Build1 publisher3 min readPublished
A $300 solver bill leaves CAPTCHA at 5% of a credential run's cost of goods
The 5% comes from one dev.to post's worked example, and it holds only if an attacker's hit rate against your login is near 0.3% and a stolen account resells near $20. At a 0.03% hit rate the same bill is half of revenue.
The Engineer · Build desk
What happened
- A dev.to post argues the CAPTCHA category has lost the cost asymmetry von Ahn's 2003 definition rests on, and that none of its three conditions hold for any visual challenge in 2026.
- It reports reCAPTCHA v2 grids solved above 90% by GPT-4-class vision models since 2023, a rate it says exceeds the average human rate on the same puzzles.
- On the defender's side it reports reCAPTCHA v3 scoring legitimate Linux, Firefox and VPN users below 0.3, while gamed real-Chrome checkers score 0.7 to 0.9.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- cost The false-positive tail is paid in lost signups by the team that installed the widget, and privacy-browser users blocked at the edge never appear on any invoice.
- decision Whether to keep a challenge widget turns on your own numbers, because at a 0.03% hit rate the same $300 solver bill takes half the attacker's revenue and starts to deter.
- exposure A reCAPTCHA v3 install puts the privacy question on all traffic, including the visitors who were never suspected of anything.
- constraint Replacing the widget with combined signals requires behavioural telemetry most teams do not collect today, and buying it ready-made means accepting a scoring decision made inside someone else's edge.
Solver providers expose roughly the interface a site does. You send a challenge image or a sitekey to 2Captcha, CapSolver or AntiCaptcha, a token comes back, and you pay per solve [5].
The post says it is quoting mid-2026 solver pricing in round numbers, and the per-provider figures do not appear in the text [6]. The one price recoverable from it sits inside the worked example: $300 of solver cost against 100,000 attempts a day is $0.003 a solve [7][9]. The numbers in the example add up. 100,000 attempts at a 0.3% hit rate is 300 accounts, and 300 accounts at $20 is the $6,000 of daily revenue the post claims [25].
The 5% conclusion [8] depends on two inputs the post supplies without sourcing: that 0.3% hit rate and that $20 account [7]. Hold the solver bill and the attempt volume, and move the hit rate one decimal place. 100,000 attempts at 0.03% is 30 accounts and $600 of revenue, and the same $300 is now half of the operation's takings [10]. For the 5% to transfer to your service, an attacker's success rate against your specific login stack has to be near 0.3%, and credentials from your platform have to resell near $20.
On the solving side, the post reports reCAPTCHA v2 grids broken end to end by GPT-4-class vision models in 2023 and by smaller fine-tuned models since, at above 90%, higher than the average human rate on the same puzzles [11]. The post names no grid variants and no measurement method. The audio accessibility fallback goes to Whisper at similar reliability [12], and Arkose FunCaptcha's 3D-rotation task held out until depth-aware models trained on synthetic renders began solving it reliably in 2025 [21].
Turnstile skips the puzzle and scores browser environment signals [17]. Browserbase and Hyperbrowser serve real Chromium on real residential IPs, so their traffic passes with high frequency [18], while Brave with strict shields, LibreWolf and Tor get blocked often enough to show up in conversion [19]. reCAPTCHA v3 has the mirrored version: operators warm real Chrome profiles with Google session cookies on seasoned residential IPs and score 0.7 to 0.9 [13], and legitimate users on Linux, Firefox, hardened browsers or VPNs land under 0.3 [14].
The post describes the resulting escalation as a quarterly ritual, reCAPTCHA to v3 to hCaptcha to Turnstile with the bots still arriving, and a Slack message around month four reading "what if we just made it harder for real users?" [24]. hCaptcha, on its account, is v2 with a privacy-first marketing posture, solved by the same providers at similar prices and success rates [16].
Shipping v3 also puts a Google tracking beacon in front of every visitor [15]. The post calls that a live regulatory issue under GDPR and US state privacy laws [15].
What it proposes instead is a composition: six independently useful components, of which most production stacks run three or four, on the argument that combining cheap signals raises attacker cost faster than any single signal does [22]. The first component needs telemetry a lot of teams do not currently collect, including continuous mouse trajectories carrying 3 to 25 Hz micro-tremors from physiological hand movement, plus hover, overshoot and correction [23]. Turnstile is the nearest shipping thing to that approach, and the post's verdict on it is "Right shape for the future, closed implementation tied to one edge" [20].
What to watch
- Whether solver providers publish per-solve prices that match the $0.003 implied by the post's example.
- Whether Cloudflare opens Turnstile's environment signals or scores to site owners instead of keeping the decision at its edge.
- Whether a regulator acts on the reCAPTCHA v3 beacon under GDPR or a US state privacy law.