Ghostery is blocking reCAPTCHA v3 API key in Chrome

[MarkoSulamagi]

Description

Ghostery blocks reCAPTCHA v3 API key in Chrome. This only happens with one specific API key and only on my own Chrome browser. This leads me to think there's some kind of learning algorithm in Ghostery and given enough time/traffic the block will appear for other people/API keys eventually as well.

If I change the Site Key then Ghostery won't block it for me anymore.

Expected Behavior

I'd expect reCAPTCHA v3 to work for chrome (regardless if the site is trusted, on default settings, or restricted).

Actual Behavior

Issue is in Chrome (Version 84.0.4147.89 (Official Build) (64-bit)). On my own browser and laptop with specific reCAPTCHA API key (works fine with Chrome on other laptops)

There are different scenarios:

1. If the site is marked as trusted then the CAPTCHA is allowed (good)
2. If Ghostery settings are marked as "Restrict Site" then the following API is blocked by ghostery: (bad)
   https://www.google.com/recaptcha/api.js?render=[SITE_KEY]&onload=ng2recaptchaloaded
3. If Ghostery is on default settings something else weird happens. The initial request to the reCAPTCHA API gets "Internal Redirect" and then Ghostery tries to execute the same request again, but changes the SITE_KEY to word ghostery (and this will obviously fail).

Steps to Reproduce

I only see this issue on my own browser's chrome. I haven't been able to replicate it with other API keys, other browsers, or on chrome with another laptop (using the same API key).

I created a fiddle with reCAPTCHA. But I don't know how to replicate the "blocking" scenario in Ghostery (it seems to be specific to my browser and API key combination). https://jsfiddle.net/xnwL8t4a/

Versions

• Browser: Chrome Version 84.0.4147.89 (Official Build) (64-bit) *
• OS: Ubuntu 20.04

[christophertino]

We pushed an Anti-Tracking whitelist update for this issue a little while back. Can you let us know if you're still seeing the API key scrubbed?

[MarkoSulamagi]

@christophertino, it seems to be working nicely for me now 👍
Hopefully, the whitelist update fixed it and it wasn't as a result of my browser cache clearing. I'll close the issue and re-open if it should come back.

Thanks :)

[bencmbrook]

I'm getting the exact same issue but with recaptcha.net which is Google's alt URL for reCAPTCHA
(https://developers.google.com/recaptcha/docs/faq#can-i-use-recaptcha-globally)