Logging in to geocaching.com not working (Captcha problem)

[gotiniens]

About on hour ago c:geo suddenly stopped being logged in. While I logged some finds just before.

Checked username and password via browser they are correct.
Also did a factory reset for c:geo. Not working. I keep getting the wrong username/password notice

Logfile seems not very helpful:
-------- beginning of system
--------- beginning of main
09-23 22:54:10.478 17193 17233 W cgeo : [network--2] Login.login: No login information stored
09-23 22:54:34.674 17193 17193 I cgeo : [main] Requesting settings backup with settings manager
09-23 22:54:34.697 17193 17193 D cgeo : [main] LocationProvider: requesting most precise locations
09-23 22:54:34.703 17193 17257 W cgeo : [network--5] Login.login: No login information stored
09-23 22:54:37.597 17193 17193 I cgeo : [main] Added '/storage/emulated/0/Android/data/cgeo.geocaching/files' as available external dir
09-23 22:54:40.072 17193 17223 D cgeo : [looper callbacks] LocationProvider: stopping location requests
09-23 22:54:42.202 17193 17193 I cgeo : [main] Requesting settings backup with settings manager
09-23 22:55:03.867 17193 19687 D cgeo : [OkHttp] POST https://www.geocaching.com/account/logout
09-23 22:55:04.600 17193 19687 D cgeo : [OkHttp] 403 [Forbidden] (731 ms) POST https://www.geocaching.com/account/logout (http/1.1)
09-23 22:55:04.604 17193 19687 D cgeo : [OkHttp] GET https://www.geocaching.com/account/signin
09-23 22:55:04.782 17193 19687 D cgeo : [OkHttp] 200 (178 ms) GET https://www.geocaching.com/account/signin (http/1.1)
09-23 22:55:04.824 17193 19687 D cgeo : [OkHttp] POST https://www.geocaching.com/account/signin
09-23 22:55:04.984 17193 19687 D cgeo : [OkHttp] 200 (160 ms) POST https://www.geocaching.com/account/signin (http/1.1)
09-23 22:55:05.005 17193 17258 I cgeo : [network--6] Failed to log in Geocaching.com as Gotiniens because of wrong username/password

--- System information ---
Device: ONEPLUS A6013 (OnePlus6T, OnePlus)
Android version: 10
Android build: ONEPLUS A6013_41_200717
c:geo version: 2020.08.04
Google Play services: enabled - 20.33.15 (120400-330018294)
Low power mode: inactive
Compass capabilities: yes
Rotation vector sensor: present
Orientation sensor: present
Magnetometer & Accelerometer sensor: present
Direction sensor used: rotation vector
Hide caches: -
Hide waypoints: -
HW acceleration: enabled (default state)
System language: nl_NL
System date format: dd-MM-y
Debug mode active: no
System internal c:geo dir: /data/user/0/cgeo.geocaching (152,5 GB free) internal
User storage c:geo dir: /storage/emulated/0/cgeo (152,5 GB free) external non-removable
Geocache data: /storage/emulated/0/Android/data/cgeo.geocaching/files/GeocacheData (152,5 GB free) external non-removable
Database: /data/user/0/cgeo.geocaching/databases/data (156,0 KB) on system internal storage
Fine location permission: granted
Write external storage permission: granted
Geocaching sites enabled:
geocaching.com: Not logged in (Geen login informatie opgeslagen)
Geocaching.com date format: MM/dd/yyyy
Installed c:geo plugins: none
--- End of system information ---

[gotiniens]

Extra info: logging in with geocaching.com account. Username and password are copied with help of password manager. After accidental removal of app en re-install still same issue

[Lineflyer]

This looks like our current investigated issue.
Can someone instruct @gotiniens to provide the needed debug to finally get this issue tackled?

[geocachermgo]

A description was given in #8818 by @moving-bits #8818 (comment)

[fm-sys]

A description was given in #8818 by @moving-bits #8818 (comment)

This will not work as @gotiniens is using our latest release version...

Would it be ok for you to install the debug apk from #9025 (click here to start download)?

[moving-bits]

@gotiniens
Thanks for reporting this issue. It is well known to us, but, alas, not reproducible, and we haven't been able to get a grip on it yet.

If you have the time you could help us by installing a special build of c:geo with extended logging.

