I was just wondering out of interest. What happens if your captcha keys get compromised. What can they be used for and how can you detect that they have been compromised.


I assume you are talking about recaptcha keys. The answer is not much happens if your recaptcha secret key is compromised. As far as I know, the key is only used to verify the server's identity to google's api when verifying the user's response. Since the response can only be verified once, an attacker cannot use it to bruteforce the solution to the captcha and therefore cannot bypass the captcha simply by learning the secret key. The attacker can use recaptcha with your key, but since recaptcha is already free, there is no point in doing so.

As @ThoriumBR mentioned, the attacker can abuse the service in which case google will detect anomalous activity and block your account. This could result in DoS for your website while you try to clear up things with Google. Your service being suspended would be the most obvious indicator of your key having been compromised (atleast if google informs you why it was suspended).

  • 1
    There's one point: abusing it so your service gets suspended, you have to take it down briefly to fix the issue, and... – ThoriumBR Aug 25 '20 at 14:57
  • @ThoriumBR Right, I missed that. I'll add it to the answer. Thanks! – nobody Aug 25 '20 at 15:01

Not the answer you're looking for? Browse other questions tagged or ask your own question.