Tor's current CAPTCHA implementation is easily crackable through bots - whether through paid human labour or automatic algorithms with 99.8% accuracy. Although the algorithm by Google is for reCaptcha, the same results could plausibly be applied to Tor's CAPTCHA, which isn't necessarily as secure or hard to read. Can this be done? And surely the NSA and other government agencies have more resources than Google.
So is Tor's Bridge-getting system or are we all being spied on?
- Any captcha can be cracked through manual human labour
- Government agencies have resources to perform massive amounts of human labour
- Therefore any CAPTCHA cannot be used
ispo facto we're all being spied on
And IP-limiting services wouldn't work because you could just use Tor to keep changing your IP. Perhaps we could block Tor end nodes, but there are always private end nodes.
Example CAPTCHA for reference: