500x500

I'm a software engineer, but I prefer to call myself Technology Bishop. Spreading knowledge through writing is my mission.

Software Engineer

Antonello Zanini

Learn why your site needs protection from bots and how CAPTCHAs and JS challenges can help

Bot is short for “robot,” and bots are applications that perform automated actions on the Internet. Although not all bots are bad, most have malicious purposes, from stealing sensitive information to attempting unauthorized access. Thus, bots can represent a security threat to any website. For this reason, you should consider “antibot” solutions to protect your site from bots.

An effective way to protect against these bot attacks is to adopt CAPTCHAs and JS challenges, two of the most effective and popular antibot technologies available. In this article, you will learn what CAPTCHAs and JS challenges are, how they work, and how you can use them to protect your website from bots.

## Why You Need Bot Protection

A bot is a software application that performs automated tasks on the Web. Bots are specifically designed to automate tasks that would otherwise require human intervention or interaction. According to [Statista](https://www.statista.com/statistics/1264226/human-and-bot-web-traffic-share/), bots accounted for 42.3% of worldwide Web traffic in 2021. So, we really cannot ignore them.

The term "bot" generally has a negative connotation, but not all bots are bad. For example, search engines use bots to crawl the Internet. In this regard, you might have already heard about [GoogleBot](https://developers.google.com/search/docs/crawling-indexing/googlebot). In addition, bots are used to collect data for analysis and keep track of important metrics, such as the uptime of a website.

At the same time, there are also bad bots. These perform malicious actions, such as [scraping](https://en.wikipedia.org/wiki/Web_scraping) sensitive data, spamming, and slowing down target websites with excessive requests. Unfortunately, malicious bots have become increasingly popular, and we have all come across a spam bot at least once on YouTube comments or Reddit posts. 27.7% of web traffic is due to bad bots.

For this reason, you need to protect your site from malicious bots. Bot protection involves techniques, technologies, and approaches to identify and block unwanted bots. With bot protection, you try to ensure that only human users and good bots can access your website, improving the general user experience.
On the contrary, a website without bot protection is vulnerable to spam and [DoS attacks](https://en.wikipedia.org/wiki/Denial-of-service_attack), which could damage your site's reputation and lead to reduced performance.

Bot protection can be implemented in several ways and include many techniques such as [blocking IPS](https://en.wikipedia.org/wiki/IP_address_blocking) based on their reputation, [device fingerprinting](https://en.wikipedia.org/wiki/Device_fingerprint), and [behavioral analysis](https://en.wikipedia.org/wiki/User_behavior_analytics). Specifically, two of the most effective and widely adopted antibot solutions are CAPTCHAs and JavaScript challenges.

Let’s now learn more about them.

## What Is a CAPTCHA?

CAPTCHA stands for "Completely Automated Public Turing test to tell Computers and Humans Apart" and represents a challenge-response test used to determine whether a user is human. In other terms, a CAPTCHA typically involves a simple challenge that users must solve to gain access.

CAPTCHAs block automated systems, such as bots, from performing some actions on a website. Thus, CAPTCHAs are particularly effective in limiting spam and preventing non-human users from accessing specific resources or web pages.

## How Do CAPTCHAs Work?

CAPTCHAs work by presenting users with a test that is easy for humans to pass but difficult for computers to solve. This way, they can distinguish between human users from automated bots.

There are different types of CAPTCHA based on the challenge presented to users. The most common ones are:

- **One-click CAPTCHA**: Asks the user to click a checkbox to verify that they are not a bot. It works by tracking the user's mouse movements to check whether it resembles human activity.

![An example of one-click CAPTCHA from reCAPTCHA](https://images.ctfassets.net/23aumh6u8s0i/7xC30RaTUMa0Ak5K1qHl83/b4fd55673099eabc13aa5aac3a1910cd/01-captcha.png)

- **Text-based CAPTCHA**: Shows an image of distorted text and asks the user to enter the text correctly into an input field.

