Gotta CAPTCHA ’Em All: A Survey of 20 Years of the Human-or-computer Dilemma

Abstract

A recent study has found that malicious bots generated nearly a quarter of overall website traffic in 2019 [102]. These malicious bots perform activities such as price and content scraping, account creation and takeover, credit card fraud, denial of service, and so on. Thus, they represent a serious threat to all businesses in general, but are especially troublesome for e-commerce, travel, and financial services. One of the most common defense mechanisms against bots abusing online services is the introduction of Completely Automated Public Turing test to tell Computers and Humans Apart (CAPTCHA), so it is extremely important to understand which CAPTCHA schemes have been designed and their actual effectiveness against the ever-evolving bots. To this end, this work provides an overview of the current state-of-the-art in the field of CAPTCHA schemes and defines a new classification that includes all the emerging schemes. In addition, for each identified CAPTCHA category, the most successful attack methods are summarized by also describing how CAPTCHA schemes evolved to resist bot attacks, and discussing the limitations of different CAPTCHA schemes from the security, usability, and compatibility point of view. Finally, an assessment of the open issues, challenges, and opportunities for further study is provided, paving the road toward the design of the next-generation secure and user-friendly CAPTCHA schemes.

Need second-hand advice? The timing of when people seek algorithmic recommendations

“…While we acknowledge that it is not always the case that algorithmic aids are systematically less accurate than their users, such situations can arise when a human decision maker and a recommender system employ different decision processes. For example, online CAPTCHA tests pose a greater challenge to image classifiers than human agents (Guerar et al, 2021). Our intent in including the human-superior situations was to test the resilience of decision-maker's trust in the algorithm despite seeing these errors.…”

CAPTCHA for crowdsourced image annotation: directions and efficiency analysis

“…genuine users, will be authenticated while artificial agents and programmed bots cannot (Von Ahn et al, 2003). Due to its partial-efficiency and unprecedented benefits, the idea was widely accepted and so far a wide variety of such tests for different applications and devices have been proposed and employed (Guerar et al, 2021;Moradi and Keyvanpour, 2015a;Roshanbin and Miller, 2013;Xu et al, 2020). However, the CAPTCHA is blamed for its intrinsic drawbacks (Caine and Hengartner, 2007;Moradi and Keyvanpour, 2015b), and specifically usability-oriented ones; its multifaceted features and usefulness are undeniable.…”

“…, 2003). Due to its partial-efficiency and unprecedented benefits, the idea was widely accepted and so far a wide variety of such tests for different applications and devices have been proposed and employed (Guerar et al. , 2021; Moradi and Keyvanpour, 2015a; Roshanbin and Miller, 2013; Xu et al.…”

IRemember: Memorable CAPTCHA Method for Sighted and Visually Impaired Users

“…In the implementation process of the proposed CAPTCHA, we considered the essential security requirements that make the CAPTCHA method more secure and eligible [23,24]. The IRemember CAPTCHA is implemented based on these requirements, including distortion levels, challenge type, randomness, time constraints, and size.…”