Given that a large part of the world doesn't use the major/minor dichotomy, or even equal temperament, this seems like a terrible way to verify someone is a human...

My favourite recaptchas, if one can have such a thing, are the shape sequence selection ones as they don't make significant assumptions about culture or education.

I'm very much of the opinion that almost all modern captchas are american-centric. Mailboxes, fire hydrants, Trams are not recognizable for billions of people.

Sidewalks/Crosswalks: American English terms

Traffic Lights: We never put them in strings above roads

A lot of US-centric assumptions built into captchas I see

[0]: https://news.ycombinator.com/item?id=25227518

For international websites it would be good to follow the users chosen language. But if a website doesn't have a english version(or other alphabet based version), expecting alphabets in a captcha is not very reasonable.

As an American expat living in a country that doesn't speak English by default... I'd say it's fairly reasonable. Captchas aren't the responsibility of the site owner, the captcha integration docs should explain how to pass the language through to them and should require developers to do so.

Cheese is though? And I'm pretty sure most of the world would recognise those things anyway - you forget how much American culture is spread through films and TV.

Just for context, 65% of India is rural and a ton of these people do not have access to the internet and will have zero idea how to get through these arcane captchas. The internet is effectively locked off to them

While I agree with both the theme and vigor of your position, your sentence made me wonder how people are seeing CAPTCHAs without the internet?

Damn I didn't know so many rural Indians without internet access are using AirBnB...

Thats why it's usually just easier to pay some people pennies to solve them by hand.

I wonder, does recaptcha work with your google account? Because at some point a lot of people will end up doing some kind of identity verification on there. But I think Google and co can make a reasonable assertion about being human by looking at activity across said Google account - location, emails, documents, etc.

  @@||google.com/recaptcha/\*$script

I wonder if the strategy is to create such a large number of different tasks that it becomes practically difficult to build solutions for all of them individually.

For instance, detecting 'sad' music is an easy task, but what if that is only 1 of 500 possible Audio-Captcha types - which also include 'select the angriest speech' and 'identify which music was played on a record player'. Individually these are probably moderately easy to solve, but if they can write/create new Captcha types quicker than people can solve them, they would stay ahead (unless someone can generalise them - but generalising is a much more difficult challenge).

It's effectively the WarioWare approach to Captcha's - an individual WarioWare game would be trivial to automate/solve, however automating the full WarioWare series would be a real big task (again, unless some sort of generalised AI can be used).

They could even employ some interesting strategies with who/when they show particular catcha types to in order to throw off bot writers.

You are right that you can probably repurpose / retrain solutions fairly quickly, but if the CAPTCHA-creators can create frameworks to create new Captcha-types fast enough (e.g. put a structure in place so it takes 1 person a day to create a new type, and you can have a team of 20 people churning out new ones constantly) then the economics of running a captcha-solving team becomes exponentially harder, and building a captcha-solver involves a lot more work.

i.e. If it is quicker to create a Captcha rather than solve it, and the people who are creating the Captcha's have more resources than the Captcha-crackers, they will stay ahead.

Security through obscurity is a valid strategy to slow down efforts, and will definetly help when you have teams of people working to defeat your security.

It doesn't need to be perfect either in most cases - just good enough that you can drive down cost progressively by trying an automated solver first before passing it on to a human if it fails.

Ultimately you'll only stop people in those cases where the monetary value of bypassing it is very low. (EDIT: And because such solvers are reusable, you need to effectively never re-use captcha types between high-value targets and low-value targets or people will end up training solvers on high-value targets as part of paid services and they'll trickle down to lower value targets as soon as they're automated fully)

Frankly, some captcha's are getting obnoxious enough that we're getting close to the point where I'd be willing to pay for a subscription service to have people solve captchas for me just for my own personal use.