![A text-based CAPTCHA from SimpleCaptcha](https://images.ctfassets.net/23aumh6u8s0i/1BhHogUF9KNhzzVmEuDden/1a66f70cfa8ae2e272d6b3843e5fb3ac/02-captcha.png)

- **Image-based CAPTCHA**: It shows several images to the user and asks them to select only those of a specified type.

![An image-based CAPTCHA from reCAPTCHA](https://images.ctfassets.net/23aumh6u8s0i/4MqWffkvau8BEVMYUZAN0b/ea0530ab70eabaa218df500199f74420/03-captcha.png)

- **Audio-based CAPTCHA**: It requests the user to listen to a sequence of numbers or letters and enter it correctly into a text field.

![An audio-based CAPTCHA from reCAPTCHA](https://images.ctfassets.net/23aumh6u8s0i/6leTUXVi0qMRv0f0irbMVT/f02523b21ca36167cb17017d8bbb90b1/04-captcha.png)

Note that most CAPTCHA examples above come from [Google reCAPTCHA](https://www.google.com/recaptcha/about/). If you are unfamiliar with it, Google reCAPTCHA is a free service that provides effective CAPTCHAs to prevent automated software from engaging in abusive activities on your website. reCAPTCHA is one of the most popular CAPTCHA providers because it is free to use, easy to implement, and highly effective. Another popular CAPTCHA provider is [hCaptcha](https://www.hcaptcha.com/).

## CAPTCHAs: Pros and Cons

Let’s now dig into the pros and cons of CAPTCHAs as an effective bot protection solution.

### Pros

- **Most online providers offer them**: Many CDNs ([Content Delivery Network](https://en.wikipedia.org/wiki/Content_delivery_network)s) and web hosting providers allow CAPTCHA integration with a few clicks as part of their bot protection offer.
- **Users are used to dealing with them**: CAPTCHAs are so popular that online users have become familiar with them. Therefore, users generally know how to deal with CAPTCHAs and are not afraid of them.
- **Users trust them**: For example, CAPTCHAs help increase the credibility of online polls and contests. So, CAPTCHAs can help a site increase its reputation.

### Cons

- **For some users, they are challenging to solve**: Due to accessibility issues, inexperience, or language reasons, CAPTCHAs may pose a challenging test for some users. 
- **They take up user time:** Solving a CAPTCHA requires user interaction and takes time. Plus, users may need several attempts to pass a CAPTCHA test. 
- **They can become annoying**: Solving online challenges to prove that you are not a bot is definitely not a fun activity, especially if you have to do it several times in the same browsing session.

Simply put, the main problem with CAPTCHAs is that they require user interaction. This interrupts the operation's flow and distracts users. For this reason, bot protection solutions that require no user action have become increasingly popular. This is exactly what JS Challenges are all about. Let's find out more about them!

## What Is a JavaScript Challenge?

A JavaScript challenge - also known as a JS challenge - is a test that browsers run automatically to determine whether the user is legitimate or a bot. The web server sends the challenge to each client as JavaScript code embedded in a web page. 

Since most popular browsers have a JavaScript stack, they will be able to understand and pass the challenge transparently. In contrast, bots typically do not have a JavaScript stack and, therefore, cannot pass the challenge.

## How Do JavaScript Challenges Work?

JS challenges are injected into the HTML code of web pages and executed automatically by the browser. Once passed, the system sends a new challenge to the user only after a few minutes or if the browsing session ends. 

Typically, a JavaScript challenge begins by verifying that the client can execute JavaScript. Then, the JavaScript code of the challenge executes. To verify that the user is legitimate, the challenge takes some browser and device characteristics into account. For example, a JS challenge may check for the presence of certain fonts.

This process may take up to a few seconds, but in most cases, JS challenges are executed without the user even realizing it. 

