ZenLinux Blog

I just noticed a major usability improvement regarding the use of CAPTCHA images for login verification. Namely, don’t show one until you’ve received a failed login attempt. NewEgg does this, and a colleague tells me Google has been doing it, too. It makes perfect sense – give your user the benefit of the doubt the first time around, and then enforce use of the CAPTCHA if you suspect you might be the target of a brute-force attack.