CAPTCHA : reCAPTCHA, hCaptcha, Turnstile

In the vast landscape of the internet, there exists an inevitability for website owners: if you publish an unsecured form, it will inevitably attract the attention of spammers and malicious bots. To protect your users and your platform from these threats, you need robust security measures in place. One such measure is CAPTCHA protection, which stands as a shield against spambots. In this article, we delve into the principles behind CAPTCHA protection and provide a comparison of some of the best CAPTCHA solutions available today.

What is CAPTCHA?

CAPTCHA, an acronym for “Completely Automated Public Turing test to tell Computers and Humans Apart,” has been around for over two decades. Initially, it was synonymous with deciphering distorted letters or numbers in images to verify human users. However, CAPTCHA has evolved significantly over the years. Today, CAPTCHA providers are moving towards passive verifications that do not require direct user interaction.

We can classify CAPTCHAs based on their need for user interaction into three categories:

1. Active CAPTCHAs: These require user interaction every time a user attempts an action, such as sending a message through a contact form. Active CAPTCHAs present users with challenges like solving math problems or identifying objects in images.
2. Passive CAPTCHAs: Passive CAPTCHAs operate without direct interaction with the user. They return a verification score, allowing the application to decide whether to proceed. These CAPTCHAs analyze user behavior, history, time-based checks, and may include proof-of-work or proof-of-space checks.
3. Hybrid or Invisible CAPTCHAs: Hybrid CAPTCHAs perform background tests in the browser and only require user interaction if the automated test fails to verify a human.

CAPTCHA Providers Comparison:

To assist you in selecting the right CAPTCHA solution for your website, we’ve compared four leading providers:

1. Google reCAPTCHA v2: This hybrid CAPTCHA offers 1 million free calls per month, with a rate limit of 1,000 calls per second. Additional calls cost $1 per 1,000.
2. Google reCAPTCHA v3: A passive CAPTCHA, it also provides 1 million free calls per month, with the same rate limit and pricing as v2.
3. hCaptcha: hCaptcha offers active, passive, and hybrid CAPTCHA solutions. The Active mode is free up to 1 million calls per month. For other modes, the Pro plan costs $139 per month (or $99 when paid annually) and includes 100,000 free calls, with additional calls priced at $0.99 per 1,000.
4. Cloudflare Turnstile: This passive and hybrid CAPTCHA is free up to 1 million calls per month during its open beta. Custom pricing applies for usage exceeding 1 million calls.

Security Under the Hood:

The CAPTCHA verification process involves both the frontend and backend components of your application.

• In passive mode, the challenge runs in the background, and a verification token is returned to the user agent.
• In active mode, a CAPTCHA challenge is rendered, and upon successful completion, a verification token is returned.

Regardless of the interaction mode, the verification token is checked on the backend using the CAPTCHA verification API.

How it works?

The security of a website employing CAPTCHA protection extends beyond the user interface and delves into the intricate workings of both the frontend and backend components. The nature of this security varies based on the CAPTCHA’s interaction mode.

In passive mode, the CAPTCHA challenge operates discreetly in the background, diligently analyzing user behavior and other subtle cues. Once this passive challenge is complete, it discreetly furnishes a verification token to the user agent. On the other hand, active mode is more perceptible to the user. Here, a visible CAPTCHA challenge is presented, and the user must successfully complete it to obtain a verification token.

However, the pivotal point in the CAPTCHA verification process lies in the backend, where the actual authentication takes place. Regardless of whether passive or active mode is employed, the verification token generated in the frontend undergoes scrutiny using the CAPTCHA verification API. This crucial step ensures that only legitimate human interactions gain access while keeping automated bots at bay.

To provide a visual representation of the passive verification process, consider the sequence diagram below. It encapsulates the intricate steps involved in this seamless, behind-the-scenes security check, safeguarding your website and users from malicious intruders.

Conclusion:

With the evolution of passive CAPTCHA providers, you no longer need to inconvenience your users with time-consuming challenges. These solutions efficiently verify human interaction while maintaining a seamless user experience.

According to Cloudflare, Turnstile is designed to be privacy-focused and it doesn’t rely on tracking user data to determine if a user is a robot, meeting the ePrivacy Directive, and GDPR and CCPA compliance requirements.

In an age where web security is paramount, CAPTCHA solutions serve as crucial allies in the ongoing battle against spambots and malicious actors on the internet.

Related posts:

React 18’s Concurrent Renderer: Better Rendering Performance