Since about 2003, captchas have been widely used as a barrier against bots, while simultaneously annoying great multitudes of users worldwide. As their use grew, techniques to defeat or bypass captchas kept improving, while captchas themselves evolved in terms of sophistication and diversity, becoming increasingly difficult to solve for both bots and humans. Given this long-standing and still-ongoing arms race, it is important to investigate usability, solving performance, and user perceptions of modern captchas. In this work, we do so via a large-scale (over 3, 600 distinct users) 13-month real-world user study and post-study survey. The study, conducted at a large public university, was based on a live account creation and password recovery service with currently prevalent captcha type: reCAPTCHAv2. Results show that, with more attempts, users improve in solving checkbox challenges. For website developers and user study designers, results indicate that the website context directly influences (with statistically significant differences) solving time between password recovery and account creation. We consider the impact of participants' major and education level, showing that certain majors exhibit better performance, while, in general, education level has a direct impact on solving time. Unsurprisingly, we discover that participants find image challenges to be annoying, while checkbox challenges are perceived as easy. We also show that, rated via System Usability Scale (SUS), image tasks are viewed as "OK", while checkbox tasks are viewed as "good". We explore the cost and security of reCAPTCHAv2 and conclude that it has an immense cost and no security. Overall, we believe that this study's results prompt a natural conclusion: reCAPTCHAv2 and similar reCAPTCHA technology should be deprecated.

翻译：自2003年左右起，验证码（CAPTCHA）被广泛用作抵御机器人的屏障，同时也给全球大量用户带来困扰。随着其应用增长，破解或绕过验证码的技术不断改进，而验证码本身在复杂性和多样性方面持续演化，使得机器人和人类均愈发难以破解。鉴于这场长期且仍在持续的军备竞赛，探究现代验证码的可用性、解决性能及用户感知至关重要。本研究通过为期13个月（涵盖3600余名不同用户）的大规模真实世界用户研究及后续问卷调查开展此项工作。该实验在一所大型公立大学进行，基于当前主流验证码类型——reCAPTCHAv2的实时账户创建与密码恢复服务。结果表明，通过多次尝试，用户在解决复选框挑战方面的表现有所提升。对网站开发者和用户研究设计者而言，研究结果显示，网站上下文（即密码恢复与账户创建场景）显著影响解决时间（具有统计学差异）。我们考察了参与者专业背景与教育水平的影响，发现特定专业展现更优表现，而总体而言，教育水平对解决时间有直接影响。不出所料，参与者认为图像挑战令人厌烦，而复选框挑战较易完成。同时，通过系统可用性量表（SUS）评估，图像任务被评为"可接受"，复选框任务则被视为"良好"。我们探讨了reCAPTCHAv2的成本与安全性，结论是其成本高昂且缺乏安全性。总体而言，本研究结果自然指向一个结论：应逐步淘汰reCAPTCHAv2及类似验证码技术。