If you’ve got any stake in the wonderful world of spam bots, then you’ve probably heard about Google’s CAPTCHA update, the No CAPTCHA reCAPTCHA. Essentially a user need only check a box and Google’s ground-up pixie dust automagically knows whether or not to believe you. A video overview of the update:
Almost as soon as the announcement, people in the accessibility community spoke up stating it was completely broken, worked well, or worked no worse than the current option. To Google’s credit, walking through the source code shows an effort was made to provide accessibility hooks.
At the very least it may prevent embarrassing mis-haps like the broken keyboard navigation at DigitalGov. At its worst it may appear that Google is turning a blind eye (pun intended) to accessibility as we’ve witnessed with its Web Components demos.
I am not an assistive technology (AT) user, so while I can fire up NVDA and try the form, I cannot truly experience it the way a day-to-day or power user would. Conveniently, both Patrick H. Lauke and Alastair Campbell made demos so that anyone can try it out for themselves (Patrick’s demo, Alastair’s demo).
I started to track the comments on Twitter in a Storify (and will continue to do so), but in the interest of providing a narrative, archiving the content pending the inevitable heat death of Storify, and having a simpler format, I am embedding the tweets and links here.
These three video examples from Patrick Lauke show the reCAPTCHA using three browser/AT combos:
- Windows 8.1, JAWS 16, Firefox.
- Windows 8.1, JAWS 16, Internet Explorer 11.
- Windows 8.1, NVDA, Firefox and Internet Explorer 11.
Articles / Posts
- We tested it without any assistive technology for simple keyboard use. Can I use the keyboard to check that checkbox, and can I see the keyboard focus to know where the cursor is? Yes, I can.
- We tested with a couple of screen readers (VoiceOver running on a Mac, Narrator on Windows 8.1, and NVDA on Windows 7). Does the checkbox get announced by the screen reader as a checkbox, even though it clearly is NOT a native checkbox? And does it work properly when checking off the checkbox using the keyboard by pressing the space bar or double-tapping on the touch screen? Yes, on both counts. Google added ARIA’s
role="checkbox"to ensure that modern screen readers treat the span as a checkbox, and they allowed that span to take the focus using tabindex.
- We tested with Dragon NaturallySpeaking. Using Dragon, can someone look at the screen and say “Click checkbox” or “Click I’m not a robot” to effectively click the checkbox? Yes, on both counts.
Marco Zehe, who works on the Mozilla accessibility team, takes a different view in this post (in German) Warum die Zugänglichkeit von Googles neuer RECAPTCHA-Version kompletter Bullshit ist. In short, he notes it has all the code for accessibility, but in practice it doesn’t quite work:
Während Googles neue Version von RECAPTCHA also rein vom Markup her die Voraussetzungen für Zugänglichkeit erfüllt, da dieses Kontrollfeld sowohl mit der Tastatur angesprungen werden kann als auch die richtigen Informationen an Screen Reader raus gibt, ist seine Zuverlässigkeit alles andere als gegeben, wenn man damit als Person mit einer Behinderung interagieren will.
Sina Bahram argues the CAPTCHA in general is a flawed premise (something with which Derek Featherstone agrees in his post) and so talks about the larger issues and how this reCAPTCHA implementation isn’t necessarily any better, regardless of the accessibility improvements (embedded audio below, or you can listen to it directly at AudioBoom):
Edit (Dec. 7, 2014): Sina has posted a transcript of the audio.
The WebAIM mailing list also has a thread about the reCAPTCHA, some of which recaptures the commentary in the tweets following.
@SinaBahram I checked the box, partially checked, unchecked. Rinse and repeat. I couldn't get it to stay checked. I do something wrong?— Onj (@FreakyFwoof) December 4, 2014
@FreakyFwoof Other than being blind, no you didn't. Turns out blind people == bots, which is the most most folks are missing as I explain it— Sina Bahram (@SinaBahram) December 4, 2014
It seems that using IE is an important heuristic for not being human, in Google's reCAPTCHA update. Try it https://t.co/vlSDLYF8ID— Alastair Campbell (@alastc) December 4, 2014
On the Accessibility of Google's No CAPTCHA: http://t.co/aAS9Fa7SlE— Derek Featherstone (@feather) December 4, 2014
@feather Did you test mobile? Touch while sometimes registering clicks doesn't reflect in mouse movements.— Awkward Dad™ (@gregtarnoff) December 4, 2014
@feather That's a major flaw in IMO. People will now replace old captchas with this and kill off mobile engagement unknowingly.— Awkward Dad™ (@gregtarnoff) December 4, 2014
@patrick_h_lauke Just successfully used your test with NVDA+Firefox.— Marco Zehe (@MarcoInEnglish) December 4, 2014
@MarcoInEnglish when i tab past the first link, focus gets on the iframe but NVDA gives no clue as to what just happened…— patrick h. lauke (@patrick_h_lauke) December 4, 2014
@MarcoInEnglish have to explicitly use "m" key to jump into the frame. also, if i get extra visual/audio captcha, it doesn't announce errors— patrick h. lauke (@patrick_h_lauke) December 4, 2014
@patrick_h_lauke Oh interesting, confirmed! Funny enough, when going to the address bar and shift-tabbing, you can get to it without problem— Marco Zehe (@MarcoInEnglish) December 4, 2014
for fun and games, here are my current experiences with reCAPTCHA… Firefox/JAWS https://t.co/CNXQTDRIYK— patrick h. lauke (@patrick_h_lauke) December 4, 2014
reCAPTCHA…IE11/JAWS (ended with a nice crash, but won't blame reCAPTCHA for this ;) )https://t.co/gc1F9BKjLY— patrick h. lauke (@patrick_h_lauke) December 4, 2014
reCAPTCHA…NVDA, Firefox, IE11 https://t.co/Wg8vMc7ixT— patrick h. lauke (@patrick_h_lauke) December 4, 2014
@MarcoInEnglish You cannot make a captcha in this fashion that is also accessible, without it being easily manipulated by bots.— Sina Bahram (@SinaBahram) December 5, 2014
No CAPTCHA so far seems better than reCAPTCHA, but appears to still be an accessibility barrier. The better approach still appears to be finding a way to avoid any CAPTCHA solution. I applaud Google’s effort to improve the accessibility from the start, but it’s clear it needs more testing — which is to be expected when rolling out such a dramatic change.
- Google’s Clever Plan to Replace CAPTCHA With a Checkbox from Gizmodo.
- Google Can Now Tell You’re Not a Robot With Just One Click from Wired.
- List of Resources: Breaking CAPTCHA by Karl Groves, from 2013.
Update: December 7, 2014
A deaf-blind user posted on WebAIM to note that No CAPTCHA doesn’t work for him in either Firefox or IE11.
Update: July 20, 2015
Terrill Thompson has left a comment at the Webaxe post that bodes well for at least one browser / screen reader combination. Read the original comment for far more detail:
Testing just now with JAWS 16.0.4350 and IE11, it seems to work well.
Update: December 14, 2015
Terrill Thompson took a look back at reCAPTCHA now that Google has had a year to update it. In his post reCAPTCHA Accessibility reVISITED he notes some improvements, but it’s still not a good idea to use.
Update: December 1, 2016
Google is teasing a new invisible ReCAPTCHA. You can sign up to try it, though the inaccessible form already makes me wary.
[…] the accessibility community was not all positive, as reported on Adrian Roselli’s blog post ReCAPTCHA Reboot, as well as in the comments on the WebAXE blog and posts to the WebAIM […]