Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We've got plenty of argument that CAPTCHA can easily be beaten, and that they introduce usability problems to users. People say that because they can be broken, they shouldn't be used.

So if you've chosen to deploy CAPTCHAs on your forms, do you keep track of the number of users who fail (and who are therefore either robots or insufficiently advanced humans)? What rate of failures occur? Is the likelihood of failure high enough to justify the effort (and cost to legitimate users) of deploying the CAPTCHA?

share|improve this question

closed as not constructive by Adi, TildalWave, Lucas Kauffman, Iszi, NULLZ Jun 4 '13 at 22:51

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance. If this question can be reworded to fit the rules in the help center, please edit the question.

I don't have any statistics so I'm not gonna answer. "Is the likelihood of failure high enough to justify the effort of deploying the CAPTCHA?" This really is a moot point though imo. Most web application frameworks have libraries that make adding captchas as simple as a one or two lines of code. It really is a matter of usability when it comes to deploying captchas. –  Terry Chia Jun 4 '13 at 16:25
@TerryChia in which case I've made it explicit that CAPTCHAs still have costs. –  user185 Jun 4 '13 at 16:25
I just have this anecdote. About a month ago, Skrill (MoneyBookers) removed their CAPTCHA (screenshot from the announcement email). After some discussion with a developer for a high value client that uses MoneyBookers' API, turns out that the main reason they removed is because the usability problem outweighed brute-forcing protection from CAPTCHA, so they implemented better rate-limiting. –  Adi Jun 4 '13 at 16:50
Here are some numbers on the effect of CAPTCHA failed attempts on conversion rates with other stats: moz.com/blog/captchas-affect-on-conversion-rates And here are more numbers on the same matter 90percentofeverything.com/2011/03/25/fk-captcha –  Adi Jun 4 '13 at 16:59
Welcome back, Graham! Unfortunately, I see a few problems with this question. First, it's really three separate questions: "Do you track CAPTCHA failure rates?", "What are the CAPTCHA failure rates observed?", and "Is the failure rate reasonable?". The first and second are polling questions, which are against StackExchange policies. Even if objective sources could be found for this data, the statistics will vary across those sources and over time. The last question is one that is up to each admin and scenario - nobody here can give one answer that's usable to everyone. –  Iszi Jun 4 '13 at 17:30