  Audio CAPTCHAs are supposed to provide a strong defense for online resources;
however, advances in speech-to-text mechanisms have rendered these defenses
ineffective. Audio CAPTCHAs cannot simply be abandoned, as they are
specifically named by the W3C as important enablers of accessibility.
Accordingly, demonstrably more robust audio CAPTCHAs are important to the
future of a secure and accessible Web. We look to recent literature on attacks
on speech-to-text systems for inspiration for the construction of robust,
principle-driven audio defenses. We begin by comparing 20 recent attack papers,
classifying and measuring their suitability to serve as the basis of new
"robust to transcription" but "easy for humans to understand" CAPTCHAs. After
showing that none of these attacks alone are sufficient, we propose a new
mechanism that is both comparatively intelligible (evaluated through a user
study) and hard to automatically transcribe (i.e., $P({\rm transcription}) = 4
\times 10^{-5}$). Finally, we demonstrate that our audio samples have a high
probability of being detected as CAPTCHAs when given to speech-to-text systems
($P({\rm evasion}) = 1.77 \times 10^{-4}$). In so doing, we not only
demonstrate a CAPTCHA that is approximately four orders of magnitude more
difficult to crack, but that such systems can be designed based on the insights
gained from attack papers using the differences between the ways that humans
and computers process audio.
