Topic
CAPTCHA challenge-response tests
CAPTCHA systems try to distinguish ordinary human interaction from automated abuse by presenting a challenge or evaluating interaction signals.
At a glance
- Purpose
- Reduce automated abuse
- Limitation
- Can block or burden legitimate users
Overview
CAPTCHA is a broad anti-abuse technique rather than one specific puzzle. Some systems ask the user to solve a visible challenge, while others evaluate risk signals and only present a challenge when needed. CAPTCHA can reduce automated abuse, but it can also create accessibility and usability problems and should not be treated as the only security control.
Challenge-response is only one implementation
Traditional CAPTCHAs ask a user to identify text, images, or another pattern. Newer systems can score traffic using browser, session, or interaction signals and reserve explicit challenges for requests that appear more suspicious.
Design for failure and accessibility
Bots can solve or outsource many challenges, while some people with disabilities can be blocked by inaccessible tests. Services should provide accessible alternatives, rate limits, fraud detection, and account protections instead of depending on one challenge mechanism.
Sources and review
MOOR's explanatory text is supported by the following source links.
- Inaccessibility of CAPTCHA — W3C
- reCAPTCHA v3 — Google for Developers