38

By now, I've solved hundreds of captchas on Stack Exchange, maybe thousands. Often when I post (conservatively, at least 30% of the time), I'm presented with this: Google reCAPTCHA embedded in a StackExchange themed dialogue, and a image identification grid over the top

We can't quite tell if you're a person or a script. Please don't take this personally. Bots and scripts can be remarkably lifelike these days!

I'm starting to take it a bit personally - a bot could not have posted thousands of well-received answers over the past few years, nor have I ever posted spam or with a bot - and it should be well within SE's power to recognize this. When I spend 30 minutes composing an answer, debugging, proof-reading, double-checking the logic and rendered Markdown, and then get hit with this when I try to post it, it feels like a minor slap in the face, especially when the captcha comes up frequently when I try to submit an answer.

(I'm sure I'm not hitting any of the listed rate limits - I never post more than one answer in under a minute, and I also always take more than 5 seconds to compose an answer, usually at least a minute)

The captcha usually requires me to analyze which of a bunch of squares (9 to 16) has a particular attribute. For some reason (maybe there's a bug in the captcha), it very frequently rejects my first attempt even when I'm sure I've clicked everything correctly, and I have to try again. So a thousand successfully solved captchas translates to maybe 20,0000 of these squares total that I've been forced to categorize before others have been allowed to view my solutions to their problems.

It's not uncommon for it to take more time to get through the captcha than for me to identify the problem in the question I'm trying to post an answer to.

Spam is certainly a problem here on Stack Exchange - it comes up multiple times every day, and we all do our part in flagging it. It's quite reasonable to require new users which trigger certain heuristics to solve a captcha or few the first time they post, or if they're posting too much in a short amount of time, or if they've posted spam before. But I think it is not reasonable to treat prolific, trusted contributors with the same suspicion when they post.

Would it be possible for Stack Exchange's algorithm for determining whether a user needs to solve a captcha be tweaked so that very likely honest contributors don't get hit by it? I don't know what heuristics are being triggered, but maybe add something like:

  • If the user has made more than 25 posts on the network, and none of the user's posts have ever been removed as spam, and the user hasn't just made many posts in quick succession, do not require a captcha.

Or something along similar lines. I would really appreciate it, and I'm sure other trusted users who have to go through the captcha would too.

I'm not asking if a change has been made, I'm asking a for the current logic to be tweaked.

Improve this question
5
  • 7
    Apparently, there's a 40-minute time limit to composing a post, after which you're prompted with a CAPTCHA. This has been in place since 2009, and was supposed to be removed in 2010, but never was. See Has the maximum time threshold for question CAPTCHAs been reintroduced recently?
    – Sonic the Anonymous Hedgehog
    Commented May 20, 2020 at 21:47
  • 2
    I very frequently get the captcha even when I've only been writing the post for ~5 minutes. There's some other rule at play that keeps tripping me up.
    – CertainPerformance
    Commented May 20, 2020 at 21:52
  • 2
    I've at most gotten a "tick if you're human" box... which I personally find horribly speciesist. Usually when I fall asleep in the middle of an answer
    – Journeyman Geek Mod
    Commented May 20, 2020 at 23:34
  • @JourneymanGeek I wouldn't exactly say it's speciesist. It doesn't ask if you're a human; it just asks if you're "not a robot".
    – Sonic the Anonymous Hedgehog
    Commented May 21, 2020 at 19:26
  • 4
    This is really annoying since little editing an autosaved answer triggers the captcha. Why don't you trust your trusted users?
    – kelalaka
    Commented Feb 4, 2021 at 23:33

2 Answers 2

Reset to default
1

Based on our current roadmap, this isn't work that we will take on, as it doesn't coincide with functional areas that we plan to improve in the near future. We recognize this can be an annoyance, but unfortunately, we can't prioritize it at this time.

Improve this answer
5
  • 10
    Then why decline it instead of using status-deferred?
    – muru
    Commented Feb 19, 2021 at 22:13
  • 3
    Why is this status-declined instead of status-planned? I also think that sometimes following the roadmap exactly is not a good idea, but that's just my opinion. What the community wants should be at a higher priority than the roadmap.
    – 10 Rep
    Commented Mar 30, 2021 at 20:19
  • 5
    Also, the 'pictures' type captcha shown above is near impossible to use if you have poor eyesight. I am reaching the point where I just don't engage with sites using it if I can help it, it wastes too much time.
    – MandyShaw
    Commented Nov 11, 2021 at 6:49
  • 2
    @mandy have you tried the audio version? There's a head icon under the images
    – AncientSwordRage
    Commented Nov 11, 2021 at 22:45
  • My hearing is perfect but I cannot work out half the time what the audio is saying. Having said which, the usability of the video version has improved markedly lately, it gets you to look for genuinely identifiable things like chess pieces and tables, on much clearer backgrounds.
    – MandyShaw
    Commented Jul 25, 2023 at 18:14
0

It's possible Stack Overflow the company aren't (completely) in charge of when and how you get hit by a 'reCAPTCHA'

I'm not affiliated with Stack Overflow, but I've done some casual research into this stuff as part of my day job and my own interests.