![Cloudflare JS Challenge's wall page](https://images.ctfassets.net/23aumh6u8s0i/2z2rN9oEZCzAxKzpGRh0sZ/65dc9f1d702ddfbda5f33b9384ffad02/05-captcha.png)

The most popular provider of JS challenges is Cloudflare, one of the leaders in the CDN market. If you enable the [Managed Challenge](https://developers.cloudflare.com/fundamentals/get-started/concepts/cloudflare-challenges/#managed-challenge-recommended) feature, Cloudflare will send the client a set of challenges. These usually start with the non-interactive challenge above, which runs a JavaScript challenge behind the scene.

Note that when it comes to detecting if the user can run JavaScript, Cloudflare relies on Google’s [Picasso fingerprinting protocol](https://research.google/pubs/pub45581/). This enables a server to verify the software and hardware stack of a client based on a few collected data.

## JS Challenges: Pros and Cons

Let’s now take a look at the pros and cons of JS challenges as a transparent bot protection technology.

### Pros

- **They are not intrusive**: JavaScript challenges are executed automatically and do not require user interaction. End users have to be patient for a few seconds while the JS challenge is executed.
- **They do not require a backend**: JS challenges can be executed without communicating with a server, making them a network-efficient antibot solution.
- **They respect privacy**: JS challenges are executed in the front end and do not require storing user data.

### Cons

- **They can be bypassed**: Assuming that bots cannot run JavaScript is not sufficient to block them. This is especially true considering that [headless browser](https://en.wikipedia.org/wiki/Headless_browser) technologies allow instructing browsers with no GUI to perform automated tasks.
- **You cannot rely solely on them**: JS challenges represent the first level of a complete bot mitigation solution, which generally involves more advanced challenges.
- **They block human users with JavaScript disabled**: Users who disable JavaScript execution in their browser for security reasons will fail JavaScript challenges. So, they will be mistaken for bots. 

## Bot Protection According to Auth0

Auth0 can help your website with bot protection. The Auth0 [bot detection](https://auth0.com/docs/secure/attack-protection/bot-detection) feature uses machine learning to identify bots and block them from performing specific attacks, such as [credential stuffing attacks](https://auth0.com/blog/what-is-credential-stuffing/) or list validation attacks. When a bot attack is detected, the Auth0 bot detection system adds a CAPTCHA step in the login or sign-up form to eliminate bot and scripted traffic.
The Auth0 [bot detection](https://auth0.com/docs/secure/attack-protection/bot-detection) feature uses machine learning to identify bots and block them from performing specific attacks, such as [credential stuffing attacks](https://auth0.com/blog/what-is-credential-stuffing/) or list validation attacks. 
When a bot attack is detected, the Auth0 bot detection system adds a CAPTCHA step in the login or sign-up form to eliminate bot and scripted traffic.

![Auth0 can introduce a CAPTCHA for security reasons in a login form](https://images.ctfassets.net/23aumh6u8s0i/1zOmIeYYMayZjuGh70KCHh/387af28906dc288f0f2a28261cc21fb4/06-captcha.png)

Note that you can configure the CAPTCHA provider directly on the [Attack Protection](https://manage.auth0.com/#/security/attack-protection) dashboard. Keep in mind that Auth0 supports [reCAPTCHA integration](https://auth0.com/docs/secure/attack-protection/bot-detection#configure-bot-detection).

Auth0 bot detection has been proven to [reduce bot attacks by 79%](https://auth0.com/blog/auth0-bot-detection-reduces-bot-attacks-by-79/) while adding very little friction to legitimate users, considering that less than 1% of CAPTCHAs are shown to human users. Also, Auth0 allows you to define an allowlist of 100 IP addresses to exempt them from bot detection measures.
 
Simply put, Auth0 offers advanced bot detection capabilities to protect its sign-in and sign-up features from bots and malicious users. With just a few clicks, you can activate the bot detection system directly in your [Auth0 dashboard](https://auth0.com/docs/get-started/auth0-overview/dashboard).

