If you’ve got any stake in the wonderful world of spam bots, then you’ve probably heard about Google’s CAPTCHA update, the No CAPTCHA reCAPTCHA. Essentially a user need only check a box and Google’s ground-up pixie dust automagically knows whether or not to believe you. A video overview of the update:
Almost as soon as the announcement, people in the accessibility community spoke up stating it was completely broken, worked well, or worked no worse than the current option. To Google’s credit, walking through the source code shows an effort was made to provide accessibility hooks.
At the very least it may prevent embarrassing mis-haps like the broken keyboard navigation at DigitalGov. At its worst it may appear that Google is turning a blind eye (pun intended) to accessibility as we’ve witnessed with its Web Components demos.
I am not an assistive technology (AT) user, so while I can fire up NVDA and try the form, I cannot truly experience it the way a day-to-day or power user would. Conveniently, both Patrick H. Lauke and Alastair Campbell made demos so that anyone can try it out for themselves (Patrick’s demo, Alastair’s demo).
I started to track the comments on Twitter in a Storify (and will continue to do so), but in the interest of providing a narrative, archiving the content pending the inevitable heat death of Storify, and having a simpler format, I am embedding the tweets and links here.
These three video examples from Patrick Lauke show the reCAPTCHA using three browser/AT combos:
- Windows 8.1, JAWS 16, Firefox.
- Windows 8.1, JAWS 16, Internet Explorer 11.
- Windows 8.1, NVDA, Firefox and Internet Explorer 11.
Articles / Posts
Derek Featherstone turned around an accessibility review pretty quickly with On the Accessibility of Google’s No CAPTCHA and provided these results:
- We tested it without any assistive technology for simple keyboard use. Can I use the keyboard to check that checkbox, and can I see the keyboard focus to know where the cursor is? Yes, I can.
- We tested with a couple of screen readers (VoiceOver running on a Mac, Narrator on Windows 8.1, and NVDA on Windows 7). Does the checkbox get announced by the screen reader as a checkbox, even though it clearly is NOT a native checkbox? And does it work properly when checking off the checkbox using the keyboard by pressing the space bar or double-tapping on the touch screen? Yes, on both counts. Google added ARIA’s
role="checkbox"to ensure that modern screen readers treat the span as a checkbox, and they allowed that span to take the focus using tabindex.
- We tested with Dragon NaturallySpeaking. Using Dragon, can someone look at the screen and say “Click checkbox” or “Click I’m not a robot” to effectively click the checkbox? Yes, on both counts.
Marco Zehe, who works on the Mozilla accessibility team, takes a different view in this post (in German) Warum die Zugänglichkeit von Googles neuer RECAPTCHA-Version kompletter Bullshit ist. In short, he notes it has all the code for accessibility, but in practice it doesn’t quite work:
Während Googles neue Version von RECAPTCHA also rein vom Markup her die Voraussetzungen für Zugänglichkeit erfüllt, da dieses Kontrollfeld sowohl mit der Tastatur angesprungen werden kann als auch die richtigen Informationen an Screen Reader raus gibt, ist seine Zuverlässigkeit alles andere als gegeben, wenn man damit als Person mit einer Behinderung interagieren will.
Sina Bahram argues the CAPTCHA in general is a flawed premise (something with which Derek Featherstone agrees in his post) and so talks about the larger issues and how this reCAPTCHA implementation isn’t necessarily any better, regardless of the accessibility improvements (embedded audio below, or you can listen to it directly at AudioBoom):
Edit (Dec. 7, 2014): Sina has posted a transcript of the audio.
The WebAIM mailing list also has a thread about the reCAPTCHA, some of which recaptures the commentary in the tweets following.
