0

One of Google's "Recaptcha" challenges asks users to identify a "thing" (typically a car or something similar) in a set of different small photos on a 3x3 grid:

Recaptcha

After clicking one of the "things", the cell fades to white and takes roughly 3 seconds before showing another photo (which might include the "thing" to identify again). I've noticed that the waiting time can vary a bit (probably depending on the "suspicion level" determined before any user interaction) between 1 second and 3 seconds. The users successfully completes the captcha if it only shows photos of something other than the "thing" and he presses the "verify" button.

The rather long fading time for each individual photo seems like terrible user experience to me, so I assume there is a reason behind it. I think it's not for slowing down the requests a attacker could make, because they could simply force users to wait at the "verify" step, rather than on individual images.

Is there a security reason behind forcing the waiting times?

  • Is this happening always or happened on a particular instance? Have you tried on different browsers? – Sayan Jun 20 '18 at 23:49
  • 1
    I see it routinely @Sayan. It certainly happens with Chrome, which I assume is what reCAPTCHA is optimized for. – Neil Smithline Jun 21 '18 at 1:20
  • @Sayan it's a little difficult to give a reliable answer to that. I've definitely seen it both on different browsers and the same. But since it sometimes just skips the challenge altogether or uses a different one, I can't reliably reproduce it. – Nijin22 Jun 21 '18 at 5:02
  • 1
    can you click again to cancel in the "grace period"? – dandavis Jun 21 '18 at 5:10
  • @dandavis No you can't cancel or "unclick" a photo (but good idea). – Nijin22 Jun 21 '18 at 8:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.