Is Google ReCaptcha v2 HIPAA compliant? - recaptcha

All is in the title.
I have been looking for a while and couldn't get a clear answer:
Something like Google itself stating in its documentation that it's HIPAA compliant.
If not. Why? What is exactly not compliant and is there a way to resolve it? For example, by blocking the google cookie beyond the user creation page.

Related

Is it possible to dynamically query Google APIs to see how much of the limit/quota you've used?

For a given Google API, is there any way to dynamically check usage against any of the current limits for that API?
For example, this page https://developers.google.com/classroom/limits?hl=en shows that I can query the Classrooms API 4,000,000 times per client per day. At midday, without going to the API Console, how could I know that I've already hit 3 million queries?
I'm hoping that there's a billing or usage API that covers this, but can't see it.
Note: I'm not having any issue right now with a specific call, just anticipating that my usage will scale up significantly in the next few months, so am looking for a solution for monitoring rather than advice on not hitting the limits at all. My specific use-case is for Google Classrooms, but reading wider around this I can't see a general solution either.
Answer:
No, dynamically you can't retrieve this information.
Feature Request:
You can however let Google know that this is a feature that is important for the Google Workspace APIs to have, and that you would like to request they implement it.
The page to file a Feature Request for the Google Classroom API is here, as there is no specific component for Google Workspace APIs in general I would suggest filing it here instead.
You can use Google's Cloud Monitoring API to achieve this. This is the documentation page for APIs-
https://cloud.google.com/monitoring/api/v3
This is the documentation page for concerned metrics-
https://cloud.google.com/monitoring/api/metrics_gcp#serviceruntime/quota/allocation/usage
https://cloud.google.com/monitoring/api/metrics_gcp#serviceruntime/quota/exceeded
https://cloud.google.com/monitoring/api/metrics_gcp#serviceruntime/quota/limit

Google reCAPTCHA in China

My site is using Google reCAPTCHA control but I am hearing its being block in
China, Is there anyway around this I see there is some people reporting that changing the API to https://www.recaptcha.net works in China?
Anyone try this because I see it still going out to google?
string apiUrl = "https://www.recaptcha.net/recaptcha/api/siteverify?secret={0}&response={1}";
As google says in his assistance page, you should use this domain "www.recaptcha.net" instead "www.google.com" on the api call.
First, replace src="https://www.google.com/recaptcha/api.js" with
src="https://www.recaptcha.net/recaptcha/api.js"
After that, apply the same to everywhere else that uses "www.google.com/recaptcha/" on your site.
Obtained from: https://developers.google.com/recaptcha/docs/faq#can-i-use-recaptcha-globally
Edit: to clarify on some of the comments, while if you try it outside of china yes you do get references to gstatic.com but if you try this in china, any references to gstatic.com are replaced with gstatic.cn (don't forget to add it to your SCP). So this solution is still valid.
IMHO, google things are not stable in China as it can be blocked anytime.
From Baidu threads, it also mentioned that sometime google recaptcha works, sometime it doesn't.
https://www.v2ex.com/t/492752 (Chinese)
In programming world ,unstable function means useless or more code for dealing with exception.
If you really need to use google recaptcha,
you would better test properly using VPN (IP in China) first.
Here are some options you can consider,
You can use alternative captcha
Google will tell you various captcha.
Build your own captcha
Open Source Invisible reCAPTCHA alternatives
Use proxy web server(nginx) to send and receive data to or from google recaptcha
I have shared the solution to this problem by using cURL.
https://stackoverflow.com/a/63568516/11910869
cURL acts as a middle man between the client and the server. So even if google.com/recaptcha can not be accessed by the client because it is blocked by the service provider, cURL can act as the proxy to send the HTTP requests and get the response.

Get user's email ID on Google Home

I'd want to get user's emailID from an Action on Google. I understand that Google Sign-In is the best way to do that. Even though I don't really need the user to sign in to the action, I think there is no other way to get user's email (please correct me if I'm wrong). But according to the documentation,
Google Sign-In for the Assistant is currently in developer preview. You can build Actions that use this feature, but they can't be published at this time.
However, Walgreens action does the same thing. I wanted to know how. I tried to search a lot, and ended up with these answers. I have done this already and it works. But I wanted to know, if there is any way to release an app using Google Sign-In.
If not, do I need to go through OAuth2.0 flow, and if so, I assume I'd need to have my own authentication system in place?
Please correct me if I'm wrong and help me find the best way to get user's emailID. I think there should be something easier than getting an authentication system in place and getting it to support OAuth2.
if there is any way to release an app using Google Sign-In.
You want the email id of the user. Google sign-in is nothing more than you getting the user's email address (inside a token that is signed by Google so you can verify it).
If you just get an email address as a "string" then you'd need to verify it before you can use it. So think of Google sign-in as an optimized UI flow to get a user's email address. Once you get the verified email address from Google, you can let them have access to the data on your site that is under that account.
Let me know if that is not clear.
From a timeline perspective, this should be out of developer preview within a month. Let me know if you want to try using it before that.
From my own research I think you are right. Until the Google Sign In account linking graduates from developer preview you would have to implement an OAuth workflow, which is a bit of a pain (although the implicit one doesn't look too bad). So perhaps the real question is ... when will Google Sign In account linking be fully available? Anyone from Google? Even a ballpark estimate would be useful.

xamarin.oauth /xamarin forms Facebook linkedin google authentification

I am new in Xamarin ,I am looking for a way to put facebook/linkedin/google authentication. I have looked at many tutorials but none of them is recent and there are not working well or there are obsolete.
Here is the tutorials, I have found: click to seeing the page
Do you know a recent and better one ?
There are many samples about how to authenticate users in facebook or google. And I find your article here in MSDN with a sample which runs in VS2015. Even though it's a little bit out of date, you can also find something useful.
You can also refer to the official documentation of Xamarin.OAuth and the sample here. Modify the information in Constants to your own's. This article specify how to register in Google and get the Client ID and Redirect URL.
You can read it more carefully then create your own UI to achieve authentication.

Testing Google's ClientLogin

I have a WPF form that uses ClientLogin to log a user into their Google account.
Specifically, I would like to test my CAPTCHA handling routing. I can't seem to get my account to generate a CAPTCHA.
Does anyone have any suggestions on how to reliably get the Google ClientLogin to ask for a CAPTCHA challenge for testing?
I've just spent quite a while trying to do exactly the same thing.
I found the answer here:
http://roobasoft.com/blog/2008/09/20/force-googles-clientlogin-to-require-a-captcha/
Basically you have to spam the ClientLogin service with bad credentials for a valid user email until it responds with a captcha request.
The page above provides a ruby script to do this, implement in a language of your choice!
cheers,
Pete

Resources