Captchas – might I be a robot after all?

«I’m not a robot,» it says on the screen in front of me. I click the box and a picture puzzle appears. I’m asked to «Select all images with traffic lights». Well, does that mean only the traffic light as such or also the pole it’s attached to? And what about that tiny bit of the traffic light that covers about three pixels of the image in the top left-hand corner? Does that count?

Isn’t it ironic that we have to prove almost every day that we’re not robots – to robots! And what used to be photos and distorted letters are now AI-generated images of animals or actual puzzles that we’re asked to distinguish and solve.

But why are these captchas becoming harder an dharder? And isn’t there a better way of checking if someone’s a robot or not?

What’s a captcha?

Captcha – or actually CAPTCHA – is an acronym and stands for *C*ompletely *A*utomated *P*ublic *T*uring test to tell *C*omputers and *H*umans *A*part. In other words, an automated Turing test that, ideally, identifies you as a human. At worst, however, it’s just troublesome.

You can probably already guess why this is needed online. The purpose of captchas is to protect websites from bot attacks. And at least in the past, picture puzzles and distorted letters were a relatively safe way to keep bots out.

But ten years ago, Google admitted in its own security blog that a lot of bots had learned to solve the captchas that were used at the time – with an accuracy of almost 100 per cent. So, a new solution was needed.

Man versus machine: a close race

While we’ve slowly but surely become accustomed to identifying traffic lights and motorcycles, AI image recognition tools have also improved. Today’s bots can even solve tricky puzzles, as MIT Technology Review writes. And in the worst case, the AI simply recruits a real human to solve the captcha. This has actually happened before.

So what do we do when every captcha puzzle or task can be solved by robots? Google’s answer? No more puzzles.

What robots can’t do

Probably the most successful solution to the captcha problem so far is Google’s reCaptchas. Used on five million active websites, they make up by far the largest proportion of captchas, according to news magazine Spiegel. You’ll know you’ve come across a reCaptcha if all you need to do is click a box.

ReCaptchas don’t verify that you’re a human by having you solve tricky puzzles, but based on your behaviour. Google describes them in their Security Blog as follows: «The updated system uses advanced risk analysis techniques, actively considering the user’s entire engagement with the CAPTCHA—before, during and after they interact with it. That means that today the distorted letters serve less as a test of humanity and more as a medium of engagement to elicit a broad range of cues that characterize humans and bots.»

What this actually means is the captcha analyses your behaviour. It observes how you move your mouse to the box or what you previously did in the browser. A bot would move the mouse at a constant speed and in a straight line – and definitely not google a pesto recipe first. What follows is a calculation of the probability that you’re a human and not a robot.

In most cases, that’s it and you’re in. However, if the probability isn’t high enough, you have to solve another puzzle to be on the safe side.

But captchas train AI, right?

Yes and no. There have been speculations for years that we’ve been teaching AI models what traffic lights, road signs and motorcycles are. Google has admitted in the past that the data from reCaptchas is used to improve OCR text recognition and Google Street View.

When the industry of self-driving cars got rolling, captchas with traffic lights started to appear. Relevant XKCD. But even if it seems likely that we’re training current AI models and teaching Teslas to drive with captchas, it’s never been confirmed.

So do I have to click on the traffic light pole or not?

Captchas have been an important part of the Internet since the early 2000s. A calculation from 2006 showed that 200 million captchas are solved every day. At 10 seconds per puzzle, that’s 150,000 hours, or over 17 years (!) of solving puzzles per day. Now imagine what this number looks like today.

However, with new developments such as Google’s reCaptcha, you should have to solve fewer and fewer captchas in the future. On top of this, technologies are already being developed that could potentially make captchas completely obsolete.

Until then, the answer’s no. No, you don’t need to click on the traffic light pole.

Captchas usually aren’t too strict with your image selection. If you have some spare time and want to brush up on your captcha skills, here are the most common ones to try out.