Bot or human? Creating an invisible Turing test for the internet

Accessibility and User Experience Concerns

• Many worry behavior-based tests (mouse paths, typing cadence, JS challenges) will disproportionately harm people using keyboard navigation, screen readers, dictation, or password managers.
• People already report being rate-limited or blocked for “too fast” or “nonstandard” interaction patterns, with no clear feedback or recourse.
• Some argue this will further erode usability, especially for low-end devices that struggle with proof-of-work (PoW) challenges.

Effectiveness of Behavioral and Cognitive Detection

• Several commenters assumed mouse/typing patterns were already standard in tools like reCAPTCHA; others with industry experience say high-end solutions already rely on complex, proprietary signals.
• Bot builders in the thread claim they can already mimic such patterns and see this as just another hurdle.
• Skeptics cite games like Minecraft and anti-cheat history as evidence that “ghost clients” can spoof behavior under adversarial pressure.
• Supporters argue that end-to-end human cognition (e.g., Stroop-like interference) is still hard to replicate reliably, at least for now.

Arms Race, Economics, and PoW

• Goodhart’s law is invoked: once human-like behavior becomes the target, bots will optimize for it.
• PoW is seen by some as a better first-line defense (raising cost per request), but critics note compute asymmetry (botnets, specialized hardware) makes it fragile.
• Cheap human CAPTCHA-solving services mean any approach that’s only an economic speed bump can be bypassed if the reward is high enough.

Identity, Reputation, and Web of Trust

• Many suggest moving from “bot vs human” to identity/reputation:
  • Decentralized identifiers, government-backed or otherwise.
  • Zero-knowledge proofs tied to passports or NFC IDs.
  • Cross-site reputation or “certificates” that you’re not abusive.
• Opponents see these as privacy nightmares, easy to abuse for surveillance, tracking, monopolistic bans, and planned obsolescence.
• A more radical camp proposes decentralized webs of trust where each user locally scores others, with no central authority.

Critique of CAPTCHAs and Future with Agents

• Some see CAPTCHAs as fundamentally misguided: real problems are abuse and resource misuse, not whether a user is human.
• reCAPTCHA specifically is perceived as punishing privacy settings and feeding surveillance/AI training.
• Several predict most traffic will soon be via AI agents; what’s needed is authenticated agent APIs with economic incentives, not ever-more-intrusive CAPTCHAs.