For this please use the following steps:

• do a database and settings backup of c:geo (using c:geo's internal functions)
• install the APK for the (special build from #9025)
• Create a file log.properties in a directory logfiles under your main cgeo directory with the following content:
  logging.minlevel=DEBUG
  logging.mincallerinfolevel=WARN
  logging.throwonerror=false
  (This is to activate a certain log level in c:geo. File can (and should) be deleted or renamed after the issue has been resolved.)
• activate logging using Settings => System => Debug
• Then restart c:geo and try to login.
• After that, go to Settings => System => Generate logfile and choose "Extended".
• You should now have a couple of log files in the "logfiles" directory beneath your c:geo directory, their filenames starting either with "logfile" or with "login". Please send those files to our support e-mail address
• After the logfiles have been written, you can rename/delete the log.properties file and disable the debugging in the settings.
• If you like to you can revert to the release version of c:geo using the following steps:
  • uninstall c:geo
  • install c:geo from Play Store
  • restore database and settings from the backup you made in the first step

Thanks for your support!

[gotiniens]

I just send the logfiles to the support address.With my limited knowledge of the app, I think there is a pretty clear error message in there.

Also, I assume my password is not somewhere in the logfiles?

[Lineflyer]

I forwarded the information to our internal developer mailing list instead posting here to avoid posting any personal information which might be contained.

Thanks @gotiniens , we will have a look into it.

[rsudev]

I took a brief look into the log (@gotiniens no password or other personal information in there), even though I am likely not bale to tackle this code-wise right now.
The main difference I could spot up-front to my login page is the presence of a <div class="g-recaptcha"-Element in the signin form part. Seems like gs is requiring to solve a re-captcha for some. Not sure if we can handle that...

[Lineflyer]

In the past we had recaptcha blocking login only in case "suspicious" IP ranges are used.

@gotiniens
Are you using any kind of VPN or anonymizer?

[gotiniens]

I am running https://adaway.org/ from f-droid. I disabled the application and it did not help.

I have send new log files with AdAway disabled to the support address

[Lineflyer]

@gotiniens
Which country are you located or to be more precise, which country is the IP address you are using associated with (e.g. according to whois)?
Are you connected via a public network (e.g. open Wifi hotspot)?
Can you try to use another IP (e.g. mobile network instead of Wifi)?

[gotiniens]

I only use my own WiFi connection, or my 4g connection.

All my ip addresses are dutch, adn that is also the country that i'm in.

Using my other providers I could authorize C:Geo

I have send new log files

[Lineflyer]

Lets wait for a detailed analysis of the problematic case by other developers.

But in case it is really a recaptcha issue as suspected by @rsudev , then for some reason gc.com requires a captcha for some of your source IP for whatever reason.

I am not sure if we can solve that issue as recaptcha is targeted to avoid such automated logins like c:geo is doing at this point.

[gotiniens]

I checked on my laptop, when using the provider where I cannot authorize I get an reCAPTHCA when trying to login to geocaching.com

Connected to an accespoint set up by my phone, using my 4G providers I do not get en reCAPTCHA.

So that theory seems pretty plausible

[Lomanic]

cgeo could at least report to the user that a captcha is required to be solved, and hence cgeo was not able to authenticate against the website.

@gotiniens if you authenticate successfully on GC.com with the captcha solved, and logout from the site or erase your cookies, is the captcha still there on the login page?

[geocachermgo]

Is there a difference between cgeo login, use of login page and the automatic browser login via cookies?

[gotiniens]

I logged in with an Incognito window using the reCAPTCHA, closed the incognito window, opened a new incognito window, and was presented with a reCaptcha.

[eddiemuc]

Idea of mine (maybe dumb...):
When c:geo detects that a captcha is required, can't it just redirect the user to the gc.com login page using a browser tab, let the user log in there (including captcha validation), then close that browser tab, then let the user enter credentials in c:geo again? (this is assuming that captcha will then be gone)?
afair when authenticating with oc.de I was also redirected to some browser page.

[SammysHP]

Another idea: If automatic login fails, allow the user to open the login form in an internal browser (webview) and after login grab the cookies.

[rsudev]

Idea of mine (maybe dumb...):
When c:geo detects that a captcha is required, can't it just redirect the user to the gc.com login page using a browser tab, let the user log in there (including captcha validation), then close that browser tab, then let the user enter credentials in c:geo again? (this is assuming that captcha will then be gone)?
afair when authenticating with oc.de I was also redirected to some browser page.

