Captcha failed to display

Question

I just got a failure with the captcha system. Sequence of events:

1. Answered a question
2. The OP changed the question such that my previous answer didn't apply, so I deleted that answer
3. Wrote a new answer that answered the new question
4. Got a captcha display with the usual robots picture and the "I'm a human being" button
5. There was NO captcha display or box to enter anything
6. Pressing the "I'm a human being" button said I didn't enter the words correctly
7. Tried several times to add a new answer, with the same results as above
8. Gave up and undeleted and edited my previous answer instead, which worked without any captcha required

I'm using Firefox 4 on Windows 7 with HTTPS Everywhere installed. (I'm sure that I've successfully used the captcha after installing HTTPS Everywhere several weeks ago.)

Answer 1

It seems Google nowadays wants sites to use www.google.com/recaptcha/api/ rather than api.recaptcha.net. The old domain redirects to the new URL, and Google recently stated it will continue doing so.

However, Google has recently stopped HTTPS support for the old domain:

IMPORTANT: changes to reCAPTCHA SSL API (api-secure.recaptcha.net) on April 11

In April, we will begin to turn down the legacy URL for reCAPTCHA's HTTPS API. If your site uses reCAPTCHA over SSL, you will need to make a minor code change before April 11.

[...]

FYI, we are now purposely serving an expired SSL certificate for api-secure.recaptcha.net. This is expected behavior.

HTTPS Everywhere rewrites api.recaptcha.net to the obsolete api-secure.recaptcha.net. This https://api-secure.recaptcha.net/challenge?k=6Ld... still works with a warning, but apparently fails silently when embedded in another web page.

But the new URL from the documentation, https://www.google.com/recaptcha/api/challenge?k=6Ld..., is fine for both HTTP and HTTPS. So: though not officially required, maybe the Stack Exchange HTML could be changed to adhere to the current documentation? Without any additional work, that would magically also make add-ons such as HTTPS Everywhere work again.

In the meantime, in HTTPS Everywhere: how about an exception for api.recaptcha.net, or some rewrite to https://www.google.com/recaptcha/api for that domain?

Answer 2

We're using a ReCaptcha supplied library, and it's still* emitting the old API paths.

Frankly, if Google doesn't think its worth fixing I don't. Furthermore, its only a problem because HTTPS Everywhere is re-writing to the (now) incorrect url.

<rule to="https://api-secure.recaptcha.net/" from="^http://api\.recaptcha\.net/"/>

in \chrome\content\rules\GoogleAPIs.xml.

_{*We were on an older library version, so I've kicked us up to the latest. Both link in the same resources.}