Evolution of Captcha: Challenges and Future Solutions

Captcha struggles to keep up as bots continuously learn and adapt, highlighting the need for innovative solutions.

### The Evolution of Captcha: From Basic Tests to Advanced Solutions
* 🤖 Captcha, the online test distinguishing humans from bots, has become increasingly difficult, with even its creator admitting to **frequent failures**.
* 💻 Originally introduced in 2000, Captcha aimed to **block malicious programs** by presenting **distorted text that only humans could read**, leveraging the limitations of early **optical character recognition (OCR) technology**.
* 📚 In 2007, reCaptcha emerged, allowing users to **assist in digitizing books** while verifying their humanity, with Google acquiring it in 2009 due to its **efficiency**.
* 🖼 As bots improved, Google shifted to **image-based Captchas** in 2012, requiring users to **identify objects in complex backgrounds**, presenting a **new challenge for machines**.
* 📊 By 2014, Google introduced **noCaptcha**, which analyzed user behavior and interactions rather than relying on traditional tests, evolving further to **reCaptcha V3** by 2018, which used **hidden data** to differentiate humans from bots.
* 🔍 Despite advancements, the inherent design flaw of Captcha lies in its reliance on **computer systems**, allowing AI models to **learn and adapt**, a concept rooted in **Alan Turing's original test** for distinguishing humans from machines.
* 📱 Future solutions may involve utilizing mobile phone sensors to create **more authentic human verification methods**, indicating a need for a **new approach** in the ongoing battle against **increasingly sophisticated bots**.

- [Narrator] It's not just you, Captcha, the online test to tell whether you're a human or a robot, has been getting harder. This is one of the guys who invented it. - Oh yeah, I fail them all the time. I never know how much to say there's a traffic light if it's only like a tiny little corner of it. - [Narrator] The problem is that Captcha was designed to keep malicious spots out of certain websites, but every time you've solved a test, you've actually made those bots smarter. - As more and more data was fed into these perceptual systems, they simply got a lot better at solving the perceptual tasks. - [Narrator] So what does it take to design a puzzle that can outsmart a bot but still be solved by any human? This is The Tech Behind Captcha. (bright music) So Captcha was first used around the same time

that Yahoo began giving out free email addresses. This was the year 2000. There were people who were writing programs to abuse different web services, and there was no easy way to stop them. And the idea was there should be a test that is really quick that humans can pass, but computers could not. - [Narrator] Luis's test looked like this, a string of letters slightly warped and distorted that the end user had to input into a text field. He called it Captcha, which stands for completely automated public turing test to tell computers and humans apart. And he took advantage of the fact that computers at the time weren't very good at something called OCR, optical character recognition. The way it works is a simple game of pairs. The program scans the image and compares any shapes that emerge like this letter P against a database of different letters in different fonts. The second it finds a match, P has identified the letter.

But if that P was warped, overlapping another letter, or had marks through it, then the program will struggle to find anything in its database that matches and won't be able to identify the letter. Simple, but enough to keep out the malicious bots. The technology behind them was relatively primitive when it came to having access to what a letter looked like. But that advantage wouldn't last long. Here's Luis from 2010. Is there some way in which we can use those 10 seconds while you're typing a Captcha for something that's useful? In 2007, reCaptcha was launched, an updated version that also helped to scan books. At the time, groups like the New York Times and The Internet Archive were in the process of trying to digitize old literature. Since optical character recognition wasn't very accurate at the time, the digitization had errors.

So, to try and help resolve those errors, reCaptcha began showing two words from a scammed document. One was a control word, a word the computer knew, but the other was a word it couldn't quite identify. In answering the Captcha, half of your answer was being used to pass the test, but the other half was used to tell the computer what word it was looking at, helping to improve OCR. Not only are you authenticating yourself as a human, but in addition, you're helping to digitize books and newspapers. The technology was so efficient that Google acquired it in 2009, but a new problem emerged because Captchas relied on machines being bad at reading, and we just taught them to be very good at it. Eventually, the bots were able to get Captchas right more frequently than humans. The test needed to evolve. So, in 2012, Google deployed this image-based Captcha.