want to test google's new reCAPTCHA? #a11y http://t.co/3UXl72mAHR (not half bad in Chrome w/JAWS+NVDA, fairly cruddy in other combos)— patrick h. lauke (@patrick_h_lauke) December 3, 2014
How bloody unsurprising. Google makes the web even less accessible with their new captchas: http://t.co/S5I9Zau3ME #a11y #accessibility #fb— Sina Bahram (@SinaBahram) December 4, 2014
. @aardrian @patrick_h_lauke Worked In VoiceOver Safari 8.01 I just interacted with an oddlynamed frame and ticked the checkbox.— Tim Noonan (@TimNoonan) December 4, 2014
@pauljadam @aardrian @patrick_h_lauke Just verrified that when using a screen reader, I get qualified as a bot. As I predicted. #a11y— Sina Bahram (@SinaBahram) December 4, 2014
@SinaBahram I checked the box, partially checked, unchecked. Rinse and repeat. I couldn't get it to stay checked. I do something wrong?— Onj (@FreakyFwoof) December 4, 2014
@FreakyFwoof Other than being blind, no you didn't. Turns out blind people == bots, which is the most most folks are missing as I explain it— Sina Bahram (@SinaBahram) December 4, 2014
@aardrian @SinaBahram @TimNoonan @pauljadam behavior varies based on heuristics/magic. e.g. IE/JAWS always prompted for extra CAPTCHA— patrick h. lauke (@patrick_h_lauke) December 4, 2014
@aardrian @SinaBahram @TimNoonan @pauljadam also, there's a timeout – if you take too long, the new reCAPTCHA prompts you for extra CAPTCHA— patrick h. lauke (@patrick_h_lauke) December 4, 2014
@aardrian @SinaBahram @TimNoonan @pauljadam IE/NVDA and FF/NVDA wouldn't let me go into the iframe somehow…— patrick h. lauke (@patrick_h_lauke) December 4, 2014
@aardrian @SinaBahram import java.awt.Robot; robot.delay(4000); robot.mouseMove("x", "y"); robot.delay(500); leftClick();— Steve Buell (@SteveBuell) December 4, 2014
@aardrian @SinaBahram Just needs the x,y target.— Steve Buell (@SteveBuell) December 4, 2014
It seems that using IE is an important heuristic for not being human, in Google's reCAPTCHA update. Try it https://t.co/vlSDLYF8ID— Alastair Campbell (@alastc) December 4, 2014
@derekcz @FreakyFwoof Also, vo/safari works better with it— Sina Bahram (@SinaBahram) December 4, 2014
@steve_holmes @SinaBahram CAPTCHA is trying to solve the wrong problem. We want legitimate users. We don't care if they're alive.— pietje poes (@stommepoes) December 4, 2014
On the Accessibility of Google's No CAPTCHA: http://t.co/aAS9Fa7SlE— Derek Featherstone (@feather) December 4, 2014
@feather Did you test mobile? Touch while sometimes registering clicks doesn't reflect in mouse movements.— Awkward Dad™ (@gregtarnoff) December 4, 2014
@feather That's a major flaw in IMO. People will now replace old captchas with this and kill off mobile engagement unknowingly.— Awkward Dad™ (@gregtarnoff) December 4, 2014
maybe i'm a noob, but my experience using various browsers/ATs with http://t.co/Syt90SLOU3 was far from @feather's http://t.co/6MmiuWxdFH— patrick h. lauke (@patrick_h_lauke) December 4, 2014
@patrick_h_lauke Just successfully used your test with NVDA+Firefox.— Marco Zehe (@MarcoInEnglish) December 4, 2014
@MarcoInEnglish when i tab past the first link, focus gets on the iframe but NVDA gives no clue as to what just happened…— patrick h. lauke (@patrick_h_lauke) December 4, 2014
@MarcoInEnglish have to explicitly use "m" key to jump into the frame. also, if i get extra visual/audio captcha, it doesn't announce errors— patrick h. lauke (@patrick_h_lauke) December 4, 2014
@patrick_h_lauke Oh interesting, confirmed! Funny enough, when going to the address bar and shift-tabbing, you can get to it without problem— Marco Zehe (@MarcoInEnglish) December 4, 2014
@MarcoInEnglish @feather just trying IE11/NVDA and also can't set focus on checkbox somehow… weirdness— patrick h. lauke (@patrick_h_lauke) December 4, 2014
@MarcoInEnglish @feather it even seems to create a complete keyboard trap after a few attempts at forward/backward tabbing…— patrick h. lauke (@patrick_h_lauke) December 4, 2014
@patrick_h_lauke not what we experienced, but again – different combinations etc. I still see it as a hugely positive step. @MarcoInEnglish— Derek Featherstone (@feather) December 4, 2014
for fun and games, here are my current experiences with reCAPTCHA… Firefox/JAWS https://t.co/CNXQTDRIYK— patrick h. lauke (@patrick_h_lauke) December 4, 2014
