Since about 2003, captchas have been widely used as a barrier against bots, while simultaneously annoying great multitudes of users worldwide. As their use grew, techniques to defeat or bypass captchas kept improving, while captchas themselves evolved in terms of sophistication and diversity, becoming increasingly difficult to solve for both bots and humans. Given this long-standing and still-ongoing arms race, it is important to investigate usability, solving performance, and user perceptions of modern captchas. In this work, we do so via a large-scale (over 3, 600 distinct users) 13-month unbiased user study and post-study survey. The study, conducted at a large public university, was based on a live account creation and password recovery service with currently prevalent captcha type: reCAPTCHAv2. Results show that, with more attempts, users improve in solving checkbox challenges. For website developers and user study designers, results indicate that the website context directly influences (with statistically significant differences) solving time between password recovery and account creation. We consider the impact of participants' major and education level, showing that certain majors exhibit better performance, while, in general, education level has a direct impact on solving time. Unsurprisingly, we discover that participants find image challenges to be annoying, while checkbox challenges are perceived as easy. We also show that, rated via System Usability Scale (SUS), image tasks are viewed as "OK", while checkbox tasks are viewed as "good". We explore the cost and security of reCAPTCHAv2 and conclude that it has an immense cost and no security. Overall, we believe that this study's results prompt a natural conclusion: reCAPTCHAv2 and similar reCAPTCHA technology should be deprecated.

翻译：自2003年以来，验证码被广泛用作抵御自动化程序的屏障，同时给全球大量用户带来困扰。随着其应用范围的扩大，破解或绕过验证码的技术持续改进，而验证码本身在复杂性和多样性方面不断演进，使得无论是自动化程序还是人类都越来越难以解算。面对这场旷日持久且仍在升级的军备竞赛，研究现代验证码的可用性、解算性能及用户感知具有重要意义。本研究通过为期13个月的大规模（覆盖3600余名不同用户）无偏用户实验及后续问卷调查展开调查。实验在某大型公立大学进行，基于当前主流的验证码类型reCAPTCHAv2，实际应用于账户创建和密码找回服务。结果表明，随着尝试次数的增加，用户在勾选式挑战中的解算能力有所提升。针对网站开发者和用户体验设计人员，结果显示网站上下文直接影响了密码找回与账户创建场景下的解算时间（具有统计显著性差异）。我们分析了参与者的专业背景和学历水平的影响，发现特定专业表现更优，而总体上学历水平对解算时间有直接影响。不出所料，参与者认为图像挑战令人烦恼，而勾选式挑战则被认为简单。通过系统可用性量表（SUS）评估，图像任务被评为"可接受"，而勾选任务则被评为"良好"。我们探究了reCAPTCHAv2的成本与安全性，结论是其成本极高且毫无安全性。总体而言，本研究结果自然引出一个结论：reCAPTCHAv2及类似验证码技术应被淘汰。