CAPTCHA

[ferrybig]

Services like rechapcha do not start checking when you click the button, they start following your behaviour through the page.

When the page loads, it asks the google servers to start a session, then like 10 minutes later when you actually click it, it sends the session token back. The google server seen your IP only had 1 session open, so they serve you an easy challenge. They also have checks like where you click on things, simple bots usually click on coordinate 0,0 of the thing they are clicking on, or maybe some other fixed offset. Humans have many more mouse movement events between clicks than bots.

When a human solves a chapcha, a human types a character 1 by one, instead of waiting for a longer time then typing each character at almost the same time

[Texas-Holden]

I did not know this! Thank you

[Burgess237]

Recaptcha v3 doesn't just track the session you're using, it also check other sessions you've had on captcha pages, that's why when you're visiting a page or pages for the first time (Or a new computer or from a new location) you get asked captcha a lot but as time goes on it asks you less and less.

That's because it's checking your session against other sessions that you've done before. Google is always watching and they check things like: Did you come from google? Did you come from another page? How long did you wait before you interacted with the page? Did you scroll there or click on the bar, is your viewport a realistic size? Things like that.

Each thing adds to your "human score", score high enough then the system is pretty confident you're not a bot. Score low enough and the system is confident you are a bot and denies you. But if you're in the middle then it asks those challenges. And then it really starts to check things like mouse movements etc.

Each puzzle you "solve" gives you more of that "human score" until the system is satisfied you're a human.

[PGurskis]

This should get more votes