## Conclusion

In this article, you learned what a bot is, why bot protection is important, and what the most popular antibot options are. In particular, you had the opportunity to learn more about CAPTCHAs.

CAPTCHAs present users with simple challenges that require some sort of interaction to be solved. Since this can be annoying for users, you may be looking for automated antibot solutions, such as JavaScript challenges. 

You learned about the most popular JS challenges on the market and how they work. And finally, you looked at what Auth0 offers for detecting bots to protect login and registration forms. 

Thanks for reading! I hope that you found this article helpful. Feel free to reach out to me with any questions, comments, or suggestions.

Protect Your Site from Bots with CAPTCHAs and JavaScript Challenges

michael hsu

I am a full stack engineer on the Auth0 attack protection team. I’m passionate about all things software and enjoy solving problems that make the world a better place. I’ve spent my career working in different software fields such as space mission control, video processing and smart assistants before working on protecting our customers at Auth0.

Engineer - Continuous Auth

Michael Hsu

joey devilla headshot 900px

I’m a Senior Developer Advocate at Auth0, and I like to work on various technologies. I’ve developed software for all sorts of platforms, from CD-ROM and the PalmPilot to my current area of focus, mobile phones, IoT devices, and AI. When I’m not looking for strange new platforms to write software for, I’m playing a strange old instrument — the accordion!

Senior Developer Advocate

Joey deVilla

Easily maximize user friction to protect your applications with our improvement on the CAPTCHA™: The CRAPTCHA!

**TL;DR:** Auth0 announces the release of ***auth0-craptcha***. CRAPTCHAs are a creative improvement on CAPTCHAs that make proving you’re not a bot more fun (or more annoying) — and just in time for the first day of April!

<AmpContent>
<amp-youtube
    data-videoid="eylQ82zG9GE"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>

<NonAmpContent>
<iframe width="560" height="315" src="https://www.youtube.com/embed/eylQ82zG9GE" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
</NonAmpContent>

For years, the [CAPTCHA™](https://en.wikipedia.org/wiki/CAPTCHA) — which is an acronym for “Completely Automated Public [Turing test](https://www.sciencedirect.com/topics/neuroscience/turing-test) to tell Computers and Humans Apart” — has been one of the most effective and widely-used tools to differentiate between actual human users and bots:

![Example CAPTCHA](https://images.ctfassets.net/23aumh6u8s0i/1G2aaQm0x156we1OM558gv/57aec3b7283f62480273dc2e1a623533/captcha-example.png)

Just as the resistance movement in the Terminator movies used dogs to tell the difference between humans and evil machines in disguise, we’ve all relied on CAPTCHAs to sort actual users from bots.

**One of the problems with traditional CAPTCHAs is that they assume that certain puzzles can only be solved by humans.** In the age of data science and the current artificial intelligence renaissance, this assumption is becoming increasingly wrong. Between the growing power of machine learning algorithms and the fact that we’ve been stuck at home due to the pandemic, computers have become much better at picking out pictures that contain buses than we are.

**Another problem is that CAPTCHAs aren’t annoying enough.** Let’s face it, a year of being stuck at home has made bored users more patient. They’re now more willing to solve CAPTCHA puzzles in order to log in.

We are a leader in authentication and authorization, and we want to add aggravation to our repertoire. We’re proud to announce the next generation of “Are you human or not?” tools. We give you: The **CRAPTCHA**. That’s short for “Complex Redundant Auth0 Problem To Confound Human Access”.

With CRAPTCHAs, users are challenged to prove that they’re not robots by performing truly human activities. They’re also discouraged from logging in, which makes your system more secure!

Let’s take a look at our CRAPTCHA catalog. As you review them, think about how much more secure your site or application will be once you’ve incorporated them.

