Some days, I wonder if I’m a bot. The problem is CAPTCHAs, those little online challenges that websites require you to pass to prove that you’re a human. When one pops up on my screen, I tend to spend way too much time looking at the grid of nine images and clicking those with a traffic light, or a crosswalk, or a bike … only to miss the one in the bottom-right corner that just barely looks like a bike. Lately, I’ve had to rotate a 3-D bird to face the same direction a hand is pointing, which should be easy but somehow isn’t. CAPTCHA stands for “Completely Automated Public Turing test to tell Computers and Humans Apart,” so if I’m flubbing them constantly, then I’m clearly a computer (my wife, house, and cat must all be implanted memories).
CAPTCHAs don’t exist to make us doubt our humanity. They are gates designed to stop spammers, hackers, and various other jerks from flooding or tricking websites with bots. These bad actors might want to, say, automatically post fake comments, steal credit-card information, or snatch Taylor Swift tickets before you can. For the most part, CAPTCHAs do their job: Before I added one to the contact form on my personal site, I used to get endless emails for discount steroids and other “helpful” offers. Now that rarely happens.
You’ve probably noticed that CAPTCHAs are getting more difficult. What started as weird strings of letters to type out without much thought has turned into images that are harder and harder to identify. And that’s before we get into animal rotating, which I’ve yet to get right on the first try. You might be wondering, because it’s 2023, whether AI is to blame for all of this. And it is. Arkose Labs, the company that makes the animal-rotating puzzle, says on its website that the system is “iterat[ed] against machine learning,” which means this torture device has been designed specifically because bots can solve other CAPTCHAs. That you have to rotate the animal is the result of a world in which AI can do even more human tasks. Arkose Labs and the many other companies that make various kinds of CAPTCHAs can only keep up by designing tougher and tougher puzzles. At some point, if they can’t, CAPTCHAs might be doomed.
A classic saying in the business world goes something like this: “Fast, cheap, or good—you can pick two.” Quickly repairing a car well won’t be cheap; cheaply repairing a car quickly will result in substandard work. You can apply the same logic to CAPTCHAs, Jeff Yan, a professor of computer science at the University of Strathclyde, in Scotland, who has studied the technology, told me. Every CAPTCHA is trying to balance three factors: security, usability, and accuracy. Of these three, usability is the one most people think about: A CAPTCHA needs to be relatively painless to solve for a wide range of people with varying abilities. The easier you make solving the puzzle, however, the more likely it is that bots will be able to solve it—so you also have to focus on building an accurate system. And then there’s security: A CAPTCHA needs to be designed so that no one can hack the system to get around it entirely. “Each of these three things are challenging,” Yan said. “AI makes [them] even harder.”
All of this could mean that CAPTCHAs need to become less usable in order to remain secure. It’s not a new problem. CAPTCHAs have been engaged in an arms race against the machines ever since the term was coined at Carnegie Mellon University, in the early 2000s, if not longer. The early approach, based off of a string of distorted text, was created because computers couldn’t identify the characters. Google eventually purchased reCAPTCHA, a company founded by those same researchers, in part because that system had another advantage: The humans solving the CAPTCHAs were helping digitize books. If a computer couldn’t read a word, Google would stuff it in a CAPTCHA and have us do the work. But the machines could soon parse text with near-perfect accuracy, prompting a pivot toward image identification. Bots then quickly got better at recognizing images, leading to CAPTCHAs with weirder photos and tasks.
In a recent study from researchers at UC Irvine and Microsoft, most of the 1,400 human participants took 15 to 26 seconds to solve a CAPTCHA with a grid of images, with 81 percent accuracy. A bot tested in March 2020, meanwhile, was shown to solve similar puzzles in an average of 19.9 seconds, with 83 percent accuracy. The machines are already better and faster than us at most kinds of CAPTCHAs, the study found, and that’s before considering just how quickly AI is advancing. In GPT-4’s testing phase earlier this year, the model solved a CAPTCHA by contacting and hiring a real-life TaskRabbit worker. Now that GPT-4 can see, OpenAI says it has solved these puzzles without needing any human help at all.
