Using Google's reCapatcha in phpBB

Do not post support requests, bug reports or feature requests. Discuss phpBB here. Non-phpBB related discussion goes in General Discussion!
Suggested Hosts
Post Reply
User avatar
Ancient Viking
Registered User
Posts: 408
Joined: Sun Jan 15, 2012 11:43 pm

Using Google's reCapatcha in phpBB

Post by Ancient Viking » Wed Sep 05, 2018 12:23 am

Earlier this year Nexus implemented Google's reCapatcha, just to prevent bots from getting access to peoples account on Nexus.

It looks like this picture and I have been thinking about setting up Google's reCapatcha on my own site too.

Has the phpBB team talked about it or is it too new?
My local forum: egetforum.nu - Offline Forum Online!

User avatar
Brf
Support Team Member
Support Team Member
Posts: 51402
Joined: Tue May 10, 2005 7:47 pm
Location: {postrow.POSTER_FROM}
Contact:

Re: Using Google's reCapatcha in phpBB

Post by Brf » Wed Sep 05, 2018 1:42 am

Recaptcha has been available in phpBB’s registration for years now.

User avatar
bonelifer
Community Team Member
Community Team Member
Posts: 3403
Joined: Wed Oct 27, 2004 11:35 pm
Name: William
Contact:

Re: Using Google's reCapatcha in phpBB

Post by bonelifer » Wed Sep 05, 2018 12:26 pm

The "I'm a Person" version is in 3.2. The new Invisible version would probably have to wait till 3.3. Someone could however create an extension to add to add it.
Knowledge Base | phpBB Board Rules | Search Customisation Database
Image
Please don't contact me via PM or email for phpBB support .

User avatar
stevemaury
Support Team Member
Support Team Member
Posts: 49650
Joined: Thu Nov 02, 2006 12:21 am
Location: The U.P.
Name: Steve
Contact:

Re: Using Google's reCapatcha in phpBB

Post by stevemaury » Wed Sep 05, 2018 1:51 pm

Ancient Viking wrote:
Wed Sep 05, 2018 12:23 am
Earlier this year Nexus implemented Google's reCapatcha, just to prevent bots from getting access to peoples account on Nexus.
How would a CAPTCHA have anything to do with accessing a particular account? The password would still be needed.
For REALLY good and VERY inexpensive hosting CLICK HERE

I can stop all your spam. PM or email me.

All unsolicited PMs will be ignored.

User avatar
Ancient Viking
Registered User
Posts: 408
Joined: Sun Jan 15, 2012 11:43 pm

Re: Using Google's reCapatcha in phpBB

Post by Ancient Viking » Wed Sep 05, 2018 6:16 pm

stevemaury wrote:
Wed Sep 05, 2018 1:51 pm
Ancient Viking wrote:
Wed Sep 05, 2018 12:23 am
Earlier this year Nexus implemented Google's reCapatcha, just to prevent bots from getting access to peoples account on Nexus.
How would a CAPTCHA have anything to do with accessing a particular account? The password would still be needed.
This is the reason why Dark0ne, the owner of Nexus, decided to use reCapatcha on Nexus.
My local forum: egetforum.nu - Offline Forum Online!

User avatar
Dog Cow
Registered User
Posts: 2491
Joined: Fri Jan 28, 2005 12:14 am
Contact:

Re: Using Google's reCapatcha in phpBB

Post by Dog Cow » Thu Sep 06, 2018 9:11 am

stevemaury wrote:
Wed Sep 05, 2018 1:51 pm
Ancient Viking wrote:
Wed Sep 05, 2018 12:23 am
Earlier this year Nexus implemented Google's reCapatcha, just to prevent bots from getting access to peoples account on Nexus.
How would a CAPTCHA have anything to do with accessing a particular account? The password would still be needed.
The same reason that a CAPTCHA has anything to do with registering a new account.
Moof!
Mac GUI Vault: Retro Apple II & Macintosh computing archive.
Inside Allerton bookMac GUIMac 512K Blog

User avatar
stevemaury
Support Team Member
Support Team Member
Posts: 49650
Joined: Thu Nov 02, 2006 12:21 am
Location: The U.P.
Name: Steve
Contact:

Re: Using Google's reCapatcha in phpBB

Post by stevemaury » Thu Sep 06, 2018 6:00 pm

No CAPTCHA prevents getting access to accounts. It may make logging on with that access more difficult. The post linked by Ancient Viking explains that the CAPTCHA was implemented AFTER the accounts were breached to make their use more difficult.
For REALLY good and VERY inexpensive hosting CLICK HERE

I can stop all your spam. PM or email me.

