How Do CAPTCHAs Work?

While filling out forms or taking part in online surveys, you have probably come across that annoying part where you have to look at a tiny image containing letters and numbers (often distorted or smashed together against a background to apparently make it more difficult to make out) and subsequently type those characters into a text box provided next to it.

So, what’s that stuff all about? Why does the code have to be so difficult to read? What purpose does it serve to have us re-type something that’s already there?

What is a CAPTCHA?

An example of a CAPTCHA (Image Source: commons.wikimedia.org)

For those who don’t know about these already, the twisted image you see above is actually an image-and-text tool, officially called a ‘CAPTCHA’, which is an acronym for ‘Completely Automated Public Turing test to tell Computers and Humans Apart’. It’s basically a type of challenge-response test (a variety of protocols where one party asks a question and the other party has to provide a valid answer to be authenticated) that’s used to determine whether a user is a human or a bot.

In essence, CAPTCHAs are a more advanced version of the Turing Test – a test developed by British innovator Alan Turing to ascertain the humanity or ‘humanness’ of the subject to which a test is being administered.

The most common type of CAPTCHA seen today was first formulated by a small group of engineers and tech enthusiasts back in 1997. It consists of a combination of distorted letters and digits (most of the time), coupled with colored backgrounds, which doesn’t make any real difference to a human looking at the screen, but it certainly complicates things if there’s a machine ‘sitting’ at the other end. Since, in this case, the administer itself is a machine (as opposed to the original Turing test, where the administer was supposed to be a human), a CAPTCHA is also sometimes referred to as a reverse Turing test.

How do CAPTCHAs work?

Traditional ‘type the letters you see in the image’ CAPTCHAs ask users to identify and submit a value (like a word or number) they see in a distorted/blurry image. These CAPTCHAs rely on the human ability to identify and comprehend visual/audio cues that would be extremely difficult to replicate in bots. Such mechanisms assume that if the user is able to make out such difficult words and patterns, they must be a human.

These types of CAPTCHAs are pretty effective, but sometimes they make the text too blurry or distorted for even humans to make out.

Moreover, they require us to ‘type’ in the hidden code – an additional task that most would just prefer pass on, if possible.

Google’s “I’m not a robot” CAPTCHA

At some point in recent years, you have almost certainly come across Google’s “I’m not a robot'”reCAPTCHA, which asks you to click on a check box, sometimes followed by an additional task of clicking on similar or related pictures.

Google’s reCAPTCHA (Photo Credit: Google.com)

This modern take on authentication employs a path-breaking design with reCAPTCHA to ensure maximum protection against bots, while requiring minimum effort on the part of users. It verifies the humanness of the user by examining the cues they unwittingly provide, including cookies and their IP addresses. It even examines the tiniest movements and keystroke patterns of users who frequent Google to tell them apart from bots.

What’s the purpose of CAPTCHAs?

CAPTCHAs are put in place to ensure that only actual humans engage and perform actions in a given system, rather than automated software (also called bots) that does the same thing and gives the false impression that an actual human used the system.

You will most likely find CAPTCHAs at the end of a purchase or online process while filling out forms, signing up on a web service, or participating in an online survey in order to ensure that the user who just interacted with the system was a real human. In other words, CAPTCHAs want to guarantee that the sign-up was done or the form was filled out by a human and not a machine.

CAPTCHAs are also used by tech giants like Google to stem “click frauds”, wherein automated bots (instead of real humans, whom the ads are actually meant for) click on pay-per-click ads and unethically generate revenue for the sites that host them.

Why do they make CAPTCHAs so hard to read?

Good luck deciphering this one!

A CAPTCHA that’s easy to read is no good, as there are a number of computer programs that can scan an image and successfully predict the message based on the shapes we see in daily life, such as numbers and letters. Therefore, a CAPTCHA that’s easy to read might make things convenient for you, but it makes life easy for bots too, which is something that CAPTCHA-makers are trying to avoid in the first place!

While Google’s reCAPTCHA is a big step towards improving the existing CAPTCHA design, we can expect even smoother versions of these human-identifying tests in the future. Wouldn’t you like to have a CAPTCHA, that, without requesting that you do anything at all, just intuitively knows that you’re not a machine?