FEATURE

CAPTCHA AND AI: RELIANCE ON CAPTCHA AMIDST TECH EVOLUTION

HOW CAPTCHA WORKS: AN IN-DEPTH EXPLANATION

There is and continues to be, an influx of new, innovative technology that sneaks into our ecosystem, used for glory or another story. The advancement of technology makes living less burdensome but also introduces a heightened sense of awareness. Cybersecurity (and technology in general) is a significant component of the newly introduced internet/ cyberspace. Presently, there has been a need for apps (tools) as well as personnel to handle and protect organizational websites and data from online theft attempts.

Again, safety measures with data on the internet have become very important as tech evolves. Individuals have always found ways to shock the system and retrieve sensitive data from innocent users or corporate databases. However, the spotlight is not on sophisticated technology, but on one of the earliest, and currently used web security tools available: CAPTCHA.

WHAT IS CAPTCHA

CAPTCHA or “Completely Automated Public Turing test to tell Computers and Humans Apart” is a computer program that is designed to protect websites from spam and abuse. It is a challenge-response authentication tool that humans can solve with ease, thus telling them apart from bots.

AltaVista’s Chief Scientist, Andrei Broder created the algorithm for image generation (precursor to CAPTCHA’s creation and modification). This was furthered in the early 2000s by Luis von Ahn, Manuel Blum, and John Langford of Carnegie Mellon University.

CAPTCHA provides one of two quizzes – a sequence of letters (text CAPTCHAs) or a distorted image for identification (image CAPTCHAs). According to Google, “computers can create a distorted image and process a response, but they can't read or solve the problem the way a human must [to] pass the test.”

CAPTCHAs are used by many website owners to protect their sites from automated attacks. They also help to prevent bots from spamming comments or registering fake accounts.

GOOGLE’S reCAPTCHA AND AI TRAINING

From its inception, CAPTCHAs have often been text-based and used distorted texts as a security feature. reCAPTCHA was introduced by Google to enhance security CAPTCHAs and how they worked. They resorted to using images instead of text, so users would have to select parts of the image based on the instructions given – selecting trucks, fire hydrants, bicycles, and trains to name a few.

It works by analyzing behavior, that is, instead of necessarily looking at the correct images selected, it tracks the movement of the mouse pointer. Usually, machines or software bots are spot-on in selecting items while humans would think through which parts of the image to select. Write-ups suggest that CAPTCHA is being used to train Google AI engines in problem-solving based on the times they (CAPTCHAs) are correctly solved.

CAPTCHA and AI

Artificially intelligent bots are proving useful to our society. Experimenting on and with them could bring to the fore the future of mass processing where tasks and activities are carried out easier and faster. Practically, AI bots have been installed with the ‘brain’ and senses of a human. However, there is the question of whether AI can break CAPTCHA. Seemingly, this looks possible – at least with text-based and audio CAPTCHAs.

According to Vicarious, a tech startup in The San Francisco Bay Area, a system has been developed by their outfit that can bypass the CAPTCHA security check. Their outfit came up with the Recursive Cortical Network (RCN) in 2017. Simply, this design works quite close to the human brain and mimics human visual tendencies.

Looking at the data inputs in this system, it is used for processes such as text identification as well as speech and facial recognition. The system gets better at correctly predicting certain patterns as it continues to learn through various trial-and-error experiments.

According to their experiment, the RCN was able to solve a large number of CAPTCHAs with very little training data. Vicarious co-founder George Dileep says that their software identifies shapes and contours to fully process the likely outcome for an image. Their study shows that the RCN can solve CAPTCHAs about fifty to sixty percent of the time on different sites.

Another researcher, Nikolai Tschacher found a way of bypassing Google’s audio CAPTCHA – one specifically made for users with visual impairments. He used archives by the authors of unCAPTCHA2, a written code that uses Google’s Speech-to-Text API to answer its audio reCAPTCHA.

Demonstrations by the original authors (University of Maryland) and Tschacher have been successful, considering that the latter researcher conducted this about a year ago. The return of correct answers was over ninety percent.

Thus, from their experiments, it can be deduced that to a certain degree, an AI bot, whether hardware or software, can bypass CAPTCHA security checks. The only difference is that comparing humans to AI bots, humans are much better at recognizing elements in a CAPTCHA. But as machine learning advances, the possibility of making progress is imminent.

But what does this mean for websites that use CAPTCHA as a protective mechanism? Does it mean that bots (physical or software) have the upper hand? Does it mean they can infiltrate systems unnoticed and unchecked? Is it less of telling bots and humans apart and more of telling AI and humans apart?

FINAL THOUGHTS

Taking a look at every section tackled in this write-up, the understanding is that technology is fast becoming a quintessential part of daily activities and operations. Understandably, the CAPTCHA system is not perfect, and like other cybersecurity flaws, the security tool is susceptible to attacks. However, these flaws make creators even more aware of the dangers and take active steps to seal any loopholes created. Both artificial intelligence and CAPTCHA/ reCAPTCHA will continue to evolve in their way of handling certain issues and will continue to learn to better themselves at it.