reCAPTCHA…IE11/JAWS (ended with a nice crash, but won't blame reCAPTCHA for this ;) )https://t.co/gc1F9BKjLY— patrick h. lauke (@patrick_h_lauke) December 4, 2014
reCAPTCHA…NVDA, Firefox, IE11 https://t.co/Wg8vMc7ixT— patrick h. lauke (@patrick_h_lauke) December 4, 2014
@aardrian The new #recaptcha is not fully localized for screen readers. Sample pict: Hungarian/English #a11y #i18n pic.twitter.com/jfyQg20ZZ6— Károly Szántai (@szantaikaroly) December 5, 2014
A game-changing reCAPTCHA makes significant steps forward to removing #a11y barriers » http://t.co/cr02TUROOs by @feather— Denis Boudreau (@dboudreau) December 5, 2014
On Google's new captcha "replacement", by @patrick_h_lauke http://t.co/pSrUIgFFJl— Karl Groves (@karlgroves) December 5, 2014
@forzanom @Accessible_Info It's exceptionally frustrating that folks are saying, let's try it out. It doesn't matter. This binary logic!— Sina Bahram (@SinaBahram) December 5, 2014
@forzanom @Accessible_Info Step #1: check the damn box. Step #2: solve the stupid captcha. Old way, Step #1: solve stupid audio captcha.— Sina Bahram (@SinaBahram) December 5, 2014
@SinaBahram @stevefaulkner @Accessible_Info Exactly. I know my working tests were pure accident it seems. This is, and remains, total crap.— Marco Zehe (@MarcoInEnglish) December 5, 2014
@MarcoInEnglish You cannot make a captcha in this fashion that is also accessible, without it being easily manipulated by bots.— Sina Bahram (@SinaBahram) December 5, 2014
The #accessibility of captcha and why Google or anybody else's method doesn't work! #a11y https://t.co/GOAsSuhnGR via @audioBoom— Sina Bahram (@SinaBahram) December 5, 2014
@SinaBahram I'm quite a fan, believe it or not, of the PHPBB CAPTCHA on this site when subscribing: http://t.co/2QNtuHp8OS— Andre Louis (@FreakyFwoof) December 5, 2014
FYI: No reCaptcha didn't work for me in Win7/IE11/JAWS15 nor on iPhone/VO. @SinaBahram @SteveFaulkner @Feather @remixman @forzanom @Vick08— Dennis Lembrée (@dennisl) December 5, 2014
@dennisl @SinaBahram @feather @remixman @forzanom @vick08 nocaptcha is not implemented on touch or mobile as yet (i believe)— Steve Faulkner (@stevefaulkner) December 5, 2014
@dennisl @SinaBahram @feather @remixman @forzanom @vick08 not implemented = its displayed but always returns a graphic capture to solve— Steve Faulkner (@stevefaulkner) December 5, 2014
http://t.co/GPDlq8kNh0 #a11y #captcha auf deutsche— Karl Groves 🇺🇸 (@karlgroves) December 5, 2014
Blog post with audio and transcript. Explaining The Fundamental #accessibility Challenge of CAPTCHA: https://t.co/GOPpuhS5Do #a11y #fb— Sina Bahram (@SinaBahram) December 6, 2014
Google’s No Captcha Shows Some Progress http://t.co/eYM5wmKUFx #captcha #a11y #webdev #security— Web Axe (@webaxe) December 7, 2014
Another reaction to the new Google #reCAPTCHA via WebAIM list: http://t.co/2VoE2XyjMq— mallory, alice & bob (@stommepoes) December 7, 2014
No CAPTCHA so far seems better than reCAPTCHA, but appears to still be an accessibility barrier. The better approach still appears to be finding a way to avoid any CAPTCHA solution. I applaud Google’s effort to improve the accessibility from the start, but it’s clear it needs more testing — which is to be expected when rolling out such a dramatic change.
- Google’s Clever Plan to Replace CAPTCHA With a Checkbox from Gizmodo.
- Google Can Now Tell You’re Not a Robot With Just One Click from Wired.
- List of Resources: Breaking CAPTCHA by Karl Groves, from 2013.
Update: December 7, 2014
A deaf-blind user posted on WebAIM to note that No CAPTCHA doesn’t work for him in either Firefox or IE11.
Update: July 20, 2015
Terrill Thompson has left a comment at the Webaxe post that bodes well for at least one browser / screen reader combination. Read the original comment for far more detail:
Testing just now with JAWS 16.0.4350 and IE11, it seems to work well.
Update: December 14, 2015
Terrill Thompson took a look back at reCAPTCHA now that Google has had a year to update it. In his post reCAPTCHA Accessibility reVISITED he notes some improvements, but it’s still not a good idea to use.
Update: December 1, 2016
Google is teasing a new invisible ReCAPTCHA. You can sign up to try it, though the inaccessible form already makes me wary.
[…] the accessibility community was not all positive, as reported on Adrian Roselli’s blog post ReCAPTCHA Reboot, as well as in the comments on the WebAXE blog and posts to the WebAIM […]
Leave a Comment or Response