CAPTCHAs aren't as secure as most people think

You land on a sign-up page. There’s a checkbox that tells you to tick the box to prove you aren’t a robot. Sometimes the system gets suspicious. Instead of one click, it gives you a grid of photos where you have to find every traffic light or crosswalk. That’s a CAPTCHA.

It’s an acronym. Stands for Completely Automated Public Turing test to tell Computers and Humans Apart; read that again if you want. It basically works like a locked door. And the key? Only humans seem to have one handy.

The digital wall#

It made sense back then. The web was young. Automated abuse looked basic. Scripts moved in straight lines, and they couldn’t read twisted letters. They didn’t see shapes in pictures, and a developer could treat a CAPTCHA as a thick wall. It blocked thousands of fake accounts from appearing in seconds. Registration forms stayed safe. Login pages held up against brute force attacks; that’s where computers guess passwords fast. The logic was clear. If a machine can’t solve the puzzle, it can’t get in.

Why does this belief stick? You can see it. A developer looks at the page and feels safe, thinking they have a solid defense; that feeling is based on an old view of how attackers actually work.

The human loop#

The issue is that determined operators don’t actually bother teaching their bots to see traffic lights. They just outsource the work; there’s a professional industry of solving services now, platforms where people in low-wage regions get paid tiny sums to solve CAPTCHAs for someone else.

It works like this. A bot hits a puzzle and sends it through an application programming interface, which is just software talking to other software, over to the service. Some human worker solves that image puzzle in seconds. The answer goes back to the bot and the bot submits it to the site. It often costs only a few pennies per thousand puzzles solved.

The barrier isn’t gone. Instead, it changed from a technical impossibility into a small bill. If an attacker has a goal and some money, this cost is negligible. But what about the real user? They pay in frustration. People who use screen readers to read text aloud because of visual impairments find these puzzles nearly impossible to handle. Who thought this was a good idea? The system meant to stop machines ends up blocking actual people better than it blocks a determined attacker.

A quieter defence#

Security isn’t about one big wall anymore. Rate limits do the heavy lifting, and they cap how many requests one IP address can send in a set window of time. If an address tries to open fifty accounts in sixty seconds, the system cuts it off.

Abuse detection is the other side of it. Why ask someone to find a staircase when you can just watch how they act? The system tracks mouse movements or the gap between keystrokes, and humans are messy and hesitant. Bots are too fast, too precise. This lets a site spot a person without making them do chores. It cares about traffic patterns instead of identity.

Site managers need to stop relying on puzzles. Put strict rate limits on every public form. Use behavioral analysis tools. CAPTCHAs should be the last resort, reserved for high risk actions once other signals show an attack is happening.