If you’ve been on the Internet and you aren’t a robot, you’ve probably taken and passed a classic “Are you a robot?” CAPTCHA – and if you’ve failed it, momentarily questioned if you are, in fact, a human. Existential crises aside, the ways these tests work might not be how you’d expect.
In a “Completely Automated Public Turing test to tell Computers and Humans Apart”, or CAPTCHA, users are given a task to complete that separates them from bots. Despite the official name, it’s often considered as a reverse Turing test, given that the computer is determining if a subject is human, rather than the human being the judge of human-ness.
The tests range from irritating (“please select the parts of this image which contain hillocks”) to not so much (“click here to confirm you are not a robot”). But how do these latter tests work? Are bots so inept that they cannot press the button?
In short, no. A clip from the British TV panel show QI explains that the test is actually looking at your behavior before you press the button. Bots have been created that can push the button, but they have a harder time faking normal human behavior beforehand.
According to cyber-security firm Cloudflare, the test tracks the movement of the user’s cursor as they move it toward the box.
“Even the most direct motion by a human has some amount of randomness on the microscopic level: tiny unconscious movements that bots can’t easily mimic. If the cursor’s movement contains some of this unpredictability, then the test decides that the user is probably legitimate,” Cloudflare says on its site. “The reCAPTCHA also may assess the cookies stored by the browser on a user device and the device’s history in order to tell if the user is likely to be a bot.”
Cookies and recent history can tell the computer whether you are a human or Johnny 5.
“Let us say, for example, before you tick the box you watched a couple of cat videos, you liked a tweet about Greta Thunberg, you checked your Gmail account before you got down to work – all of that makes them think that you must be a human,” QI host Sandi Toksvig said in the video.
“Essentially when you are clicking ‘I am not a robot’ you are instructing the site to have a look at your data and decide for itself.”
Usually, the test is enough to satisfy the program that you are human, but sometimes it will give you alternative tests to take, say if your mouse wiggle is a little too precise or if your browsing history is that of a robot. Either that or you actually are a robot and might be better at proving you’re a human than an actual human is.
An earlier version of this article was published in April 2023.
Source Link: How Does CAPTCHA Tell Robots And Humans Apart?
