My understanding is that captchas were never supposed to be impenetrable, just difficult enough that to have bots (or mechanical turks) solve them at scale is expensive enough to deter that kind of automation. It’s probably getting a lot easier for a computer to solve nowadays though.

In practice, there are several types of CAPTCHAs: text-based, image-based, audio-based and behavior-based.

Computer scientist writing an article about captchas doesn’t know that proof-of-work captchas exist… Such a joke.

Of course those don’t do much against automated fake form filling, but against DDoS they’re THE solution.

Proof of work (PoW) captchas make the (computing) cost for the attacker exponentially higher than for the website. Basically the website creates a challenge, which has to be solved by the client/attacker before getting access to content. Best of all the website can set the difficulty of the challenge to anywhere from instant to seconds to solve, so normally the users don’t even notice it (as it runs in the background) but once someone starts DDoS’ing the difficulty goes up.

Any CAPTCA that can’t be cracked by a computer can be cracked by shoving it in front of a porn video and someone will solve it for you before it times out.

Captchas like googles older “what are these two words” and “select the traffic lights” are just ways for google to get the public to provide label data for their AI tools anyway

If you use a vpn, private browsing, and/or adblockers some sites will actually gaslight you by telling you that your response was incorrect.