Captchas like googles older “what are these two words” and “select the traffic lights” are just ways for google to get the public to provide label data for their AI tools anyway
they were; they’re not needed anymore. I trained a few ML models myself and I guarantee they had more than enough data to overfit by the first few months these captchas collected data. A paper from 2019 already showed a success rate of 97% (iirc) of automated models trying to solve these captchas, and trained on much less data. With all the data they collect you can be sure they don’t need any more of it for several years now.
If you use a vpn, private browsing, and/or adblockers some sites will actually gaslight you by telling you that your response was incorrect.
Any CAPTCA that can’t be cracked by a computer can be cracked by shoving it in front of a porn video and someone will solve it for you before it times out.
In practice, there are several types of CAPTCHAs: text-based, image-based, audio-based and behavior-based.
Computer scientist writing an article about captchas doesn’t know that proof-of-work captchas exist… Such a joke.
Of course those don’t do much against automated fake form filling, but against DDoS they’re THE solution.
Proof of work (PoW) captchas make the (computing) cost for the attacker exponentially higher than for the website. Basically the website creates a challenge, which has to be solved by the client/attacker before getting access to content. Best of all the website can set the difficulty of the challenge to anywhere from instant to seconds to solve, so normally the users don’t even notice it (as it runs in the background) but once someone starts DDoS’ing the difficulty goes up.
My understanding is that captchas were never supposed to be impenetrable, just difficult enough that to have bots (or mechanical turks) solve them at scale is expensive enough to deter that kind of automation. It’s probably getting a lot easier for a computer to solve nowadays though.
