Dazed and Confused: A Large-Scale Real-World User Study of ReCAPTCHAv (2023)

"The conclusion can be extended that the true purpose of reCAPTCHAv2 is a free image-labeling labor and tracking cookie farm for advertising and data profit masquerading as a security service."

Neither does the summary:

"We estimate that – during over 13 years of its deployment – 819 million hours of human time has been spent on reCAPTCHA, which corresponds to at least $6.1 billion USD in wages."

"Google has potentially profited $888 billion USD from cookies and $8.75-32.3 billion USD per each sale of their total labeled data set."

Not sure I 100% agree with the conclusion. IMO they currently still offer some level of security against unsophisticated actors, not no security.

And something can be bad and still be the best choice - we probably need some valid alternatives before we abandon captcha entirely - although i'm not sure what that alternative would be.

IMO the conclusion is a little bit like 'if lockpicks exist, locks offer no security and should be depreciated' - but at the moment locks and captcha still offer a level of security against unsophisticated actors.

Anecdotally from many posters here and as I've personally experienced, automated verification (as attempted by some captchas which entirely eliminate any user interaction) is not foolproof, and an escape hatch is necessary from time to time.

While it could be argued that this leaves the captcha vulnerable to automated solving, the fact that there is a small cost to acquiring a GPU server, a captcha solving service, or a image segmentation model does act as a deterrent (even if small).

> Select all squares with motorcycles

I have never once considered this a "bounding box" task (the prompt of "Select all squares with X" certainly doesn't imply it do be), and now I'm wondering if this is the cause of false failures, or if the researchers failed to understand the task. There's a citation on the "Image Bounding Box Task" … but it doesn't lead anywhere useful.

Woof, some super high quality "research" going on here. Their basis for this claim is that they found a paper from 2016 where the authors did some cookie aging, found it worked and passed that on to Google, who then fixed it. The authors cite this "blatant vulnerability" but then seem to assume that ReCAPTCHA being versioned means that v2 has never changed since it launched? Then they discover the amazing fact that CAPTCHAs require energy and disappear down a conspiracy theory rabbit hole before concluding the entire product - that people pay money for - is actually useless.

The reality is that academics can't contribute much directly to modern anti-spam work and that has been true for a long time. They aren't genuinely spammers so tend to act in ways that don't trigger anti-spam systems (which is correct behavior). The possibility that their simulations of bad activity aren't accurate enough just doesn't occur to them, so then they run around reporting "vulnerabilities". Usually it's easier to tweak the system to make them happy than have them go to the press and cause a scene, so they think they're doing useful work, but it's actually just distracting employees from the actual job of spam fighting. Back in 2020 Twitter publicly lost patience with this type of university output and slammed it as "extremely limited" and "behind the curve" [1]. Citing an eight year old paper as if it's still relevant is a classic example of this problem. The publish-and-cite model is designed for investigating natural laws, not black box commercial systems that can change on a weekly basis or faster. Their supervisor should really have stopped them citing something that old.

The other problem is that because researchers don't understand spammers very well they tend to assume that anything they can do, spammers can also do. In reality spam is purely a profit/loss optimization problem. Spammers are business people who want to make money. The goal is to throw just enough speedbumps in their path to make their profit margin negative, at which point they give up and the spam goes away, without also tipping your own numbers into the red by over-spending or hurting the UX too badly. Making things tougher than necessary risks pushing your own margins negative, making things easier than necessary risks users getting annoyed at the spam and leaving. The goal is to ride the edge of the wave as closely as possible. When spammers find a trick that works they keep it as a trade secret and sell the results of using the trick, not the trick itself, and so disrupting the relationships between black market suppliers is an important tactic. CAPTCHAs in particular are just a throttle intended to slow down low grade spam; if you're actually spending 20-30 seconds automatically solving image puzzles with an 80% success rate you haven't beaten anything, because slowing you down that much was the goal in the first place.

This environment is nothing like academia, where people are getting funded by the government to spend months doing work basically for the heck of it. In academia it's reasonable to spend a year gathering data, running experiments, training ML models, solve a tiny subset of the actual problem spammers face, ignore the cost of doing all that because it's government subsidized, and then announce you've defeated something. If they were really spammers they'd given up and moved on to a different scheme long before that (in a surprising number of cases, this new scheme will be getting a proper job). So whether they realize it or not, all this line of work really does is funnel tax money into the spam ecosystem - exactly what we don't want.

Source: worked in web anti-spam for a while.

[1] https://blog.x.com/en_us/topics/company/2020/bot-or-not "the threat has evolved and the narrative on what’s actually going on is increasingly behind the curve."

Mostly I won't sign up to a service that has a captcha unless I know in advance it's a service I need (unlikely), it's an immediate click away.

I'd rather have one time magic links and codes via text and email than a captcha.

Inconvenience that is robotic on my behalf (copy a code from here to there and treat this as part of "something you have") is much preferred over something that is demanding on my behalf (interpret this puzzle we're showing you, and pause the context you were in to now solve the puzzle).

The worst recent offenders are a grid of 9 abstract representations of something with the instruction to click the one that is correct (right way up), which is only as good as those generated images. Next up is the ones where you need to click images that are in certain "orbits" depending on what the object in orbit is. And of course the never-ending hell of solving Google Captchas where you must pick American English items and perform several leaps of "maybe the computer thinks this is a staircase or bridge?" when what you say and it thinks clearly disagreed.

Captchas are nothing but friction, they've become too hard for humans and too trivial for machines, and the result is that they are only friction to humans... the very humans you want to extract time, money and attention from.

[0]: https://github.com/dessant/buster