All unsolicited PMs will be ignored.

User avatar
Ger
Recognised Extension Developer
Posts: 1774
Joined: Wed Jan 02, 2008 7:35 pm
Location: 192.168.1.100
Contact:

Re: Using Google's reCapatcha in phpBB

Post by Ger » Fri Sep 07, 2018 2:59 pm

That forum runs on an old version of IPB; 3.x if I'm not mistaken. They had a serious flaw storing their passwords as

Code: Select all

md5( md5($hash) . md5($password) );
So I wouldn't be surprised if those passwords were compromised. Once some hacker has a list of passwords he can try to login using a script. That script will fail if suddenly a captcha is required.

In the end the captcha doesn't do anything at all to prevent breaching the accounts.
My extensions:
Simple CMS, Feed post bot, Avatar Resize, Modbreak, Magic OGP, Live topic update, Modern Quote, Quoted Where (GDPR) and Autoresponder.
Newest: FAQ manager for 3.2

Like my work? Buy me a coffee to keep it coming. :ugeek:
-Available for custom work-

Louis235
Registered User
Posts: 1
Joined: Sat Oct 13, 2018 4:33 am

Re: Using Google's reCapatcha in phpBB

Post by Louis235 » Tue Oct 16, 2018 6:47 am

I have not seen any problems with "spam" registrations since I moved over to Google reCaptcha.

User avatar
Lumpy Burgertushie
Registered User
Posts: 65206
Joined: Mon May 02, 2005 3:11 am
Contact:

Re: Using Google's reCapatcha in phpBB

Post by Lumpy Burgertushie » Tue Oct 16, 2018 3:33 pm

not the point. the captcha is used when registering. that is not the same thing as accessing an account that is already in place.

once you have registered there is no need for a captcha during login.


robert
I am available for custom work on a donation basis. Please send me a PM with your needs.

Premium phpBB 3.2 Styles by PlanetStyles.net

OK, so what's the speed of dark?

User avatar
Ancient Viking
Registered User
Posts: 408
Joined: Sun Jan 15, 2012 11:43 pm

Re: Using Google's reCapatcha in phpBB

Post by Ancient Viking » Thu Oct 18, 2018 8:36 am

Louis235 wrote:
Tue Oct 16, 2018 6:47 am
I have not seen any problems with "spam" registrations since I moved over to Google reCaptcha.
I would like to know how to use Google's reCaptcha on my site and if it matters I already have https:// in place.

What do I need to do?
My local forum: egetforum.nu - Offline Forum Online!

User avatar
Mick
Support Team Member
Support Team Member
Posts: 20237
Joined: Fri Aug 29, 2008 9:49 am
Location: Cardiff

Re: Using Google's reCapatcha in phpBB

Post by Mick » Thu Oct 18, 2018 8:55 am

In order to use reCaptcha, you must create an account on www.google.com/recaptcha. Then go to spambot countermeasures, select reCaptcha, configure and fill in the blanks.
"The more connected we get the more alone we become" - Kyle Broflovski

There are no ‘threads’ in phpBB, they are topics.

Swanny
Registered User
Posts: 425
Joined: Sun Apr 14, 2002 2:11 am
Location: Canada

Re: Using Google's reCapatcha in phpBB

Post by Swanny » Tue Oct 30, 2018 12:44 am

Does phpBB plan on supporting reCaptcha v3? Details @ https://developers.google.com/recaptcha/docs/v3

sakm
Registered User
Posts: 510
Joined: Sun Jan 21, 2007 8:14 pm
Location: Hull, uk
Name: Stu
Contact:

Re: Using Google's reCapatcha in phpBB

Post by sakm » Sat Nov 03, 2018 9:35 pm

I thought reCapatcha had been broken by bots already?

User avatar
Mick
Support Team Member
Support Team Member
Posts: 20237
Joined: Fri Aug 29, 2008 9:49 am
Location: Cardiff

Re: Using Google's reCapatcha in phpBB

Post by Mick » Sun Nov 04, 2018 10:40 am

It has been compromised a few times, the last time was in May I believe and a patch was issued. There are many discussions about it's *past* vulnerabilities on the web.
"The more connected we get the more alone we become" - Kyle Broflovski

There are no ‘threads’ in phpBB, they are topics.

Post Reply

Return to “phpBB Discussion”

Who is online

Users browsing this forum: Yandex [Bot] and 40 guests