What does clicking ‘I am not a robot’ really mean (or rather what is the CAPTCHA system)?
By Fay Capstick
A 2020 episode of QI gave a rather surprising explanation of what ticking ‘I am not a robot’ on a website really does. They said that it gives a website permission to look at your actions and history on your device to decide if you are human. This week we will look to see if there is any truth in this claim.
What are we talking about?
We are talking about the now familiar box that we are faced with a few times a day, asking ua to click ‘I am not a robot.’ Sometimes it goes no further and we’ve all asked ourselves how does clicking that prove anything, after all a bot must be capable of clicking on it too?
Sometimes it does go further and we are displayed a grid of images and asked to select, for example, all the bikes or traffic lights. This usually leads to endless dilemmas about whether a couple of pixels in the next image counts as needed a tick. Or you might be asked to type characters from a distorted image or to listen to an audio clip and type what you hear. More fun tests include solving a puzzle.
This all somehow magically helps the website decide if we are real, but how does it work?
This system is actually called CAPTCHA (Completely Automated Public Turing Test to tell Computers and Humans Apart). It is a computing test to determine if the user is human. It is sometimes called the reverse Turing test, as the point is to prove humanity rather than artificial intelligence. The tests themselves should be dynamic, helping to work around any programmed responses.
Where is CAPTCHA used?
CAPTCHA is used because bots are faster than human users, and they can be used to do things like quickly book tickets that can then be resold for profit. The system is also used to secure things like online voting, creating a new email account, or sharing webpages on social networking. Fun fact: the CAPTCHA and reCAPTCHA system were invented by the same guy who went on to bring us Duolingo.
Invisible CAPTCHA
With an invisible CAPTCHA the user does not need to do anything, which is good for those of us who are rubbish at working out the distorted text. This type of CAPTCHA is done in the background without the user’s input. This was introduced by Google when they acquired the Invisible reCAPTCHA system.
What is reCAPTCHA and No CAPTCHA reCAPTCHA?
reCAPTCHA was invented in 2007. It used distorted characters and gives the user a couple of words to decipher. One of the words would come from old books or articles that needed to be digitised. Basically, the job of character recognition was being crowd sourced to do the job the OCR was having trouble with. This resulted in 440 million words being transcribed. I can take credit for zero of these, as I find reCAPTCHA a nightmare method.
reCAPTCHA was bought by Google, who developed it into No CAPTCHA reCAPTCHA. This system is more advanced and tracks your behaviour on your computer. This is where the concern about looking into your usage and behaviour comes from. With this system your actions are analysed, including how you are accessing a page in terms of mouse use, scrolling, browsing history, and timings to submit forms. It’s disturbing in some ways, as we don’t expect this when we click the ‘I am not a robot’ box, however it does seem a sensible way to keep the bots at bay. By 2017 over a million websites were using Google’s reCAPTCHA.
Does CAPTCHA actually work?
Mostly, yes! Apparently the version used by Confident CAPTCHA has a success rate of 96% and performs the test 50 million times a month. Obviously, the target is 100%, but 96% is very close, however it still means that bots are getting through and the bots are getting smarter every day.
Why do I have to do CAPTCHAs?
They help a website decide if you are a human or a bot. What bots find harder is mimicking the actions of a user on a computer before they take the test. Therefore when you click ‘I am not a robot’ and the system interrogates your computer usage it will provide a far more reliable test than whether you can correctly click on pictures of hills.
What is the problem?
One obvious problem with the CAPTCHA tests is the issue of disability and accessibility. For example, visually imparted users will not be able to successfully compete the visual tests and hearing impaired people will not be able to do the audio tests. As mentioned, and as someone with visual difficulties, I find the distorted text CAPTCHAs a nightmare. It has also been reported that seniors struggle with CAPTCHAs too. To work around this you can usually click for a new test or an alternative format. However, this isn’t ideal.
The problem with defeating bots is that they are getting better every day and therefore the way we can prove our humanity is an ever-evolving challenge for the developers.
Conclusions
QI was quite correct in that far more is happening behind the scenes when we declare ourselves to be human over robot in this reverse Turing test. I think the thing that most people find troubling about this is that our computer usage behaviour is being interrogated, and we have no idea that this is happening when we merrily tick the box. Of course, if there were full disclosure many would likely click ‘no’, which would cause even more of a problem for those trying to operate websites without being bombarded by bots. The system errs on the side of caution (to stop bots), which is why you will find yourself clicking on images of bikes regularly and that is probably a price worth paying.
Final thoughts
At Parker Shaw we have been at the forefront of the sector we serve, IT & Digital Recruitment and Consulting, for over 30 years. We can advise you on all your hiring needs. If you are looking for your next job in the IT sector please check our Jobs Board for our current live vacancies at https://parkershaw.co.uk/jobs-board