3

My idea is to use a sort of layered CAPTCHA model (4 layers - from which layer 0 is no captcha) with difficulty as primary focus.

My first focus beside stopping bots is to make the visitor more and more aware of what he's doing.

It will give the visitor more think work than "type-in" or "watch-and-type-in" work and this verifies the visitors knows what he's doing(eg. limitating unnecessary requests).

2
  • 2
    A CAPTCHA is not meant to be work, it's meant to "Tell Computers and Humans Apart" (...TCHA). If you want to signal that something should be used sparingly because it is a lot of work for the server, you can try displaying a message like "this is a lot of work for the server, use sparingly" to the user, and if people can't behave, then a credit system would probably be more effective than trying to annoy users more and more.
    – Luc
    Apr 7, 2020 at 11:19
  • Solving a CAPTCHA might distract a user from what they were previously doing. Apr 7, 2020 at 21:47

2 Answers 2

4

After many years of working in the information security industry, I have yet to come across such an implementation. This doesn't mean it can't be suitable for certain use cases, but it definitely isn't an established design pattern.

I have seen a decrease in the usage of CAPTCHAs during the last years, because UX experts hate them. CAPTCHAs are mostly used as last resort (e.g. after 10 failed login attempts) or implementations that aim at less UX impact (e.g. reCAPTCHA V2) are used.

But there is another mechanism known in the security world, that might fit your need. It is called step-up authentication. This pattern basically forces a user to re-authenticate with the same or a stronger form of authentication, before he can perform a high-risk task. This achieves what you are looking for: It verifies that the visitor knows what he's doing.

A good examples for this approach is deleting a repository at GitHub. Before you can do this, you must re-enter your password and type out the name of the repository, which you selected for deletion. That way the user is forced to stop and think again, before making a crucial mistake by deleting the wrong repository.

Another example are critical operations which require MFA before they allow execution. You may be able to log into your online banking account with username and password to check your balance, but if you want to perform a transaction, you must enter an additional PIN sent via SMS as a second factor.

You have to evaluate, if a ramp-up authentication would solve your problem in a more elegant way are you really do require CAPTCHAs. Please take into account, that CAPTCHAs are usually not considered user friendly and may have an impact on your customer satisfaction.

5
  • "We actually do see a decrease in the usage of CAPTCHAs, because UX experts hate them." if only... in my (also professional) experience, it's getting ever more, and now not only when you want to send a contact form but also when simply trying to access a website or login with valid credentials on the first attempt. And the captchas are no longer "type the correct letters" but "allow us to track everything about you and behave human".
    – Luc
    Apr 7, 2020 at 11:22
  • "very convenient implementations ... like [Google] reCAPTCHA" eh, yeah, no. Have you ever tried solving one of these if you successfully block Google tracking across the internet? If it doesn't know you're human already, they have you hunting school buses for five minutes and throwing errors when you got it correct (I would know; I'm human). And then I'm not even talking about the TOS and privacy policy they require. It is not a proportional measure in most cases, as GDPR requires, so it isn't legal either but nobody cares about that.
    – Luc
    Apr 7, 2020 at 11:24
  • 1
    @Luc - CAPTCHAs are a very controversial topic, and their usage may vary with industries, but overall I see a steady decrease. I'll edit my statement to make it clear, that this is my personal experience and not something that's proven by scientific measures. Pointing out the issues with reCAPTCHA is also important. I will edit my answer, to remove the positive undertone in this regard.
    – Demento
    Apr 7, 2020 at 11:40
  • 1
    @Luc I remember years ago Google search had a special message for TOR users. Something to the effect of "We see you are using TOR. That's okay but you need to solve this CAPTCHA for us to prove you're human" No matter how many I solved correctly, they never let me through. I'm more confident that it was just a trick to get more free labor via reCAPTCHA than I am that it was a bug. I've seen them do what you describe, getting harder or more tedious challenges, both recently and years ago when they were still using it to collect data on text they couldn't OCR. You do less work if they can ID you Apr 7, 2020 at 20:07
  • 2
    The GitHub example is worth a +1 for such a simple question. I would have also +1ed if you had mentioned that CAPTCHA's aren't just a UX problem. They impede site accessibility as well. (Not just to totally blind users.) And another reason they're falling out of favor is because machines have gotten better at un-mangling text in CAPTCHAs than humans are. And they're probably just as good as humans at identifying buses, street signs, taxis, etc. Apr 7, 2020 at 20:14
1

This is more of a User Experience question. But if you want to make sure the user is aware of what they are doing before performing a destructive operation and decide to do that by making that operation intentionally difficult to perform, then you should design those hurdles in a way which makes them more aware of what they are about to do. A regular captcha would rather be a distraction, because it usually has no relation to what the user is about to do.

Example: Our company has an inhouse solution for rolling out remote software configuration changes. One administrator intended to uninstall an application on one PC, but misclicked and accidently uninstalled it on a couple thousand PCs. It was a very important application, so it caused a lot of disruption. Our plan to prevent that from happening in the future includes that the remote configuration program now tells the user how many PCs will be affected by their change, and if it's more than a hundred it asks them to type that exact number into an input field before the command gets executed.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .