I just learned that Google came out with this new version of Recaptcha that supposedly detects the difference between a human and bot submission without any required input from the human, such as solving a simple puzzle or checking a box.

How can this version of Recaptcha still tell the difference between spam bots and humans?

  • Whereas earlier versions of reCAPTCHA used widgets which would stop the flow of an application if not answered correctly, reCAPTCHA v3 implements a "threshold" score based on more of an AI approach to detect "suspicious interactions", and then lets the API developer chose the actions to score. Bots are typically not very smart and don't mimic humans very well, they just try to defeat things with "brute force" - they have common features like requesting pages very quickly without interacting with elements on the page... – dan Jun 17 '19 at 4:23
  • 1
    Google doesn't state exactly what criteria it uses to detect bots since that might help spammers to avoid them, so we can really only guess, but it's likely based on signals like mouse movement or touch events, page scrolling speeds, expanding hidden/collapsible content, etc... all things the common spammer isn't going to be able to reproduce very easily. The good news is that sites that use these will be a lot less "friction-less", without users having to stop and figure out puzzles or check boxes. – dan Jun 17 '19 at 4:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.