## CRAPTCHA #1: Play the Piano

![Piano CRAPTCHA](https://images.ctfassets.net/23aumh6u8s0i/5lY8BABmqfmC7dHfYLQRha/552bf30073d4c9d2eca768f0ff33d930/piano.png)

A popular regret among adults is that they never learned to play the piano. There are also many musicians who “play by ear” and wish that they’d learned to sight-read music. This CRAPTCHA capitalizes on both these regrets and will keep out bots and humans who quit their piano lessons!

<a  target="_blank" rel="noopener" rel="noreferrer" href="https://auth0-craptcha-piano.us.auth0.com/authorize?client_id=iVGwMsN3KT2d0qsWlmV7xdEpbfNwkQM3&response_type=code&connection=Username-Password-Authentication&prompt=login&scope=openid profile&redirect_uri=https://manage.auth0.com/tester/callback?connection=Username-Password-Authentication"><strong>🎹 Try out the Piano CRAPTCHA for yourself!</strong></a>


## CRAPTCHA #2: Shoot Some Ducks

![Duck Hunt CRAPTCHA](https://images.ctfassets.net/23aumh6u8s0i/6aVhNYvmseT2Nh4b9lWthz/a1da9c155b727d57655bcc32efb8fa3a/duck-hunt.png)

This CRAPTCHA forces the user to play the classic videogame [_Duck Hunt_](https://en.wikipedia.org/wiki/Duck_Hunt) for some amount of time before being granted access to the system or service. There’s nothing that user love more than an unskippable, mandatory interruption prior to using an application!

No animals were harmed in the making of this CAPTCHA. We can’t guarantee that users won’t be harmed by it, though.

<a target="_blank" rel="noopener" rel="noreferrer" href="https://auth0-craptcha-duckhunt.us.auth0.com/authorize?client_id=d0e6AVpg5WZNOQrz4vcwrxhI6yc3sBvm&response_type=code&connection=Username-Password-Authentication&prompt=login&scope=openid profile&redirect_uri=https://manage.auth0.com/tester/callback?connection=Username-Password-Authentication"><strong>🦆 Try out the Duck Hunt CRAPTCHA for yourself!</strong></a>

> Credit goes to
[Matthew Surabian](https://github.com/MattSurabian/) for his [amazing JavaScript implementation of _Duck Hunt_](https://github.com/MattSurabian/DuckHunt-JS).

## CRAPTCHA #3: Scratch and Win to Get In!

![Scratch and win CRAPTCHA](https://images.ctfassets.net/23aumh6u8s0i/rEAwa0A9GjiFk9Ouvl0XO/f808fb558e3e77e128fab6052abcc755/scratch.png)

Someone once called lotteries “a way to tax optimists”, and this lottery-themed CRAPTCHA is a way to tax your users’ patience! In order to access a system or service, users have to scratch 3 boxes before they can proceed. Access to your application is the ultimate prize and it’s definitely worth filtering out unlucky users.

<a target="_blank" rel="noopener" rel="noreferrer" href="https://auth0-craptcha-scratcher.us.auth0.com/authorize?client_id=uCYUiWwHcRBO6PR3nSwUEjvcjuFwsMxw&response_type=code&connection=Username-Password-Authentication&prompt=login&scope=openid profile&redirect_uri=https://manage.auth0.com/tester/callback?connection=Username-Password-Authentication"><strong>💰 Try out the Scratch and Win CRAPTCHA for yourself!</strong></a>


## CRAPTCHA #4: Beat the Crooked Dealer at Blackjack

![Blackjack CRAPTCHA](https://images.ctfassets.net/23aumh6u8s0i/4OBWpiQItvBWyG6KemroDm/1562a64ff71f614a06ed7ee4d8a50ad4/blackjack.png)

Why leave your user experience to chance, when you can leave it to skill *and* chance? Your users — if you still have any at this point — will have to play a rigged game of blackjack and win twice in order to gain access.

