Should captcha or verification codes be case sensitive?

Question

As I have come across many verification codes, the most annoying thing in them is when you write in all letters in the code in lower case and the code is rejected saying its not valid. Some codes are accepted and some are not. And the user has no idea if they are case sensitive or not before actually submitting it and validating it. Given the curvy, hardly recognisable characters on the codes, not making the users aware of its case sensitivity could annoy them more and bring down the UX.

So what would be the ideal way to deal with this ??

Answer 1

For starters, I strongly recommend against using captchas as they are not user friendly and have significant usability issues and make it harder for users to complete the form. To quote this article

Firstly, it is worth pointing out that captchas are nowhere near as secure as you’d like to believe. Back in 2005, the W3C pointed out that third party services had demonstrated that most captcha services could be defeated with 88%-100% accuracy by using some simple OCR. I suspect that since then captchas have probably gotten a bit better, but spam bots probably have as well.

Then of course there are the accessibility issues. In particular, visitors who suffer from blindness, dyslexia or low vision will struggle greatly with a captcha system. You can aid them slightly by offering an audio alternative, but the audio used in captcha systems tends to be rather noisy and doesn’t help a great deal. Audio alternatives are particularly useless if you are in a noisy environment such as a coffee shop or office. To make matters worse, these audio alternatives are often not provided in a way that is accessible to the very audience that needs them the most.

Let’s assume, however, that all of our visitors have good vision. Captchas are still the wrong solution because they put the onus on the user to figure them out in order to successfully continue. Spam is not the users problem, it is the problem of the business that is providing the site. It is arrogant and lazy to try and push the problem onto a site’s visitors.

Captchas cause a great deal of frustration for many users. On average, it takes around 10 seconds to solve a captcha correctly. I have watched many a savvy user struggle 2, 3, even 4 times to correctly solve a captcha. That’s no way to reward someone who is trying to interact with your site.

---

There are alternative methods you can potentially look at which can make it easier for users to prove themselves as human without having to decipher the word entered and trying to determine whether its case sensitive or not

Some examples of those methods are

1. The Honeypot method

The idea behind the honeypot method is simple: website forms would include an additional field that is hidden to users. Spam robots process and interact with raw HTML rather than render the source code and therefore would not detect that the field is hidden. If data is inserted into this “honeypot,” the website administrator could be certain that it was not done by a genuine user.

2. User Interaction:

One method getting a lot of attention has users perform tasks that are impossible for virtual intelligence. They Make Apps features a small slider that must be dragged to the right in order to submit a form. It asks the visitor to “Show your human side; slide the cursor to the end of the line to create your account.”

3. Other Alternatives: Other alternatives worth looking at are

Other alternatives are Text CAPTCHA and Egglue, which ask simple questions humans can answer using logic or intuition rather than pattern recognition alone.

NuCaptcha uses behavior analysis to assess each visitor’s risk level. Then it assigns easy or difficult CAPTCHAs based on how likely it is that the visitor is a bot. Visitors who behave like humans are given very easy tests to complete.

The downside of these options is that they still disrupt the user’s workflow. While they might be less frustrating, they still create a barrier between the user and their goal.

Answer 2

At face-value there is a trade-off between usability and security. The argument could be made that requiring an exact case match would make it less likely that the CAPTCHA could be brute forced or guessed by machine vision.

However in real world cases (brute force protection, machine vision mitigation graphics) the actual risk introduced by being case insensitive would be negligible. Thus CAPTCHA's should be case insensitive.

Answer 3

It depends on the technology a website is using. Usually, recaptcha the follows the following sequence for spam reduction. It offers a known captcha and another unknown word that it wants to identify (from some book), so even if the give on lower case or a completely upper case text, the other one can be unknowingly a text, number or a mix of both.

So, there's only one part that you control using recaptcha.