It is unlikely that the recaptcha will not be shown on the next attempt (if it was e.g. triggered by the ip-address as it seems in this case)

[SammysHP]

It should also be possible to auto-fill username and password fields by injecting some JavaScript into the webview.

[eddiemuc]

It is unlikely that the recaptcha will not be shown on the next attempt (if it was e.g. triggered by the ip-address as it seems in this case)

I could produce the captcha after simply entering a wrong password three times on login. When I then logged in correctly one time, the captcha was gone the next time. In this case the assumption would work. But you are right, if geocaching places some sort of "permanent" condition onto captcha display this would not work. Are you sure captcha is triggered by IP adresses?

[rsudev]

I could produce the captcha after simply entering a wrong password three times on login. When I then logged in correctly one time, the captcha was gone the next time. In this case the assumption would work. But you are right, if geocaching places some sort of "permanent" condition onto captcha display this would not work. Are you sure captcha is triggered by IP adresses?

I am not sure of course, but the tests described by @gotiniens at least hint in that direction.

[Lineflyer]

Are you sure captcha is triggered by IP adresses?

Yes, because we had a user in the past, who used TOR anonymizer permanently and always had login problems with c:geo due to captcha.

[Lineflyer]

The first help for me (on support) would be to correctly identify different login problems and provide proper error messages for each (e.g. for the captcha error, that users should check if they use any VPN service and try without it or change the network/IP).

[moving-bits]

Thanks for creating (@gotiniens) and forwarding (@Lineflyer) the logfiles. I'll investigate and start working on a "captcha warning message" first.

@Lineflyer
How about creating a FAQ entry for what to do if a "Login error due to recaptcha" has been detected?

[moving-bits]

@gotiniens
I've updated the special build for #9025 to include a captcha check. Can you retest using the (new APK).

It should show you a message like "Login failed: Captcha required. Please refer to our FAQ for guidance.".

[gotiniens]

@moving-bits That seems to work correctly,

Using my WIFi I get the message as you said.
On 4G I can authorize succesfully

Do you need further log files?

[moving-bits]

@gotiniens
Thanks for cross-checking. No further logfiles etc. required for now.
I will add the captcha check in the upcoming release.

Whether we can mitigate the captcha problem is a different story, though...

[fm-sys]

Why c:geo doesn't store the login cookies?

That would help a lot for users where login via wifi connection works but not via mobile data (or vise versa). Also it would speed up the login process for everyone...

[Lineflyer]

While smoke testing the current release I tend to follow always same routines.
Besides other tests I also test with a basic member account and forgot, that I changed the password for that account.

I ran into the Captcha problem while first using the old one, seemingly due to the above mentioned captcha enforcement on consecutive login fails. This was not the case last time I had this problem.

So my assumption regarding the higher occurrence of the captcha problem would be, that this is a new setup on geocaching.com to enforce captcha on consecutive login failures.
AFAIK from c:geo this does not even need consecutive login tries explicitly by the user, but we regularly try to login if it failed during the session (or not??). This means, that if the user entered a wrong password and does not immediately correct it, he will trigger the captcha as c:geo will try to login during usage from time to time.

[Lineflyer]

Since we now have an explicit error message to the user for the "Captcha problem" combined with a details "What do to in case" in our FAQ, there have been no users since then contacting our support with this problem.

I think thats all we can do for this Captcha case.

[Lomanic]

As written in #9056 (comment) cgeo could store authenticated cookies to reduce the burden of users having to solve a captcha every time in this case. Last time I checked, I think cgeo was not doing that.

[FutureCow]

I got the same problem, using my WiFi triggers the captcha, using my mobile connection I can login.

[Wim-T]

I also have the chaptcha problem. Always, with 4G provider, and also with wifi. So its impossible for me to use cgeo

[Jwolter0]

I am having the same problem, on WiFi and 5G, effectively keeping me from Geocaching all this year. I'm a strong proponent of open source software, but I may need to abandon C:Geo until this is fixed.

Also the message that @moving-bits inserted ("Login failed: Captcha required. Please refer to our FAQ for guidance.") is good, except that I could find nothing in the FAQ about this topic.

[MagpieFourtyTwo]

@Jwolter0

except that I could find nothing in the FAQ about this topic

Pls. check out FAQ "Login problems", chapter "5. Possible error messages", Headline "Login failed: Captcha required"