<a target="_blank" rel="noopener" rel="noreferrer" href="https://auth0-craptcha-blackjack.us.auth0.com/authorize?client_id=U2WSlCTYAFiYromuRoHR9B0qnLWFRhBJ&response_type=code&connection=Username-Password-Authentication&prompt=login&scope=openid profile&redirect_uri=https://manage.auth0.com/tester/callback?connection=Username-Password-Authentication"><strong>🃏 Try out the Rigged Blackjack CRAPTCHA for yourself!</strong></a>

## Security Through Absurdity
Think about it: what’s more secure than a system that’s too aggravating to get into? That’s the power and promise of Auth0’s new CRAPTCHAs. Our CRAPTCHAs will filter out the bots, and have users simply choose not to log into your applications out of sheer frustration. Not only will your systems be more secure, but they’ll also experience greatly reduced server load and support issues, thanks to fewer users. That’s the power of security through absurdity.


## But Seriously...

We hope you got a laugh out of our **April Fool's Day joke**! While it may be tempting to make CAPTCHAs harder to get through, there are actually better ways to implement bot detection using *real* Auth0 products.  

**Want to actually protect your application with _minimal_ user friction?** Are you one of those people who actually _like_ having users?

Protect your application with Auth0’s [bot detection](https://auth0.com/docs/attack-protection/bot-detection). It’s part of our suite of attack protection feature set. With Auth0, you can choose to present CAPTCHAs only when the login attempt displays suspicious behavior or characteristics. It’s security *and* usability!

> CAPTCHA™ is a trademark of Interactiv Corporation.


Introducing Auth0 CRAPTCHAs!

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

How CAPTCHA technology got to this point, and why it’s not going anywhere.



“I’m not a robot” seems like it should be the easiest thing in the world to prove. But if you’ve ever found yourself squinting over a CAPTCHA, trying to pick out photos of crosswalks, you know it’s not as easy as it sounds.

![ReCAPTCHA Example](https://images.ctfassets.net/23aumh6u8s0i/43tITlloB61ioCbc1QQseN/4f5bed888e366d64c204033a65a47aaa/1_recaptcha_example)

CAPTCHAs are designed to guard websites against harmful bots. When they’re properly employed, they’re a useful defense against spam and fake accounts. But CAPTCHAs (and the bots themselves) have become so sophisticated that the tests can end up stymying human users.

The growing consensus is that web designers need to provide the right kind of CAPTCHA and use it only under specific circumstances. Otherwise, CAPTCHA comes at a cost to user experience (UX) and accessibility.

Here, we’ll dive into how CAPTCHA evolved to its current state and discuss what we can do to increase its usefulness and decrease its frustration.

## The Evolution of CAPTCHA and UX

To understand the tension between CAPTCHA’s security goals and UX, you first must understand its (surprisingly fascinating!) origins and evolution.

The term CAPTCHA stands for Completely Automated Public Turing test to tell Computers and Humans Apart. This rather tortured acronym references Alan Turing’s famous [Turing Test](https://www.uipath.com/blog/can-robots-think-the-turing-test-and-rpa): our ability to gauge the sophistication of artificial intelligence based on a human’s ability to differentiate a human from a robot.

### CAPTCHA’s origins

CAPTCHA was created in the early 2000s to combat the epidemic of bots that were spamming early search engines and clogging the internet. Credit for its invention is disputed, but researchers at Carnegie Mellon University certainly pioneered its use. The original CAPTCHA took the form of text warped past the point that computers could decipher while still being (mostly) legible to human beings. The challenges also served as gatekeepers for all users of a particular webpage, instead of being presented to only suspicious users. There were early concerns that the technology presented accessibility challenges, but people soon became accustomed to the little checkbox that proved their humanity.