- There was a switch to go from distorted characters to the harder problem of distinguishing certain things in images where you have to pick all the ones that have a traffic light or a bicycle or whatever. - [Narrator] Interestingly, when it comes to boxes like this where it's not exactly clear if this counts as a traffic light or not, there isn't actually a right or wrong answer. - The way to get it right is just what the majority of the human population says. - But for machines, this was a huge new challenge. After all, they'd only just learned how to read. See, with text-based Captchas, the machines only had to identify a limited range of variables, letters and numbers from a black and white background. But now with image Captchas, they had to be able to identify anything and spot an object in a very busy background. However, computer vision was just around the corner. - Whereas you and I would process the stream

of perceptual input, the computer vision system is basically taking the pixels and processes strings of pixels, vectorized, we would say. And as it processes these images, it's picking up patterns in the images. It's picking up patterns in the pixels. - [Narrator] Now, for any computer vision system to perform well, it needs a lot of labeled data. - It's being trained to identify cars by having many, many, many images of cars. - [Narrator] The problem was that image-based Captcha was essentially a data labeling task. By solving it, you were once again generating data that could help a bot defeat it. - The systems just kept getting better and better 'cause they kept getting bigger and bigger. - [Narrator] A new approach was needed. So in 2014, Google launched the noCaptcha, one simple box. But this version of capture wasn't looking at whether you clicked the box.

It was looking at how you clicked it and how you interacted with the rest of the internet. See, if you're writing code to make something move, the simplest version will be for it to move at a constant speed in a linear line, but humans naturally aren't that accurate. We overshoot, we don't move in a perfectly straight line. And that is what this version of Captcha was looking for, human flaws. It was also monitoring things like your internet history and your typing speed. If the history was just a string of repeated attacks on the same website, you're probably a bot. But if you stopped halfway through the day to browse for shoes or look at cat videos, you might just be human. By 2018, Google had done away with the tick box entirely and launched reCaptcha V3 based solely on that hidden data. But even flawed human characteristics is something that a smart algorithm can eventually learn to mimic.

So are the bots always destined to win? Well, perhaps. See, there's a quirk at the very heart of Captcha that means bots will always get the upper hand eventually. And to understand what it is, you need to go back to before the internet was invented, to the man at the heart of the Captcha test, Alan Turing. He's considered one of the founding fathers of AI after he penned this paper, Computing Machinery and Intelligence. In it, he describes a method to test whether you're talking to a human or a machine. - You had a questioner right behind the screen and trying to differentiate between a human and a computer machine giving answers. This now has famously become known as the Turing test. - [Narrator] The problem with Captcha is that the questioner isn't human. It's a computer. And therefore, any information that's input into the computer can be used by AI models to train Captcha-defeating bots.

Even Luis's original paper on Captchas says that the technology will act as a security measure for websites and advance the field of AI. You have the research world almost continually catching up and surpassing the Captcha world. [Narrator] But the solution may be to take the test outta the computer and into the real world. We all have mobile phones, and they have so many different sensors within them, being able to tilt the phone on instruction or being able to take a few steps in one direction or another using the sensors in the phone. [Narrator] But in order for us to truly prove that we're human online, we may have to find an entirely new approach. I think the question now is not are we doomed? It's how do we seize control again? I would not be designing a Captcha today. I think that's a losing battle, it's too hard. (warm music)

Why Proving You Aren’t a Robot Has Never Been Harder | WSJ Tech Behind

The Wall Street Journal takes you inside carefully selected stories and events in a visually captivating way so you can dig deeper into the news and insights that matter to you. 

The Wall Street Journal

Captcha has become increasingly difficult, as its original purpose of keeping bots out of websites has inadvertently made them smarter.

The concept was first introduced in 2000, using warped and distorted letters to create a quick test for humans.

The program's success relied on the computers' struggles with optical character recognition (OCR) to identify the distorted letters.

Captchas struggle to identify warped or overlapping letters, keeping out malicious bots.

reCaptcha, launched in 2007, used two words from scanned documents to help improve optical character recognition and digitize literature.

Google's acquisition of reCaptcha in 2009 led to bots becoming better at solving Captchas, prompting the need for evolution in the test.

Image-based Captchas shifted the focus from text to identifying objects in images, posing a new challenge for machines.

Computer vision systems, processing pixel patterns, required a large amount of labeled data for effective training.

The task of solving image-based Captchas inadvertently generated data that helped bots improve, leading to the need for a new approach, which Google launched in 2014 with the noCaptcha.

Captchas initially tracked human flaws and internet behavior to differentiate between humans and bots.

By 2018, Google shifted to reCaptcha V3, using hidden data for user verification.

The challenge for Captcha lies in its reliance on computer algorithms, which can be used to train bots to mimic human behavior, giving them the upper hand.

Rethinking Captchas for Proving Humanity Online

Captchas were originally designed as a security measure for websites and to advance AI, but the research world is quickly surpassing them.

The solution may lie in using mobile phone sensors to prove our humanity through real-world actions.

The narrator suggests that finding a new approach is crucial, as designing a Captcha now seems like a losing battle.