At work I just recently managed to trip it three times in one day, which I consider a record since in the past I've encountered it at most a few times a week. What's more infuriating is that my queries were far less complex than the ones that tripped it before (trying to find information about some API constants), basically one quoted term and one site: modifier. I can understand if I was querying 24/7 and hogging their servers (in which case a nice "please slow down" message would be much better), but it tripped within a few minutes of, admittedly intense, Googling.
The security device may notify the attacker device that the solution is incorrect regardless of whether the solution is actually correct.
In Google's case, it doesn't do that at all --- solve one CAPTCHA successfully and all you get is another, immediately. If you actually do deliberately give the wrong answers, it does tell you they were incorrect.
I wonder what can be done to stop it from doing that, besides the old tactic of evading IP bans by changing IP --- it's somewhat creepy to think that it's probably capable of detecting that too and banning the entire subnet. On second thought, it might be worth it... if it means I can get thousands of others blocked from Google for a nontrivial amount of time, all the more mouths to complain and maybe force some reconsideration. I am not a robot. I am not a competitor scraping your pages or doing anything else against your ToS. I am just an intelligent human with over two decades of Internet searching experience enthusiastically using your service for the exact purpose it claims to do: to find something on the Internet.
I have experienced Google doing the endless captcha when using Opera's built in VPN.
The first time I went through about 3 captchas and then I "knew" they were messing with me.
So, now, I just change my location in the VPN, and get back the searching...
Maybe it’s time to stop using Google and use another search engine which actually treat you like a human being, like DuckDuckGo.
Which shows how important it is for Internet health that we have search competitors to Google who maintain their own indexes. No one company should become the sole practical gateway to the Net.
Once you realize this it’s way less confusing, and in fact it even clearly states the instructions at the top of the CAPTCHA. But it’s super confusing and definitely a usability nightmare.
The goal, as I see it, is to increase the number of round trips to google required to solve a CAPTCHA, in order to increase the cost for those using CAPTCHA solving services.
These Google CAPTCHA's are deployed all over the internet, but you mostly won't notice them until you use a VPN. When you do, you get them at what seems to be their strictest setting: multiple rounds of 'click the object that is a car/storefront/road/mountain/road sign/bus/river', where all pictures clicked are replaced via a fade-out-fade-in that lasts about five seconds before you can continue evaluating the new picture.
To add insult to injury, if you do try to make complex and slightly varying queries and exhaust its result pages in an effort to find something you know exists, very often it will think you're a robot and present you with a CAPTCHA, or just ban you completely (solving the CAPTCHA just gives you another, and no matter how many you solve it keeps refusing to search; but they probably benefit from all the AI help you just gave them, what bastards...) for a few hours.
Edit: I wonder if Google is using this as a sort of income source for pages that bring little to no ad revenue.