![Match The Characters](https://images.ctfassets.net/23aumh6u8s0i/1BcQnEZcM6QvnxUVk0ofJj/bda99ac8486d2ebff6e0d4d1f164a6d9/2_match_the_characters)

### Putting CAPTCHA (and users) to work

Soon, CAPTCHA’s developers realized that the technology could be used for something more useful than just making users translate meaningless distorted text. They developed [reCAPTCHA](https://www.google.com/recaptcha/about/), which put users to work digitizing the New York Times archive since humans could decipher the distorted letters in old newsprint better than computers. In 2009, Google bought reCAPTCHA and put it to work digitizing Google books.

Then, in 2013, Google introduced the [image recognition version of CAPTCHA](https://www.techradar.com/news/captcha-if-you-can-how-youve-been-training-ai-for-years-without-realising-it), using photos from Google Street View. They used this image identification data to train their artificial intelligence to be able to recognize objects more effectively. The more the AI learned, the fewer advantages humans had, so, in effect, Google trained CAPTCHA to render itself obsolete.

By 2014, one of [Google’s machine learning algorithms had a 66% higher success rate at solving text CAPTCHAs than humans](https://www.theverge.com/2019/2/1/18205610/google-captcha-ai-robot-human-difficult-artificial-intelligence), which meant it was time for another evolution.

### CAPTCHA version 3: rise of the machines

Next, Google transitioned to “No CAPTCHA reCAPTCHA,” which, [according to them](https://www.google.com/recaptcha/about/), “uses an advanced risk analysis engine and adaptive challenges to keep malicious software from engaging in abusive activities on your website.” While Google is, as always, secretive about the inner-workings of its bot-detection algorithm, this approach was still a big step forward in employing CAPTCHA only for traffic that appears suspicious.

New types of CAPTCHAs have proliferated in recent years, such as math problems and word problems and forms of CAPTCHA that feel more like games. This variety of CAPTCHA code has helped keep the technology alive since hackers can’t just program a single script that will work on every web page.

![Captcha Game](https://images.ctfassets.net/23aumh6u8s0i/7AyhOqKO8DlN8CT9tlmlR4/e925d52297fbdf6f73b139d2bcd96c1e/3_captcha_game)

Despite attempts to gamify CAPTCHA, many users (and developers) still view it as an annoyance.

## The Pitfalls of CAPTCHA for UX

Throughout its existence, CAPTCHA has been a polarizing technology because, if poorly implemented, it can be both frustrating and ineffective.

The first issue with CAPTCHA is **accessibility**. Early CAPTCHA was a nightmare for people with visual impairments, who couldn’t read the warped characters on the screen. Developers soon added audio CAPTCHA so users could hear the letters instead, but accessibility concerns remained. For example, a 2016 study found that users with learning disabilities had more difficulties and a more negative attitude toward [CAPTCHA tests](http://www.ijello.org/Volume12/IJELLv12p207-223Gafni2796.pdf).

Then there’s the problem of **frustration**. As CAPTCHA challenges have become more complex in order to throw off bots, they’ve become increasingly time- and labor-consuming for users.

[Another 2016 study](https://www.researchgate.net/publication/320655707_CAPTCHA_-_Security_affecting_User_Experience) compared different types of CAPTCHAs. They found that text-based challenges were the most frustrating for users, and math tests had the lowest success rate, and while picture identification and games ranked highest for UX, they also took the longest. Ultimately, they concluded that “none of the existing tests are ideal.”

Finally, there’s the issue of **efficacy**. CAPTCHA has a net positive impact on UX only if it actually works at providing a less spammy internet experience for everyone. But sophisticated bots are increasingly capable of solving CAPTCHA puzzles. In addition, “[CAPTCHA farms](https://www.nytimes.com/2010/04/26/technology/26captcha.html)”&mdash;in which spammers pay human workers to take CAPTCHA tests for pennies&mdash;have been around for years.

