How do security puzzles affect User Experience?

Question

Are there any studies on these kinds of security puzzles and how they affect the user experience, for bad or for good?

I'm specially interested in accessibility issues and also if you know about other examples aside of the one above (from Binance)

Answer 1

Evidence suggests that interactive CAPTCHAs present accessibility challenges. Hollier et. al. in W3C writes:

While online users continue broadly to report finding traditional CAPTCHAs frustrating to complete, it is generally assumed that an interactive CAPTCHA can be resolved within a few incorrect attempts. The point of distinction for people with disabilities is that a CAPTCHA not only separates computers from humans, but also often prevents people with disabilities from performing the requested procedure.

...

Frankly, a design pattern that expects multiple attempts from users as a matter of course is arguably inaccessible by design to persons living with an anxiety disorder as well as to many living with a range of other cognitive and learning disabilities.

Section 2.1.3 of the document directly addresses logic puzzle CAPTCHAs:

The use of logic puzzles as a CAPTCHA technique, however, introduces substantial barriers to access for people with language, learning or cognitive disabilities. An individual living with dyscalculia will understandably find even simple arithmetic puzzles challenging. A blind individual will be unable to identify the hammer from among graphical depictions of common tools.

Moreno et. al. (2014) researched several CAPTCHAs and found that mini-puzzles were problematic for people with visual, cognitive and motor disabilities; sliders were potentially accessible for users with visual impairments if connected to assistive technologies, but are still problematic for those with motor disabilities.

Puzzle CAPTCHAs sometimes are problematic when they rely on cultural knowledge (example: select all the foods that a baby eats, with foods that are particular to one culture of the world.)

On the other hand, they can be easier for some users with dyslexia or those who are less familiar with a particular alphabet than CAPTCHAs that distort letters.

Why do companies like Google with massive resources insist on horrendously inaccessible puzzles such as making us tick all the boxes that contain crosswalks? Because we're helping Google build its visual AI.

Hundreds of millions of CAPTCHAs are solved by people every day. reCAPTCHA makes positive use of this human effort by channeling the time spent solving CAPTCHAs into annotating images and building machine learning datasets. This in turn helps improve maps and solve hard AI problems.

The W3C's recommendation thus is:

When puzzles are used, therefore, it is advisable to support a variety of puzzles so that someone unable to solve a given puzzle can obtain a different kind of puzzle when requesting another challenge.