Heretic and Google reCAPTCHA

What reCAPTCHA does

Version 2 shows a checkbox and falls back to an image grid. The checkbox is not the test. The test is the telemetry Google gathers around the click, plus whatever your Google session says about you, and the grid appears when that is not convincing.

Version 3 removes the interaction entirely and returns a score. Google's documentation suggests starting at 0.5 and tuning it against your own traffic, which is an honest way of saying the number has no absolute meaning. reCAPTCHA Enterprise adds assessment reason codes and account defender features on top of the same score.

The threshold is the product

Suppose the score comes back 0.61. What happened?

You know the model was moderately unconvinced. You do not know which input moved it, whether it was one signal at full strength or eleven at a third each, whether this visitor scored 0.44 last week for reasons unrelated to their behaviour, or whether a retraining shifted what 0.61 means. So you pick a cut, and the cut comes from a fortnight of watching chargebacks rather than from anything about the visitor.

Then a real customer scores 0.83 and is turned away. They email support, support asks the vendor, and nobody in the chain can name the fact that did it, because there is no fact. There is a weighting.

A score moves the hardest decision in the system onto you and hands you nothing to make it with. That is not an implementation flaw. It is what a probability output is.

Some questions are not matters of degree

Some are. Whether a mouse path resembles the population of known-good sessions is genuinely probabilistic, and a probability is the honest answer.

Others are not. The TCP SYN was built by a Linux kernel and the user agent claims macOS. The handshake round trip was 2.1 ms and the browser claims a timezone whose nearest point light cannot reach in under 45. A navigator getter accepts a plain object where the engine's own getter requires a Navigator receiver. The window realm and a worker realm resolve different timezones.

None of those is 0.61 of anything. They are contradictions, in the plain sense that two statements cannot both be true. Rolling them into a float and thresholding the float throws away the one property that made them useful.

What Heretic returns

Three words and the evidence. contradicted means at least one conclusive finding fired. refused means the client did not finish being measured, and it carries the same weight as the other two. uncontradicted means we measured what we asked for and found no contradiction, which is a statement bounded by our measurements and not a claim that the visitor is human.

Alongside it, every finding under a stable ID with a headline you can paste into a support ticket and a definition you can read in the docs.

We do have tiers, but they grade the rule rather than the visitor. A finding is conclusive when its premise is solid and conditional when the premise might be wrong. geo.rtt-below-vacuum is conclusive because nothing beats light. geo.rtt-below-fibre is conditional because microwave and satellite paths beat glass and we do not measure the medium. We never demote a rule because we dislike who it correctly identifies. That judgement is yours.

The accessibility cost

Worth stating plainly, because it is usually left out. Image and audio challenges are hard or impossible for a meaningful share of real users, and the W3C has a working group note on exactly this. Meanwhile solving services charge under a dollar per thousand, and current vision models clear image grids at rates above human accuracy.

A puzzle that costs an attacker a fraction of a cent and costs your genuine users several seconds is priced the wrong way round.

Which one you want

reCAPTCHA is free at the volumes most sites run, and it is fine for spam on a low-value form. If you are already running v3 with a threshold you trust, there is nothing here that says rip it out.

If you have ever had to explain a block to a customer and could not, or you need to know that two registrations came from the same machine, a score is not going to get you there.