An Empirical Study and Evaluation of Modern CAPTCHAs
Modern CAPTCHAs are increasingly frustrating for legitimate users—especially those on VPNs, Tor, or with accessibility needs—while becoming less effective as bots, AI models, and paid “captcha farms” learn to solve them quickly and cheaply. Commenters argue this arms race is pushing the web toward other, often more privacy-invasive or exclusionary mechanisms such as device attestation, payment-card or ID verification, proof-of-work puzzles, or micropayments, raising concerns about anonymity, equity, and energy use. Many expect CAPTCHAs to linger for years despite their declining value, with some small sites instead relying on rate limiting and moderation rather than ever-harsher human tests.
User experience and accessibility
- Many describe CAPTCHAs as unusable or infuriating, especially image grids (“bicycles, buses, hydrants”) that can take minutes and often fail.
- Tor, VPNs, privacy-focused browsers, and anti-fingerprinting tools trigger disproportionate CAPTCHA “hell,” effectively punishing privacy.
- Ambiguity (“does this tiny corner count?”) and slow/never-loading images are common complaints.
- People with poor eyesight or elderly users are often blocked entirely; audio CAPTCHAs help some but not all. Several note this seems ripe for disability/ADA challenges.
Effectiveness vs. bots and AI
- Thread revolves around the claim that bots/AI can now outperform humans; commenters point to study table data but also note the study mainly measures human performance.
- Modern systems like reCAPTCHA reportedly rely more on behavioral analytics (mouse movement, timing, prior Google data) than the visible puzzle.
- Many note bots already bypass CAPTCHAs via paid human “captcha farms”; AI solvers would mainly cut costs and accelerate abuse.
- Others argue timing/jitter checks can be faked; it’s just another cat‑and‑mouse layer.
Alternatives proposed
- Identity or cost-based: payment-card validation, UPI-style systems, SMS/email from “reputable” providers, government or international IDs, social accounts, hardware keys, or proof-of-personhood schemes.
- Throttling and rate-limits: per-account or per-IP limits instead of puzzles, though CGNAT and large botnets undermine IP-based throttling.
- “Do nothing” for low-stakes sites: accept that public data will be scraped and bots will exist; focus on bandwidth budgets and moderation.
Proof-of-work and micropayments
- Some advocate computational PoW or crypto-like schemes (e.g., mCaptcha, browser mining) as a “cost per request” instead of human puzzles.
- Others raise concerns: energy waste, botnets with “stolen” CPU, mobile battery drain, and the rich/big-operator advantage.
- Micropayments via cards are constrained by fee floors; crypto-based variants raise complexity and abuse risks.
Privacy, identity, and device attestation
- Device attestation and “private access tokens” are seen by some as the next step and by others as a path to locked‑down, non-owner‑controlled devices and loss of anonymity.
- Worldcoin and similar biometric proof-of-humanity ideas draw strong dystopian and centralization worries.
Meta: study and HN
- Several note the HN submission title (“AI bots are now outperforming humans…”) was misleading relative to the paper’s actual title and focus.