I think Google is doing that "mark all cars/street stigns/etc" style of captcha and using the data for ML training and stuff it asks juust a little too many it comes across as them using the captcha a little too eagerly to collect data.

Are you using an IP possibly in use by other people? As I'm seeing zero logging in. As to why multiple, they're to prevent bots. Random clicking succeeds some percent of the time, several decreases that percentage.

You need a captcha to log in so that it's hard to make multiple fake accounts. You need captchas to buy stuff because otherwise one could make all accounts manually and then use them to quickly buy products to spend some bank account before it's banned.

I think each smallish site would benefit from designing their own captchas because that way the effort to solve for machines would be harder than solving the Google captchas. The effort to solve for humans would be a lot lower. This is perhaps one of the few areas where rolling your own security solution is beneficial by virtue of it being different.

I think perhaps you underestimate how hard it is to make a good captcha, that is one that is hard to solve programatically but not too hard to solve for a real person (this second part is often overlooked as easy). I suspect you'll find a lot of the prior techniques work well when applied to someone's hand-rolled version, given that coming up with something unique enough to not have prior work put into solving it (and have enough variation to make learning the entire data-set infeasible) is likely much harder than you think.

I don't know.. It seems stupid easy to me. Try something like "Type the third and fifth letters of the word elephant into the box below" with instagram filter applied. A bunch of variations for the first part like "the following word" and "the word in parenthesis".

Basically, I can't think of a way to come up with something ez that defeats it. You would have to train a neural net specifically on these images because normally neural nets are bad at instagram filter removal unless trained on it. Plus you can slow down/ban/mess with requests based on cookies.

There are basically infinite solutions. Would take a couple of days to implement and would be really fun. I guarantee you: if your site gets maybe 30k visitors a week, nobody would bother spending a month cracking your captcha when there are much easier targets out there.

Finally, you can make it super annoying to actually find where the image is by converting to svg and messing with html structure/compose image in JS. Now they're going to be forced to run a headless browser, take screenshots of the captcha page and finding the image within the page.

If they take the pay-per-captcha approach, I don't think anti-captcha and the like would make it too ez. Still days of work to set up something really brittle.

> Try something like "Type the third and fifth letters of the word elephant into the box below" with instagram filter applied.

That was a common captcha technique a decade ago. It didn't last.

> Basically, I can't think of a way to come up with something ez that defeats it.

You're mistaking your inexperience with the field and its methods for difficulty in solutions.

> Finally, you can make it super annoying to actually find where the image is by converting to svg and messing with html structure/compose image in JS.

This isn't hard to defeat. SVG is really no harder than PNG or JPEG to deal with, and if you are programatically altering it, it's trivial to figure out the purpose of the JS and re-implement it, and pass in whatever randomized variables change it. Or just use node, and scrape it from the page and run it as delivered.

> Now they're going to be forced to run a headless browser, take screenshots of the captcha page and finding the image within the page.

That's trivial. Far more trivial now than it was in the past, actually. There's plenty of systems around to run headless browsers. Some are to ease testing for developers, some are specifically designed for and marketed to people that want to do things just like this. Worst case, you use electron and make your own browser to do it.

I don't think this is such a good idea. First of all, designing a catch system that isn't terrible is a lot of work -- it doesn't really make sense for most dev teams to take it on when there are so many pre-built solutions out there. Second, dealing with proprietary captcha systems isn't actually that hard -- you can throw pretty much anything at anti-captcha.com.

Hey there, could you send me an email at jeff@humble.com? Sounds like there might be something weird going on.