I've highlighted in your image the parts of the screen that I believe are completely out of Stack Overflow's hands:

The original posters image, an embedded reCAPTCHA and associated image grid, either he checkbox and grid enclosed in a red free hand circle

As far as I am aware, all of reCAPTCHA's information come from your browser history, cookies (even for non-Stack Overflow websites) and things like the way in which your cursor moves to click the checkbox. Stack Overflow has no control on how Google treats this data, and can't (as far as I'm aware) easily provide more information to prevent this from happening. I don't think the rate-limiting or time on questions is the only metric that Google have (or even if they could be changed by Stack Overflow).

My wife hits this problem regularly, because she has a habit of checking every single page of results when she does any online shopping, which we think the secret Google algorithm considers to be too bot-like. Browsing lots of Stack Overflow questions might be handled in a similar way by Google's secret algorithm.

There could be plenty more behaviours that Google's secret algorithm considers 'suspicious' as well without that behaviour happening on the Stack Exchange network. That, I believe, is to get around bots being written to build up a browsing history to imitate non-bots.

Wired wrote an article back in 2014 about it, with more details. And here's an answer from our Security stack.

It's also worse on Firefox, when user tracking is disabled

If you have Firefox with tracking protections, it will be harder to solve ReCaptcha. This is because ReCaptcha (sadly) relies on user tracking which tracking protections disable.

Reddit post

Ok, so we all know you're not a bot... Why should you be hit by reCAPTCHA's?

One of the use cases for reCAPTCHA, according to their own website include Account Takeovers (ATO), where a bot (having built up a browsing history) could try to take over an account here for nefarious purposes. There's other use cases that might apply as well, but this seems the most relevant. Whatever the reason, reCAPTCHA does make the web safer from what I can see, even if you don't directly notice or benefit.

So, why do I have to complete so many photo-grids?

The links above cover this I believe, and I'm least confident in how this works but they are taken from Google Street View, and I believe compared to known verified answers either for that exact photo in a training set or based on the same image detection algorithm Google uses to let you search "cat" in your Google Photos. The issue is that the AI is not perfect, and in clicking on the images you're incrementally training it. Sometimes you disagree with what it expects (and eventually after many others make the same choice, the AI would update and change its opinion on that image), and sometimes even if you flawlessly pick the right images it wants stronger proof you're not a bot.

One small thing to bear in mind if you're visually impaired, is that reCAPTCHA should allow you to complete it non-visually. I've never tried, but the headphones icon on the photo-grid should allow that:

reCAPTCHA checkbox and photo-grid with headphones button enclosed in a red free hand circle

I'm hoping what I've written is both helpful and accurate to how the site uses reCAPTCHA, I'm just sorry I couldn't be more helpful in how you can avoid this annoying issue.

Improve this answer
6
  • 8
    The decision whether to ask for verification or not in the first place is 100% in the hands of SE; only then it passes the ball to Google. In particular, the captcha is already not shown to users with sufficiently high reputation; it is certainly possible to tweak these criteria based on the user’s activity on SE to alleviate the OP’s problem.
    – Emil Jeřábek
    Commented Nov 11, 2021 at 11:01
  • @emil I don't know exactly how it's implemented, but I think it's not that simple. You say "the captcha is already not shown to users with sufficiently high reputation" do you have a reference to that? If it's to do with rate-limiting, I don't think that's the only way it's potentially triggered, as I tried to cover above.
    – AncientSwordRage
    Commented Nov 11, 2021 at 11:06
  • 2
    Ok, maybe it’s not that it is never shown to high-reputation users, but certainly the criteria as implemented do take reputation into account; see meta.stackexchange.com/a/2293. There is an algorithm used by SE, depending on things like reputation and how often you post (which is information not available to Google), that determines whether to ask for verification or not. If so, it calls recaptcha, and then it is up to Google how exactly it performs the verification. The question is about the former, not about the latter.
    – Emil Jeřábek
    Commented Nov 11, 2021 at 11:15
  • @Emil that post only covers verification that SE triggers (when "editing, asking, or answering"), I wouldn't be in the least bit surprised if there was some part of their set up where they aren't in control of when verification is asked for. I'm not sure though.
    – AncientSwordRage
    Commented Nov 11, 2021 at 11:22
  • 5
    I can’t make sense of what you are saying now. This is SE’s website. It does exactly what they code it to do (up to interpretation by the browsers). They are in full control of it until they intentionally pass a part of the control to a third party (like Google here). Whatever happens before that is entirely up to SE.
    – Emil Jeřábek
    Commented Nov 11, 2021 at 11:40
  • @Emil SE have chosen to use Google's reCAPTCHA, which means they've given it permission to watch what its users are doing. If that means reCAPTCHA sees a user do something, I believe reCAPTCHA can automatically trigger its own verification if the Google algorithm sees fit, separate from the ones SE requests it to do. There's a lot of speculation in what I've just said, so take it with a big pinch of salt.
    – AncientSwordRage
    Commented Nov 11, 2021 at 11:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .