Best options for designing my own customised captcha-type process?

Question

Okay, I've finally had enough of these stupid non-user-friendly Captcha images. Tonight I visited a site I had every intention of doing business with, but prior to being able to view the content (God knows why the captcha was used at this point of the process - but that's another question) I had to prove I was human. Below is just one of the images I was faced with:

I literally spent almost 16 minutes trying to get past the Captcha process. All options in that time (bar one) was the same challenge (i.e. Select all images with street signs), albeit with a variety of different images. The exception was one I was asked to select all images with flowers in it (and yes, I got that 'wrong' too).

Believe me when I say I tried every possible interpretation of what may be defined as 'street signs'.

As a result, I now want to design my own collection of 'captcha' type images for this purpose for cases where it is prudent to include one on a site I'm developing.

So, my question is:

Is there any research indicating the most user-friendly approach to performing this test?

My intention, at this stage, is to still use a combination of images in either a 3x3 or 4x4 grid. But what I'm really after is, what would be the most user friendly option to denote in these images?

So far I've come up with things like:

• Displaying a mixture of mathematical questions and funny riddles, asking the user to select all images that are funny.
• Displaying a mixture of mathematical questions and funny riddles, asking the user to select all images that ask a mathematical question.
• Displaying all images with a very simple mathematical question (e.g. 1+3=, 2+2=, 3+3=) where two or more of them equals the same value, asking the user to select all images that equal the same value.
• Displaying images containing words and asking users to select all images containing words pertaining to xyz (where xyz may be something as simple as words starting with 'P', words ending with 'G', words naming a sport, etc).
• Displaying images that are essentially blocks of colour, asking the user to select all images of a particular colour (or all images not a particular colour).

Which of the above works, or are they all user-friendly? And what other options might I consider?

Anything backed up by research would be preferred.

Answer 1

Captcha is inherently not user-friendly, as it is a barrier to content that has no relevance on the user experience. Trying to roll your own captcha process is going to not achieve what you are trying to accomplish, for a few reasons:

1. Users already have a defined mental model of what to expect when using captcha. This is due to the widespread use of captcha across the web.

2. Your ideas for captcha are biased, and exclusionary:

   • Asking about "funny" items is cultural, and can vary

   • Math questions are a hard barrier for some people

   • Words pertaining to "xyz", requires vocabulary knowledge

   • Displaying blocks of color requires visual prowess and excludes color-blind people.

I would recommend either a honeypot (which has varying levels of success), or use the "new" noCAPTCHA reCAPTCHA by Google: noCAPTCHA. The noCAPTCHA is super user-friendly and effective, and requires minimal user interaction:

You could even decide to show the captcha based on security logic, so users that are more likely bots would be served the captcha, while others could slide right through.

Answer 2

There is no good way to implement a CAPTCHA. They're bad, really bad, for usability.

The latest Google text CAPTCHA to be used before this picture puzzle was apparently easier to solve by bots than humans. I know I could spend dozens of tries before succeeding. Up to 40% of users allegedly failed to solve these when they were taken out (though I've lost the source on that number).

The current puzzle one is just plainly wrongly designed. It is slow (you have to wait a certain delay before the next picture gets served) and you have to properly interpret what constitutes a river or a lake or a mountain or a street sign... Which of course is always debatable.

There is plenty of research and UX anecdotes showing how bad CAPTCHAs are. All the people who attempted to come up with alternatives did worse than text recognition reCAPTCHA. And yet some people associate being annoyed with CAPTCHAs on a website as the website taking security seriously. They're just so used to the pain...

This is why Google now provides a service based on user profiling (read: privacy breaches) in their reCAPTCHA in order to help provide the necessary security UX with, ideally, no actual user effort. Be aware that privacy-conscious users who switch to Tor will have to enter a tedious CAPTCHA puzzle game.

Alternatively you could invest in solutions to detect the spammers / bots on your platform, or increase the entry cost to participation (by using exclusively federated identity schemes or by requiring some work on the platform before enjoying any benefits, as done on StackExchange) to deter all forms of naive bots.