Page MenuHomePhabricator

Remove the CAPTCHA label hack from ConfirmEmailHooks::onAuthChangeFormField
Closed, ResolvedPublic

Description

Background

GrowthExperiments (tries to) manipulate with the default behaviour of the CAPTCHA extension. Specifically, ConfirmEmailHooks::onAuthChangeFormField attempts to adds a "what is this?" link, see the message as an example.

Problem

There are two problems with this hack. Most importantly, changing the label is a highly unusual integration with ConfirmEdit (the extension powering CAPTCHA). Non-standard integrations are error-prone, which brings me to the second problem...

...During several tries, I was actually unable to reproduce this behaviour. The CAPTCHA field in create account looks always the same, regardless of whether GrowthExperiments is enabled. Below, you can find screenshots from enwiki and enwikivoyage (those two projects were picked, as enwiki has GrowthExperiments, and enwikivoyage doesn't).

enwiki screenshotenwikivoyage screenshot
image.png (288×335 px, 26 KB)
image.png (269×315 px, 22 KB)

I'm also unable to trigger the link on other Growth projects.

Solution

Given the link broke and no one complained (likely for months, if not years), I propose to remove the code powering this capability. If we do not want to remove it, I suggest to move it to ConfirmEdit itself (upstreaming it), where it can be done in a sustainable way.

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

@KStoller-WMF Would you be okay with us dropping the (now-broken) feature? Or is that something we should fix by upstreaming? What do you think?

Personally I think any sort of "What is this?" help message seems like unnecessary noise for any modern web user, and I agree it seems like we should just simplify and remove the broken code.

Side note: Won't this code be totally irrelevant in the future as we shift to a new captcha system anyway? AKA the hCaptcha work the Product Safety and Integrity team is working on.

Feel free to move to Up Next if this is a small fix you think we should consider ASAP.

Personally I think any sort of "What is this?" help message seems like unnecessary noise for any modern web user, and I agree it seems like we should just simplify and remove the broken code.

Side note: Won't this code be totally irrelevant in the future as we shift to a new captcha system anyway? AKA the hCaptcha work the Product Safety and Integrity team is working on.

Yes, but a full rollout might be some months away, and is not guaranteed. So an interim fix is probably a good idea, assuming it is not a large amount of time.

Change #1199864 had a related patch set uploaded (by Bartosz Dziewoński; author: Bartosz Dziewoński):

[mediawiki/extensions/GrowthExperiments@master] Remove outdated signup form CAPTCHA customizations

https://gerrit.wikimedia.org/r/1199864

Change #1199864 merged by jenkins-bot:

[mediawiki/extensions/GrowthExperiments@master] Remove outdated signup form CAPTCHA customizations

https://gerrit.wikimedia.org/r/1199864