AFAICT it's a source hostname, not URL, so there's no way to only allow that in that specific page.

I also wonder how people deal with this themselves. I block everything 3rd party by default and use medium mode to add noops when needed. Do you allow captchas globally or enable this per site? Temporarily or permanently? If I may as well ask, what about CDNs too? Do you have a global allow rule for those?

[gorhill]

I think the UX could be slightly better

It's for advanced users, and really this was added (more than 11 years ago) originally strictly to help filter list authors to investigate filtering issues. There won't be more work done on this.

[pastspot7938]

I accept your position. I personally still think something like this could be valuable based on my use-case above. It's very cumbersome to deal with captchas daily on websites, particularly because some action fails because it's not loaded and I have to figure out that it's blocked, then unblock google.com, refresh, then unblock gstatic.com and refresh again. And because I don't want to have google tracking me I only do this temporarily and next time I need to login I have to do this dance again.

I've accepted this because for me privacy outweighs convenience most of the time, but I'd love if there was a better way to handle this.

I also understand google purposefully hosted recaptcha under google.com, which is a shame for us.

Again open to suggestions and feedback, and thanks for getting back to me.

[gothic-bum]

Do you allow captchas globally or enable this per site?

* https://recaptcha.google.com/recaptcha/ * noop
* https://www.google.com/recaptcha/ * noop
* https://www.gstatic.com/recaptcha/ * noop
* https://www.recaptcha.net/recaptcha/ * noop

Then use static filters for more specific filtering.

what about CDNs too?

It depends on the specific CDN. The same concept applies: use noop rules with static filters if needed.