I had bookmarked this one and forgot about it. It’s interesting how security evolves.
A CAPTCHA no longer asks whether you can read wobbly letters — it silently measures how your mouse moved across the page, because bots trace geometrically perfect arcs and humans wander in tiny, unrepeatable curves.
Somewhere around 2014, the CAPTCHA quietly stopped being a puzzle. For years, the standard test of humanity was a smear of warped letters that you squinted at, guessed, and usually got wrong on the first try. Then Google shipped a version that just asked you to tick a box. No letters, no traffic lights, no fire hydrants — at least not for most visitors. Tick the box, and the page lets you through. It felt like the site had simply stopped bothering.It had not stopped bothering. It had started watching the mouse.
The box is a decoy. Google’s reCAPTCHA v2, introduced as the “No CAPTCHA reCAPTCHA,” is built around a simple observation: telling a human from a bot is much easier if you look at how the visitor behaves before, during, and after the click, rather than at the click itself. The checkbox is a stage. What Google’s script is actually recording, from the moment the page loads, is a stream of tiny events — mouse coordinates sampled dozens of times a second, scroll speed, the exact millisecond gaps between keystrokes, touch pressure on a phone, even the way the browser’s rendering engine handles a hidden canvas.
There is a lot more explanations but it ends with this:
An arms race that has moved off-screen
Bot developers know all of this, and the better ones now inject synthesised human-like mouse traces into their automation frameworks. There are open-source libraries — Ghost Cursor is a well-known one — that generate Bézier paths seeded with random jitter and Fitts-law deceleration. Some commercial CAPTCHA-solving services train neural networks on recorded human sessions and replay statistically indistinguishable movements.
……. The wobbly-letters CAPTCHA of the 2000s is, at this point, a museum piece. It was defeated by optical character recognition years ago, and the puzzles that replaced it are largely theatre. The real test happens in the milliseconds before the click, in the tiny, unrepeatable curves your hand traces without noticing. You’ve been passing it, or failing it, every time you tick a box.