All in all I have to solve the captcha 5 times or so, each time involves marking multiple images.
What sense does this make?
Either they trust the captchas (then they only need one), or they don't (then they should remove them). I've complained about this to them in the past but they haven't changed it.
I think each smallish site would benefit from designing their own captchas because that way the effort to solve for machines would be harder than solving the Google captchas. The effort to solve for humans would be a lot lower. This is perhaps one of the few areas where rolling your own security solution is beneficial by virtue of it being different.
Basically, I can't think of a way to come up with something ez that defeats it. You would have to train a neural net specifically on these images because normally neural nets are bad at instagram filter removal unless trained on it. Plus you can slow down/ban/mess with requests based on cookies.
There are basically infinite solutions. Would take a couple of days to implement and would be really fun. I guarantee you: if your site gets maybe 30k visitors a week, nobody would bother spending a month cracking your captcha when there are much easier targets out there.
Finally, you can make it super annoying to actually find where the image is by converting to svg and messing with html structure/compose image in JS. Now they're going to be forced to run a headless browser, take screenshots of the captcha page and finding the image within the page.
If they take the pay-per-captcha approach, I don't think anti-captcha and the like would make it too ez. Still days of work to set up something really brittle.
That was a common captcha technique a decade ago. It didn't last.
> Basically, I can't think of a way to come up with something ez that defeats it.
You're mistaking your inexperience with the field and its methods for difficulty in solutions.
> Finally, you can make it super annoying to actually find where the image is by converting to svg and messing with html structure/compose image in JS.
This isn't hard to defeat. SVG is really no harder than PNG or JPEG to deal with, and if you are programatically altering it, it's trivial to figure out the purpose of the JS and re-implement it, and pass in whatever randomized variables change it. Or just use node, and scrape it from the page and run it as delivered.
> Now they're going to be forced to run a headless browser, take screenshots of the captcha page and finding the image within the page.
That's trivial. Far more trivial now than it was in the past, actually. There's plenty of systems around to run headless browsers. Some are to ease testing for developers, some are specifically designed for and marketed to people that want to do things just like this. Worst case, you use electron and make your own browser to do it.