[Bug 32125] Should support auth using captcha

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=32125

--- Comment #42 from Simon McVittie <simon.mcvittie at collabora.co.uk> 2012-02-14 06:36:55 PST ---
(In reply to comment #41)
> What if protocol specifies the label anyway even if the challenge is,
> say, OCR?

(XMPP does.)

Then we give the Handler as much information as possible, and let it make its own decision depending on UI policy and the value of Language: it can either
display what the server gave it, or its own translated string; or even something like displaying the server's string if its Language matches the current
locale, or both strings if not.

> And most of all, what if a friendly proprietary protocol implements
> the captcha type "lotsofcrap" which actually requires a label? I'd
> rephrase that part so that label should be set to an empty string if the
> protocol does not supply one.

I don't think the current spec rules out that behaviour. It does say CMs SHOULD NOT emit an empty label for "qa", but only because that's meaningless and
unsolvable.

If a Handler implements the lotsofcrap challenge type, it needs to know enough about it to display it usefully, in which case it could easily extend the
"ignore (CM or server is broken) if no label" rule to it.

Or please propose wording (as a spec patch) if you have a better version?

> Or actually, if you really intend to always provide the label from the
> handler unless it's part of the challenge (which makes sense),

I intend to *allow* Handlers to have that behaviour, but not *require* it. As a general design principle, telepathy-spec doesn't make UI decisions.

> wouldn't it
> make sense to
> ditch the label property in the structure, and provide the label in the
> payload instead?

I did consider putting the "qa" question in as a "text/plain" payload, but there doesn't seem a whole lot of point in special-casing it, if labels exist at
all.

One difference between "qa" and the others is that for any other captcha type, you're expected to display the Label (or your own localized version of it) *and*
the payload, whereas for "qa" (afaics) you're expected to display the Label (question) only:

  /-[Captcha]---------------\           /-[Captcha]---------\
  | Type the words you see: |           | What is 2+2?      |
  | /------------------\    |      vs.  |                   |
  | | spleen Belgium   |    |           | [_______________] |
  | \------------------/    |           \-------------------/
  | [_____________________] |
  \-------------------------/

-- 
Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA Contact for the bug.