Google's ReCaptcha has done a lot of harm to the Internet and is constantly used when it completely unnecessary (viewing a page? Submitting feedback when you're already logged into an account that you already did a captcha to make or login with?).
>Google CAPTCHAs have gone from asking the question "Are you human?" to "Which human are you?".
This is a good way to put it. I wonder if the Googlers that work on ReCaptcha are somehow able to convince themselves they're Making The World A Better Place, like most Googlers somehow manage to.
Hand on my heart: I've been in a very secure (national security) facility and witnessed someone struggling with Google's captcha thing for hours. They were trying to make a change in a system used for soldier's flights. 200+ Accounts needed a single number swapped on a form. 200+ google captures to solve. Nothing is as frustratingly pathetic as someone in uniform, a trained soldier, screaming about whether "traffic light" includes both sides of the hanging light.
Passwords, access cards, biometrics, hardened doors, guards carrying machine guns, rooms without numbers, and on the inside of all that: google captcha.
Speaking as someone with some military experience, almost certainly the second. Military computers are locked down excessively, often in ways that are actually counter to real security. Policy is reactionary, and is all-too-often simultaneously too narrow and too broad (in orthogonal ways) which ends up impacting usability while not really adding any security.
If there is no way for users to spam other users then there is no need for a captcha at all. Just add rate limiting and alerts to see if one user is using too much resources. If your users can disturb each other than the best solution is to make your system invite only and remove invite perms from anyone who is inviting bots or alternatively have some way where users must add other users as friends before they communicate using an external service so for example someone wants to add a friend they send an email with a friend code then you are using the existing anti spam system of whatever external system the user picks.
Maybe none of these are convenient for you but for some websites they work quite well. Invite only communities often have far less trolls and virtually no spam.
Even if this is true, the problem is that Google reCAPTCHA is way easier to slap on anything, and for the few hurdles it imposes it is very effective at stopping bots.
I'm not in a position to decide on a human verification mechanism, but I used to do WordPress and Drupal CMS work as a freelancer. The number of non-technical people setting up their own sites on these platforms vastly outnumbers the people who even are aware of some of the downsides to Google reCAPTCHA. Until the mechanisms you described implementing are as easy as installing a plug-in, Google reCAPTCHA is here to stay.
EA use a variant of this for their FIFA app and it was legitimately the most frustrating CAPTCHA I've ever tried to solve. They overlaid several objects at the same time in an attempt to make it harder and it took me 9 minutes to solve them all. Example: https://imgur.com/a/x8x4amL
This is definitely easier. While I don't mind reCAPTCHA on many resources, commercial entities which charge money for you to use their products, should try to make the login process as easy as possible and reCAPTCHA isn't one of them, as at times you have to iterate several times of identifying all cross walks or store fronts.
I'm more worried about the small state space. Even if there are many possible images, randomly guessing lets in 1/8 of the bots. Is there something to protect against this?
Not sure you need to make sure the user is human on a log-in form. Just limit the number of attempts per day per account, perhaps with email verification to pass it.
Meanwhile in developing nation's captcha work from home schemes are becoming quite common. Where for a few pounds day/dollars/euros a worker at home will identify 1000's of captcha.
From my understanding it's popular work as mum's and those at home can do while caring for children.
>Google CAPTCHAs have gone from asking the question "Are you human?" to "Which human are you?".
This is a good way to put it. I wonder if the Googlers that work on ReCaptcha are somehow able to convince themselves they're Making The World A Better Place, like most Googlers somehow manage to.