CAPTCHA stands for Completely Automated Public Turing test to tell Computers and Humans Apart. It is a tool that helps differentiate between bots and humans. The CAPTCHA process makes it difficult for bots to complete but relatively easy for humans.
Let’s explore this method of authentication more thoroughly.
CAPTCHA is used by any website that wants to decrease the presence of bots on the site. It includes:
Maintaining poll accuracy: CAPTCHA security can prevent the skewing of polls by authenticating each user to ensure each vote is entered by a human. However, this makes the time required to cast a vote longer than normal which can deter people from voting multiple times.
Limiting registration for services: Services can use CAPTCHA to decrease the amount of bots that create fake accounts. By restricting account creation, it prevents a waste of services and reduces opportunities for fraud.
Preventing ticket inflation: Systems that sell tickets can use CAPTCHA to prevent scalpers from purchasing large amounts of tickets for resale. It can also be used to prevent false registration for free events.
Preventing false comments: CAPTCHA authentication can prevent bot accounts from spamming comment sections, message boards, and news feeds. CAPTCHA can also reduce online harassment.
Traditional CAPTCHAs include distorted or overlapping letters that are open to human interpretation and prove to be difficult for a bot to comprehend. Access is prevented until all the letters are properly identified.
This type of CAPTCHA generally relies on a human’s ability to interpret and recognize patterns. Bots on the other hand, can only follow set patterns or input randomized characters. The limitation a CAPTCHA presents makes it highly unlikely that a bot will guess the right combination of letters.
Since CAPTCHA was introduced, bots that use machine learning have been developed. Machine learning bots are able to identify patterns in traditional CAPTCHAs with algorithms in pattern recognition. This development led to newer CAPTCHA methods that are based on more complex tests. For example, reCAPTCHA, a popular CAPTCHA service run by Google, now requires clicking in a certain area and waiting until the timer runs out.
Modern CAPTCHAs fall into three main categories—text-based, image-based, and audio.
Text based CAPTCHAs are the original way in which human verification happens. Traditionally, these CAPTCHAs use known words or phrases, or a random combination of digits and letters. Some text based CAPTCHAS can also use variations of capitalization.
The text based CAPTCHA presents these characters in a way that is estranged and requires a human interpretation. The estrangement can involve scaling, rotation, and distortion of characters. It can also involve overlapping characters with graphic elements such as background noise, lines, arcs, or dots. This estrangement can prove to be difficult for bots that have insufficient text algorithms but at times can also be difficult for humans to guess as well.
Techniques for text based CAPTCHAs:
Image-based CAPTCHAs were developed with the goal of replacing text-based CAPTCHAs. CAPTCHA images generally use graphical elements such as pictures of animals, shapes, or scenes. With image CAPTCHAs, users are prompted to either select images matching a theme or images that don’t match.
While image based CAPTCHAs are easier for humans to detect, it presents difficult accessibility issues for visually impaired users. For bots however, image based CAPTCHAS are more difficult to interpret than text because these tools both require image recognition and semantic classification.
Audio CAPTCHAs were developed to provide accessibility to visually impaired users. This type of CAPTCHA is often used in a combination of text and image CAPTCHAs. Audio CAPTCHAs present audio recordings of a series of letters or numbers which the user then enters.
Audio CAPTCHAs rely on bots not being able to recognize relevant characters from background noise. However, similar to text based CAPTCHAs, this can also be difficult for humans to interpret.
These CAPTCHA systems ask users to solve a simple mathematical problem such as, “4+4” or “13+5”. The assumption is that a bot will find it difficult to perform a simple math problem and give a response.
Word problems are another variant to this CAPTCHA. Essentially it asks the user to type the missing word in a sentence, or complete a sequence of several related terms. While these types of CAPTCHAs are accessible to visually impaired users, it may also be easier for bots to solve.
A popular and preferred alternative to CAPTCHA authentication is requiring users to sign on through their social media profile such as Facebook, Twitter, & LinkedIn. The user’s details will automatically be filled in and authenticated using SSO (Single Sign On) verification provided from the social media website.
This type of authentication proves to be easier than traditional CAPTCHA verifications and is a more convenient registration mechanism.
reCAPTCHA is a free service Google offers as a replacement for traditional CAPTCHAs. Like CAPTCHA, some reCAPTCHAs require users to enter images of text that computers have trouble deciphering. Unlike regular CAPTCHAs, reCAPTCHA sources the text from real-world images: pictures of street addresses, text from printed books, text from old newspapers, and so on.
Google has expanded the functionality of reCAPTCHA tests so that they no longer have to rely on the old style of identifying blurry or distorted text. Various reCAPTCHA tests are used to combine information:
There are some bots that can get past a CAPTCHA. According to researchers, it has been documented that there are ways to write a program that beats the image recognition in CAPTCHA. Attackers also use click farms to beat the test, which is essentially thousands of low-paid workers solving CAPTCHAs on behalf of bots.
A Turing test assesses a computer’s ability to mimic human behaviour. Alan Turing, who created the Turing test in 1950, was an early computing pioneer. The way for a computer to pass the Turing test is if its performance during the test is indistinguishable from that of a human. The Turing test is not dependent on getting answers correct but rather how “human” the answer sounds regardless of whether they’re right or wrong.
A CAPTCHA is really the opposite of a Turing test as it determines whether a supposed human user is actually a computer program or not. It does this by assigning a brief task that people tend to be good at and one that computers struggle with.
Bad user experience: A CAPTCHA test can interrupt the flow of what users are trying to complete, which gives them a negative view of their experience on the web, and leading the user to abdon the webpage altogether.
Not usable for visually impaired individuals: An issue with CAPTCHAs is that they solely rely on visual perception. This makes it difficult not just for people who are legally blind but also for anyone with any kind of impaired vision.
These tests can be fooled by bots: As we mentioned, CAPTCHAs are not fully bot-proof and should not be relied upon for bot management.