How Do CAPTCHAs Work and Why Are They So Difficult?