I wonder, does recaptcha work with your google account? Because at some point a lot of people will end up doing some kind of identity verification on there. But I think Google and co can make a reasonable assertion about being human by looking at activity across said Google account - location, emails, documents, etc.
@@||google.com/recaptcha/\*$scriptI wonder if the strategy is to create such a large number of different tasks that it becomes practically difficult to build solutions for all of them individually.
For instance, detecting 'sad' music is an easy task, but what if that is only 1 of 500 possible Audio-Captcha types - which also include 'select the angriest speech' and 'identify which music was played on a record player'. Individually these are probably moderately easy to solve, but if they can write/create new Captcha types quicker than people can solve them, they would stay ahead (unless someone can generalise them - but generalising is a much more difficult challenge).
It's effectively the WarioWare approach to Captcha's - an individual WarioWare game would be trivial to automate/solve, however automating the full WarioWare series would be a real big task (again, unless some sort of generalised AI can be used).
They could even employ some interesting strategies with who/when they show particular catcha types to in order to throw off bot writers.
You are right that you can probably repurpose / retrain solutions fairly quickly, but if the CAPTCHA-creators can create frameworks to create new Captcha-types fast enough (e.g. put a structure in place so it takes 1 person a day to create a new type, and you can have a team of 20 people churning out new ones constantly) then the economics of running a captcha-solving team becomes exponentially harder, and building a captcha-solver involves a lot more work.
i.e. If it is quicker to create a Captcha rather than solve it, and the people who are creating the Captcha's have more resources than the Captcha-crackers, they will stay ahead.
Security through obscurity is a valid strategy to slow down efforts, and will definetly help when you have teams of people working to defeat your security.
It doesn't need to be perfect either in most cases - just good enough that you can drive down cost progressively by trying an automated solver first before passing it on to a human if it fails.
Ultimately you'll only stop people in those cases where the monetary value of bypassing it is very low. (EDIT: And because such solvers are reusable, you need to effectively never re-use captcha types between high-value targets and low-value targets or people will end up training solvers on high-value targets as part of paid services and they'll trickle down to lower value targets as soon as they're automated fully)
Frankly, some captcha's are getting obnoxious enough that we're getting close to the point where I'd be willing to pay for a subscription service to have people solve captchas for me just for my own personal use.