Wanting to go a step further into reducing the attacking surface from my "register new user" form I think on using reCAPTCHA (the one Google offers).
Having bots sorted out from being able to register and hence not being able to easily break my website seems good. And to what I understand reCATPCHA helps with keeping automated things from using my register form.
Anyway I started wondering. If the attackers had the consent of Google (which I use to determine the "attacker is a bot"-attribute), then there seems no way the Google reCAPTCHA can stop bots anymore.
In essence: If I import the Google reCAPTCHA feature into my protection-system for my website it will only protect against to the extend
- that reCAPTCHA itself cannot be bot-answered
- Google does not allow some bot to cheat.
Is my assumption true that importing something as reCAPTCHA functionality already opens potential doors for Google and their partners?
So Google reCAPTCHA can be bypassed by Google, right?
Update and further information
ajax.googleapis.com is loaded into the website. So if Google wanted to cheat… even here is plenty of chance :-(