The company has safeguards that will stop you from actually using a chatbot to solve a CAPTCHA. They are not foolproof, but skirting them would be a horrible waste of time for any spammer, whose goal is to quickly solve lots of puzzles. A number of companies offer services that purport to do just that. 2Captcha will solve a thousand CAPTCHAs for a dollar, using human workers paid as low as 50 cents an hour. Newer companies, such as Capsolver, claim to instead be using AI and charge roughly the same price. The difference, supposedly, is speed: Capsolver claims that its models are much faster at solving CAPTCHAs than humans are.
The burden is on CAPTCHAs to keep up. The most popular type, Google’s reCAPTCHA v3, should mostly be okay. It typically ascertains your humanity by monitoring your activity on websites before you even click the checkbox, comparing it with models of “organic human interaction,” Jess Leroy, a senior director of product management at Google Cloud, the division that includes reCAPTCHA, told me. Plenty of other companies are trying to use similar, primarily noninteractive tactics to detect bots. “A legitimate user may typically visit the homepage, click on a sign-in button, enter their credentials, and then, for example, go to pay their bill,” Leroy said. “An attacker, on the other hand, either via hiring humans or writing bots, will try many different email-and-password combinations.” The idea: Whether a bot or a human is attempting to log in with multiple passwords doesn’t particularly matter—it’s sketchy either way.
Activity monitoring, according to Leroy, is already more common than reCAPTCHA’s visual challenges, but still, “visual challenges will continue to exist for the foreseeable future,” he said. Tracking isn’t perfect, so Google might still serve you a traditional grid of blurry bikes. I tested this on my own website. If I head straight to the contact page and click the CAPTCHA check mark before doing anything else, I’m shown a visual test. If I browse the site for a while, though, all I need to do is check the box—no test required.
So the arms race is still on. But failing a CAPTCHA isn’t just annoying—it keeps people from navigating the internet. Older people can take considerably more time to solve different kinds of CAPTCHAs, according to the UC Irvine researchers, and other research has found that the same is true for non-native English speakers. The annoyance can lead a significant chunk of users to just give up. “It comes down to access,” Wendy Reid, the accessibility-and-publishing-standards lead at Rakuten Kobo, told me. The company sells e-books and e-readers, and uses CAPTCHAs to confirm new accounts, among other things. “If you fail a CAPTCHA, if these systems don’t think you’re a human, you can’t get in,” Reid said. For example: CAPTCHAs typically offer audio challenges for blind users, but what if someone is both blind and deaf? The system Rakuten Kobo uses, hCAPTCHA, has a fallback: Users can provide their email address, which is used to confirm their identity. That, though, presents a privacy issue for some users, who would prefer not to supply an email address. You get the idea: There’s no perfect solution.
But the puzzles, although less common now, have changed only marginally since 2003. “Most CAPTCHAs still follow old paradigms,” Yan told me. “Twenty years later, and the principals stay mostly the same.” Every system is built around identifying something—text, images, animal direction. If “activity monitoring” can’t work in every instance, it might be time for something else entirely, Yan said: “There are problems that cannot be solved by AI technology. For example, AI can’t engage in a conversation like we’re having.” I, for one, hope I don’t need to have a conversation with a human every time I want to log in to an account, but I get what Yan is suggesting: There are still ways to identify humans from the machines. But as AI improves, there might be fewer ways, and especially fewer ways that can happen quickly on your laptop.
Unlike the many other facets of life wrestling with that same AI conundrum—academia, coding, publishing—the one and only purpose of CAPTCHAs is to separate bots from humans. Researchers are highly motivated to figure out something quick and simple that humans do better than computers. Once, that was reading scribbly text; then it was identifying pictures; now, apparently, it’s some combination of surveillance and rotating animals. Whatever CAPTCHA comes next might be more of a nuisance and might produce more swearing whenever it appears on my computer screen. But what that next annoying little task is will suggest something about what it means to be human. It’s much less annoying than a world in which no task like that still exists.
