Are captchas necessary for established users?

Question

Currently, even high-reputation users, community moderators and (as far as I've heard) SE employees are confronted by captchas when they perfom actions in quick succession. That has become a significant nuisance for some user now with the increased difficulty of the ReCaptchas SE uses.

But do we actually need Captchas for established users? I certainly see the need for them for unregistered or relatively new users, but for high reputation users there are only three scenarios that I can think of where they might be useful:

• The account is hacked by a spammer
• A user is rage-quitting and vandalising the site
• A user is performing large-scale misguided edits/retagging etc.

I've never heard of a case where a high-rep user was hacked by a spammer, I don't think wasting the time of a lot of users due to a largely theoretical concern is a good idea. The other two cases are real dangers that happen reasonably often.

I agree that some rate-limiting is necessary even for trusted users to prevent certain kinds of abuse. But I do think the limits should be implemented differently than they are currently, and I'd even go as far and to discontinue Captchas for reasonably high-rep users entirely and replace them with hard throttling. Of course this would be extremely annoying with the current limits, they would have to be implemented in a way that users would not encounter them during normal usage of the site.

One important part would be to make the limits less sensitive to short bursts of activity, e.g. by defining the limit over longer times and not as a hard limit between to actions. For example, instead of one edit every 10 seconds, allow 6 edits every minute. This would stop bot-like behaviour of users still pretty quickly, but it would not be triggered by common behaviour. Additionally, there could be a large per-day cap to limit the damage any user can do.

One could also take additional information into account to automatically detect harmful patterns. E.g. if many edits are reverted in a short time, it would make sense to block the user from editing for a while. The same could work for posts, using downvotes and flags as measure of harmfulness.

There would be a problem with large-scale editing or retagging, but on many sites preventing users from performing too many mass edits too quickly might stop them from flooding the frontpage. But we anyway need better tools to perform large-scale tagging operations, they are a complete pain at the moment on any non-SO site due to trashing the frontpage.

The /review path might need some special consideration, as it is encouraging behaviour that is likely to trigger the throttle mechanism.

But the biggest feature in my opinion that would allow more leniency with the anti-vandalism features would be a rewind option for user activity. Allowing moderators to undo all actions of a user since a certain point in time would make it pretty painless to reverse all consequences of a vandalism spree.

Answer 1

I have 49K and I've hit the captcha a lot in the past week - at least an order of magnitude more often than the 6 months prior.

I wouldn't mind if they were normally solvable on the first try, but it often takes me 4 or 5 tries. So I think something recently changed where the triggers for the captcha have become far more sensitive, and combined with the declining quality of the captcha images (something I hadn't noticed before because they weren't triggered very often at all, and may have been a gradual or sudden change, I'm not sure), it is downright frustrating.

I think the rewind feature you mention is a good idea in spirit, but implementation would be difficult. Think about cascading actions, like rage-quitter edits a post, then someone edits part of that, then someone adds a more constructive edit - I think the domino effect makes undoing just that rage-quitter's activity very difficult.

What I do think we should be seeing is a return to the rate-limiting behavior we enjoyed prior to this most recent change (and I don't think anyone can dispute that something has changed recently). Are these limits specified by Jeff two years ago still the set of rules that are in place? Have any been added / removed / changed? If so I think they need to be re-visited. At the very least I think the current set of rules should be thoroughly investigated to ensure they're working correctly. Something had to have changed to make this behavior so much more noticeable and annoying recently.