In this question on software recommendations, the OP asks for an alternative to Google reCAPTCHA because "for a security reasons also we don't want to depend on any out side services".

As far as I know, you ask Google for a CAPTCHA, you display it, you send the user’s input to Google who tell you if the input was correct or not.

Where’s the possible insecurity? 

It's not like you send Google the user's log in, password, d.b.b, bank account number or any other sensitive information.

I suppose that a truly determined attacker could use some man-in-the-middle attack, but why? CAPTCHAs are generally used to prove you are not a bot and not as login credentials.

Am I missing something? Is the OP correct to be concerned or is he just going to cause himself a heap of extra work, possibly by trying to implement his own system which he believes to be safer than Google's because ... security through obscurity?

Well, there could be a couple of concerns:


Denial of service: In case the Google reCaptcha system somehow goes down, your users will probably not be able to authenticate anymore. This could also happen if they implement some kind of update, which breaks the whole system.
External JavaScript libraries: when using Google reCaptcha, you need to include some JS libraries. In case Google wants to execute some XSS attack, you have just made it a lot easier for them.
Tracking: anyone clicking through the reCaptcha 'consents' to be tracked by Google. This may impact your user's privacy, as well as provide a means for Google to track traffic on your website. 


However, as mentioned in this answer, they probably care more about their reputation than about compromising your website. Although I doubt that when it comes to the 'tracking' concern. 
