One of Google's "Recaptcha" challenges asks users to identify a "thing" (typically a car or something similar) in a set of different small photos on a 3x3 grid:
After clicking one of the "things", the cell fades to white and takes roughly 3 seconds before showing another photo (which might include the "thing" to identify again). I've noticed that the waiting time can vary a bit (probably depending on the "suspicion level" determined before any user interaction) between 1 second and 3 seconds. The users successfully completes the captcha if it only shows photos of something other than the "thing" and he presses the "verify" button.
The rather long fading time for each individual photo seems like terrible user experience to me, so I assume there is a reason behind it. I think it's not for slowing down the requests a attacker could make, because they could simply force users to wait at the "verify" step, rather than on individual images.
Is there a security reason behind forcing the waiting times?
