Skip to content
TORNLIFE More

[100R]+ An easy way to use reCAPTHA globally

Started by bingri [1523812] on in Bugs & Issues.

22 replies · 578 views · thread synced · 4 days ago · View on torn.com
About this thread

Posts archived: 23 / 23 posts (100%) · the total is Torn's reply count + the opening post at the last fetch

Counted by TornLife from the archived posts.

Archived posts
23
Discussion span
→
Authority score
62 / 100
Historical score
43 / 100
Story score
62 / 100
Engagement score
72 / 100

People posting, likes and official posts are not counted for this thread yet: on threads longer than one page they come from a periodic pass over the archive, which has not covered it.

Most-liked replies

  • tobytorn [1617955] · 20 likes ·
    TL;DR Add "www.gstatic.cn/recaptcha/" to the Content-Security-Policy HTTP header to resolve the reCaptcha issue in China. After changing reCaptcha's domain to recaptcha.net as suggested by OP, all reCaptcha resources can be smoothly accessed from China now. However, reCaptcha loads a script …
  • bingri [1523812] · 12 likes ·
    Cool Seems much easier than migrating from reCaptcha to hCaptcha
  • bingri [1523812] · 12 likes ·
    So could you please add "www.gstatic.cn/recaptcha/" to the Content-Security-Policy HTTP header for the whole site? Thank you very much! @chedburn @bogie
bingri [1523812] · #10
Hi, boss

Sorry to bother you again.

I find the captcha have been changed to google.cn while accessing gym or crime page. That does work here. Thank you!

But I find the register page is still using google.com

Could you please help to check it again?

Thank you very much!
Chedburn [1] Admin Developer · #11
We can confirm we're using recaptcha.net everywhere, including the register page. I don't think we're missing anything?

If you see 'google.com', we believe it's because google decided to show you the .com version?

Thanks.
bingri [1523812] · #12
Maybe you are right.
I tried to access the register page using two different network operators and get two different results. One was okay, the other still failed.
I will report if I find some more useful information.
Thank you again!
bingri [1523812] · #14 · edited
Hi Ched,

Sorry to bother you again.

Thanks for your support last time, we have recruited a lot of new players these months. However, the CAPTCHA is still causing quite a bit of trouble.

I'd like to suggest that TORN migrate from reCaptcha to hCaptcha, which site is https://www.hcaptcha.com/

Here are the reasons for the suggestion:
1. reCaptcha is blocked in some areas such as China, hCaptcha is not.
2. reCaptcha is free for only 1-1,000,000 calls per month, hCaptcha is free.
3. Google has a habit of collecting your users' personal data without your consent.

Thanks very much for reading and considering.
DeKleineKobini [2114440] Committee Committee · #15
bogie has voiced his dislike for hCaptcha multiple times, so I doubt they will switch

CF still use hCaptcha (which in mine and many's opinion is far worse than reCaptcha in terms of inconvenience)
source

hCaptcha isn't controlled by us, and in fact we also dislike it (reCaptcha is much better in our opinion).
source

The vast majority of players won't get cloudflare captchas (hcaptcha), that only tends to come up if you're using a VPN or new device without any prior cache.


And thank god for that as hcaptcha is just awful - is better than it was though at least.
source

Mentions: An end to Captchas? Cloudfare speaks on the issue. · Captcha - a pain in the arse · How many have been fcuked up by hCaptcha ?

tobytorn [1617955] · #16
TL;DR Add "www.gstatic.cn/recaptcha/" to the Content-Security-Policy HTTP header to resolve the reCaptcha issue in China.

After changing reCaptcha's domain to recaptcha.net as suggested by OP, all reCaptcha resources can be smoothly accessed from China now. However, reCaptcha loads a script "recaptcha__en.js" from a geolocation-dependent domain, which is blocked by Torn's Content Security Policy. This script is usually loaded from "www.gstatic.com". But when accessed from China, reCaptcha decides to load this script from "www.gstatic.cn", which is not whitelisted by the Content-Security-Policy header and thus blocked by the browser. See the screenshots below for details.

Torn reCaptcha shown successfully. The script is loaded from "www.gstatic.com" which is in the whitelist.

[image: i.imgur.com]


Torn reCaptcha accessed from China. The script is loaded from "www.gstatic.cn", which is not in Content-Security-Policy and thus blocked by the browser.

[image: i.imgur.com]


Torn's Content-Security-Policy, whitelisting "www.gstatic.com/recaptcha" but not "www.gstatic.cn/recaptcha"

[image: i.imgur.com]


I also try to disable Chrome's CSP using the "Disable Content-Security-Policy" extension and then access Torn from China (without VPN). The reCaptcha shows up and works perfectly, which confirms that CSP is the root cause.

Could you please add "www.gstatic.cn/recaptcha/" to the Content-Security-Policy HTTP header for the whole site? That should resolve the reCaptcha issue for Chinese players, not only for the challenge before gym/crime, but also for registration and the occasional bot hunter challenge.
bingri [1523812] · #18
So could you please add "www.gstatic.cn/recaptcha/" to the Content-Security-Policy HTTP header for the whole site?

Thank you very much!

@chedburn @bogie