Tech Graveyard/security
The CAPTCHA (2000 to Dying)
Bots solved distorted-text CAPTCHAs with 99.8% accuracy in a 2023 UC Irvine study. Humans scored 50 to 84%. The CAPTCHA increasingly blocks humans, not bots.
Born 2000 · Still dying, projected end 2027 · Status: dying
By Deepak Gupta · Published · Last updated
Paired prediction: what replaces it in Future Tech
Certificate of Death
Name of decedent
The CAPTCHA
- Born
- 2000
- Died
- Not yet
- Age
- 26+
Cause of death
Bots and AI vision models solve CAPTCHAs as well as humans, for a fraction of a cent per solve
Survived by
Behavioral biometrics, device fingerprinting, Cloudflare Turnstile, Apple Private Access Tokens
Invented by
Luis von Ahn, Carnegie Mellon University
The hook
A 2023 UC Irvine study found bots solved distorted-text CAPTCHAs with 99.8% accuracy. Humans managed 50 to 84%. In 2024, ETH Zurich researchers solved 100% of reCAPTCHA v2 image challenges with a YOLO vision model.
Thesis. The CAPTCHA was always a Turing test. The Turing test is now trivially passable.
The story
The origin
Luis von Ahn, Manuel Blum, and colleagues at Carnegie Mellon coined the term in 2000. By 2008 reCAPTCHA was digitizing books while blocking bots, which felt brilliant: a security check that produced useful work as a side effect.
The arms race
Warped letters gave way to image grids ('select all traffic lights'), which gave way to invisible challenges, which gave way to 'tap and hold.' Each generation harder for humans, eventually trivial for AI.
The economics flip
Human solver farms already sold solves for a fraction of a cent. Then automated solvers matched humans in accuracy and speed. Solving CAPTCHAs became cheaper than the cost of legitimate users abandoning the flow.
The user backlash
Every CAPTCHA adds friction, and some real users abandon the flow instead of solving it. The UC Irvine study clocked humans at 9 to 15 seconds on distorted text. The cost of false positives (humans failing, humans giving up) can exceed the cost of accepting some bots.
The replacement
Behavioral biometrics. Cloudflare says Turnstile runs on challenge pages across more than 25 million of its websites (September 2023). Apple Private Access Tokens ship in Safari. Neither asks the user to do anything.
Key data points
- CAPTCHA term coined at Carnegie Mellon: 2000
- reCAPTCHA launched: 2007 (acquired by Google 2009)
- Bots on distorted-text CAPTCHAs: 99.8% accuracy (UC Irvine, 2023)
- reCAPTCHA v2 image challenges solved: 100% (ETH Zurich, 2024)
- Turnstile on Cloudflare challenge pages: 25M+ websites (Cloudflare, September 2023)
- Apple Private Access Tokens shipped: iOS 16, Safari 16
Contrarian angle
The CAPTCHA's most successful function in its last decade was annoying paying customers off your site. Bots solved it. Humans gave up.
The flip side
What replaces it
The paired prediction in Future Tech.
Read the prediction◆ Technology Rewired
See the full evolution in Technology Rewired:
FAQ
Are invisible CAPTCHAs (reCAPTCHA v3) more effective?
Modestly. They reduce friction but still score off a model that AI can game. The honest answer: they are a stopgap, not a future-proof solution.
How do behavioral biometrics work without invading privacy?
They score signals like mouse trajectory entropy, typing rhythm, touchscreen pressure patterns. The signals are processed locally or with privacy-preserving cryptography. Most users have no idea it is happening.
Should I still use CAPTCHA on my contact form?
Use Turnstile or hCaptcha's invisible mode. Honey-pot fields plus rate limiting handle most spam with far less friction.
More from guptadeepak.com
Further reading
Related obituaries
More from the security graveyard.
1987 to dying
DyingSignature-Based Antivirus
In 2014 a Symantec executive told The Wall Street Journal that antivirus was dead. Marketing budgets kept signature AV alive another decade. EDR and XDR are finishing the job.
Cause: Polymorphic and AI-generated malware made signature matching mathematically impossible
security · Peak 2005 · Projected end 2027
1839 to dying
DyingThe Photo as Proof
I built a CIAM platform that scaled to over a billion users, and its whole job was deciding whether a credential is real. Photographs used to do that work for free. That era is ending quietly, and almost nobody has changed how they look at an image.
Cause: Generative models that produce photoreal images of anything, indistinguishable from a capture, at zero marginal cost.
security · Peak 2005 · Projected end 2028
1960 to dying
DyingStranger Danger
We taught a whole generation one rule: do not talk to strangers. Then we got in their cars, slept in their homes, and matched with them at 11pm. I spent years building identity systems, the kind of trust rails that made the rule obsolete, and I am still not sure we made the right trade.
Cause: Rating systems and platform intermediation made stranger trust scalable, so the instinct to avoid strangers stopped paying off.
security · Peak 1990 · Projected end 2030