The spammers thought the same when Bayesian spam filtering started working: "I'll just program a Markov chain to insert some none-spammy words". It did not work out quite so well.

I've also been thinking on how to defeat this, but even the mouse movement seems hard. You are trying to beat the big data statistics that Google has on these mouse movements. Programming a distorted mouse path does not take into account micro-movements (compare with saccades) or speed. To simulate mouse movements convincingly, I figure you'd need a model based on actual mouse movement data on these Captcha's. Also, you may succeed once or twice, but the third time the system is detecting your bot, making all your work void, since your code is now a new signature for bot-detection.

Bots want to quickly leave a message and move on to the next one. Real users first read an article, before they comment. If "Time on site before filling in Captcha" is a feature, then there may be no other way around detection, than for your bot to wait 5-10 minutes before filling in the Captcha.

I think this new system really makes it easier for non-bots to quickly fill in a captcha, and makes it harder for bots. Also because reputation (of IP, of cookies and behavior on Google domains) now seems to play a larger role.

The result of this reputation system for Captcha's is that Google admits to tracking their users outside their own domains. This also places the entire Google+ eco-system, analytics code, Chrome, fonts, charts and Google Hosted Libraries in a different light. Google tracks you everywhere, and the actions you take build or break your online reputation. I am not sure as a legit user that I want to trade this privacy concern, just so I can show my "humanity" and that I am not an evil bot. An evil bot would crawl the pages where these captchas are hosted, and join this data with the captcha user data. Then you can get personalized advertisements when you comment on 4chan in political threads.

Exactly what I was thinking. Even if Google got smart enough to detect that the distorted path speed was too mechanical, you could record 100's of macros of yourself moving the mouse towards a target. When it's time to submit a captcha, select one of the macros at random and play it back with some slight randomness added. Voilà!

Mouse movement is not the only factor Google is using.

I don't have a mouse, as I'm using a tablet device, and it recognized me as a human as long as I have cookies enabled

Yeah, good luck with that.

Ya, a little good luck to he, but not so much...

I have seen video-games bots that does that unbelievably well. Some powerbot.org scripts are sincerely more human than myself.

http://phantomjs.org/ makes this easy enough to do.

You seem to be assuming Google doesn't know of PhantomJS and many other automation frameworks. In fact, I personally wrote some of the code to detect them - not in ReCaptcha, but in a closely related project (which ReCaptcha may be using, even...)

I'm pretty sure you can just harvest mouse movement information and train a computer to mimic that.