I wonder why stack exchange system (maybe just the android-enthusiast's one) ask you to type captcha even when you are signed to your account. Should being signed be sufficient verification ?

How algorithm determine when to make an "user/bot" to retype captcha ?

Thanks for answer in advance.


Scripts can have accounts too. It would be easy for a spammer or other malicious user to sign in and then give control to his script. Having the possibility of a CAPTCHA for signed-in users prevents this attack.

The system has a few ways to guess whether particular activity is from a genuine user. Full details aren't available to us end-users, because that would make the system too easy for attackers to defeat.

One common way to make the check go wrong is to leave a page open for a long time before submitting the form; for example, you start to answer a question, then get interrupted, go to lunch, come back an hour later, finish answering the question, and then get the CAPTCHA when you try to post your answer. This is because of a token in the page that expires after some time.

  • 3
    I suspect also a CAPTCHA is triggered by entering text too quickly. If preparing a long question or answer I tend to create the post in an offline editor, then open the relevant page, then paste. This always triggers a CAPTCHA. – Chenmunka Nov 17 '13 at 11:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .