The entire site is an exercise in delusion and marketing bullshit. I am absolutely convinced that the people selling this abomination of a product have either never used it themselves or are abjectly and wilfully misleading people.
Some other choice quotes from the page:
> Users have a bad association with difficult photo CAPTCHAs.
> Instead of type what you hear (or alphanumerics) puzzles, we ask users simple questions using delightful and amusing scenarios
> All are incredibly easy for legitimate users
> Every Arkose MatchKey challenge is tested on humans. We release challenges only when they meet very strict usability benchmarks. Our strongest puzzles, designed for bad actors, have no impact on good user completion-rates.
> In fact, Arkose MatchKey is the strongest CAPTCHA ever made.
The ChatGPT app uses this. The puzzle I got involved moving a train, it was super confusing and ridiculous. I was imagining a non-technical user doing these, and my god. No chance.
My mum regularly asks for help when all she's done is ignore the captcha thinking it's an advert because it stands out like a Google ad (different UI, different font, extra branding etc).
At least she's learnt to automatically ignore ads, but it comes with consequence of ignoring captchas as well...
The Internet as a whole has become very elderly unfriendly. Even the iPhone becomes an unnavigable mess once you’re trying to help someone 70+ work with it.
And continually changing UIs definitely don’t help.
My parents are in their late sixties and travel internationally quite often and the lack of a physical SIM slot in new iPhones makes them not want to upgrade devices ever, because it would mean that they'd have to learn a whole new paradigm for installing and using eSIM when they're not very tech literate.
An interesting thing is that for Arkose to be effective against bad actors, they can't just make CAPTCHAs that are hard for bots. They also have to be not-easy or at least expensive for a subset of humans who aren't legitimate users, namely 'CAPTCHA Farms' like https://anti-captcha.com/.
Most CAPTCHAs, including ones made by Arkose, have site keys that are unique to that CAPTCHA and public/visible in the browser -- so companies like Anti Captcha can then automate sending challenging CAPTCHAs directly to a human solver in a 'CAPTCHA farm' who can solve it (in a different browser) and have the CAPTCHA return that it was successfully passed, usually all within ~a minute.
So to get around this and -- as Arkose's site says -- make fraud expensive for hackers, Arkose Labs has to make their CAPTCHAs hard/slow to solve. If they do that, then it becomes expensive for bad actors to rely on labor to solve them (anti-captcha.com cites 58 seconds/$3 per CAPTCHA).
As long as the site key is publicly exposed, this basically isn't going to change; you either need to also couple it with other anti-fraud tactics like device fingerprinting, or use a CAPTCHA that doesn't expose the site key at all.
Disclaimer - I work for a company (Stytch) that has a competing CAPTCHA product.
>I am absolutely convinced that the people selling this abomination of a product have either never used it themselves or are abjectly and wilfully misleading people.
Same goes for the people who decided to put it on their websites.
The claims may be silly, but the captchas seem reasonable to me compared to the increasingly impossible to read "what characters do you see?" captchas and the increasingly hard to decipher images of crosswalks and trucks.
Captchas seem to work best when they reflect the simplest task that AI cannot do rather than a task AI can easily do but with the difficulty ramped up.
Unfortunately, Arkose is one of the only viable products for stopping credential stuffing and other similar attacks. It has been implemented at several companies I've worked at because there are just not enough alternatives.
The main value-add for companies like Arkose is that they have teams monitoring and changing the aggressiveness of the challenges as new attackers try to get around them. With a product like Recaptcha, you are inevitably completely screwed when attackers get around it.
If attackers get around reCAPTCHA, you are screwed, but so is half the Internet, including Google themselves. Do you think Google would not care about an increase in spam and would not try to fix reCAPTCHA?
You will not get the same level of support from Google as you will from a vendor dedicated to this. Ironically, HBO Max is the main case study on reCAPTCHA Enterprise's landing page, which I guess did not work out for exactly this reason: https://cloud.google.com/blog/products/identity-security/how...
Some other choice quotes from the page:
> Users have a bad association with difficult photo CAPTCHAs.
> Instead of type what you hear (or alphanumerics) puzzles, we ask users simple questions using delightful and amusing scenarios
> All are incredibly easy for legitimate users
> Every Arkose MatchKey challenge is tested on humans. We release challenges only when they meet very strict usability benchmarks. Our strongest puzzles, designed for bad actors, have no impact on good user completion-rates.
> In fact, Arkose MatchKey is the strongest CAPTCHA ever made.