To be fair, it’s immensely challenging to devise a test so universal that any human can pass it. Professor [Jason Polakis explained the conundrum to _The Verge_](https://www.theverge.com/2019/2/1/18205610/google-captcha-ai-robot-human-difficult-artificial-intelligence): “You need some type of challenge that works with someone from Greece, someone from Chicago, someone from South Africa, Iran, and Australia at the same time. And it has to be independent of cultural intricacies and differences. You need something that’s easy for an average human, it shouldn’t be bound to a specific subgroup of people, and it should be hard for computers at the same time. That’s very limiting in what you can actually do.”

## Making CAPTCHAs Work for Everyone

For all its potential for misuse, CAPTCHA is still an important tool in bot defense. The key is to employ it only when a user’s behavior is suspicious, and they’ve been flagged as a potential bot.

There are multiple ways to determine this, some of which move beyond the realm of traditional CAPTCHA. For example, “[continuous authentication](https://www.theverge.com/2019/2/1/18205610/google-captcha-ai-robot-human-difficult-artificial-intelligence)” looks for physical cues in user interactions with web pages. Are they filling out web forms with superhuman speed? Are their cursor movements more precise than humans, with our imperfect motor skills?

Web developers can use this adaptive approach in conjunction with CAPTCHA tests. Auth0’s [bot-detection feature](https://auth0.com/docs/anomaly-detection/bot-detection) constantly assesses risk by looking at every IP address interacting with a website and determining the likelihood that it’s a bot. It analyzes the behavior of this IP address across the internet and assigns it a reputation score. If that score is low, the bot-detection engine faces the user with a CAPTCHA. Auth0 tenants who enable this feature can choose from a generic CAPTCHA or use Google’s reCAPTCHA.

![Dashboard Anomaly Detection](https://images.ctfassets.net/23aumh6u8s0i/2s5vyitrsTZfbVzK5anX3H/c66b384a956ce1c026b98089d4a249f9/4_dashboard_anomaly_detection)

This type of use lets CAPTCHA work the way it was intended to, without creating needless obstacles for legitimate users.

In addition, it’s important to implement the right kind of CAPTCHA code: one that assigns tests randomly and doesn’t reuse the same solution. For that reason, it’s inadvisable for developers to write their own CAPTCHA script or use a free plugin without knowing its origins.

In the future, the pendulum may swing toward forms of CAPTCHA that identify humans not by our ability to outperform bots but by our tendency to make errors that AI would not. For instance, in 2017, Amazon patented the [Turing Test via failure](http://patft.uspto.gov/netacgi/nph-Parser?Sect1=PTO2&Sect2=HITOFF&p=1&u=%2Fnetahtml%2FPTO%2Fsearch-adv.htm&r=1&f=G&l=50&d=PALL&S1=9767263.PN.&OS=PN/9767263&RS=PN/9767263). This type of CAPTCHA presents users with challenging tests that humans tend to fail, and bots answer correctly.

Some websites also use [honeypots](https://dynomapper.com/blog/514-online-captcha-solving-services-and-available-captcha-types), a form of CAPTCHA invisible to human users. This method inserts fields onto a screen that are visible only to bots, tricking them into filling out forms and proving they’re not human.

Finally, CAPTCHA shouldn’t be your only defense against bots. [Social logins](https://auth0.com/learn/social-login/)&mdash;which allow users to verify their identity via their social media account or another trusted identity provider&mdash;are another useful method to restrict website usage to actual human beings.

## CAPTCHA Is Changing, but It’s Not Going Anywhere

As long as there are spammers trying to create fake accounts, there will be a need for technology that separates human users from spambots. Because of that, some form of CAPTCHA technology will always exist, evolving in parallel with AI.

The CAPTCHA of the future probably won’t look anything like the “find the street sign” challenges of today. But for now, these simple tests are still part of a smart bot-detection strategy. Website designers who employ CAPTCHA need to be open to this evolution and always employ the technology thoughtfully to ensure they’re not punishing their human users. 

<include src="asides/AboutAuth0" />


"captcha"