Hi OpenRent, hope the weekend is going well!
I would like to suggest some improvements to the CAPTCHA process.
Currently it seems CAPTCHA requests only happen when a user clicks a link or refreshes the browser. This is far more cumbersome and less efficient than if the CAPTCHA validation process was automated and streamlined into areas where it is needed, such as searching for properties and reporting issues with adverts. As is common with many websites you don’t need to interact with the site to receive a CAPTCHA puzzle request. This loads automatically and access is suspended or greatly reduced until it is solved. A modal may load that grabs the attention of the user while functionality is reduced until it is solved. On Openrent (this appears to be sitewide) CAPTCHA relies on user interaction and not automated checks on current CAPTCHA validation state. It is more passive rather than active which reduces the functionality of the website and may catch some users, particularly less computer savvy ones off guard essentially denying them access to the site. It’s also really annoying having to refresh every few minutes just to keep up with CAPTCHA TTL.
I’ve reported a few ads and found that the CAPTCHA TTL is very short (less than a few minutes in many examples) so if I report one ad and that goes through without the need to complete a CAPTCHA the next one will not but it won’t tell me why and instead I’m just met with a form that does not send, or an error message but no user friendly status message to say I failed or did not complete CAPTCHA. It’s also the same with the dashboard. Dashboard property listings do not detect CAPTCHA state so they become unusable and without notification to the user they must again complete a CAPTCHA but not be notified until they start this process. Image carousel in the property listing for example will not work but no notification and no CAPTCHA request. Only when interacting with a link will the CAPTCHA request appear.
Questions about the “simple sign on” process
I also have some questions about the sign-on process. Using the normal login flow there is an error message that states “We cannot communicate with your email provider”. I’m confused what is going on here because it’s not customary to communicate with an email provider when logging in. Validation of an email addresses would usually be a significant security/privacy flaw in email hosting as requests could essentially produce entire dumps of email addresses that match. It’s unlikely OpenRent is attempting to validate an email address. To test this out, I used a hotmail and gmail address an as example (I use privacy focused email which have more obscure domains and sometimes catch out validation when signing-up/logging in) and these also triggered this issue. I am then asked to use the “simple sign-on” flow. I have to admit, this feels a bit gimmicky and also frustrating because I often have to navigate to the “simple” login page in order to access my account.
Thanks for reading and looking forward to your response!