THE EFFECTIVENESS OF
CAPTCHA: We’re all familiar with
this pesky pop up. Not only is it annoying, but if we’re being honest, it’s kinda hard too. Before
you just had to click a checkbox or type out some blurry text. But, now you have to identify
the motorcycle or the crosswalk or the invisible donkey. Apparently these obtrusions are supposed
protect websites from bots, hackers, and AI. But, it looks like the only visitors that it’s actually
blocking are frustrated users. I mean, if AI is advanced enough to produce this and this, surely,
it can get through this and this right? Well, the answer is yes, most modern AIs can easily bypass
modern captchas. In fact, such AIs have become so common that AI researchers have started to name
their captcha solvers “Yet Another Text Captcha Solver”. And that itself was 5 years ago. Also,
you don’t even need to know coding or develop AI to outsmart these suckers. Instead, you can just
use cheap labor from overseas to crack millions of these for virtually no money. In fact, there
are full on companies that are centered around offering exactly this. The most notable of these
is a company called 2captcha who charges just $1 for 1000 captcha solves. You basically just need
these ten lines of code here, and it’ll route whatever captcha you’re trying to crack to some
sweatshop in Asia. And boom, you suddenly have the ability to crack a million captchas for less than
the price of a new iPhone. Ironically, this is not only more cost effective than hiring someone
to develop AI for you, but it’s actually even more reliable. Afterall, the people solving these
captchas are actually just real people. But, if such solutions are so accessible and widespread,
why in the world are websites still making us solve these increasingly difficult puzzles? Well,
it turns out that Captcha is not only an easy revenue driver for Google, but it’s a goldmine
of data and millions of hours of free labor. Way back in 2007, 60 million captchas were being
completed every single day, so this number is likely in the hundreds of millions today most
of which goes through Google. Google, ironically, charges the same amount as the captcha solvers $1
per 1000 solves, so with lets say 300 million captchas per day, Google would be pulling
in $110 million per year. Not a bad amount for a service that doesn’t accomplish much,
but that money is nothing in comparison to the data. Here’s the thing, what sort of website would
be most likely to incorporate captcha? Well, the answer is websites that offer some sort
of valuable service whether that be a newsletter, a waiting list, or an online purchase. This data
point that you used this service is way more valuable than the random Google search you
made about how to be more popular. And thanks to captcha, Google is able to get their hands
on a few hundred million of these data points every single day. So, here’s how captcha went
from being a failing security measure to being one of Google’s most valuable data collection avenues.
DUBIOUS HISTORY: Interestingly enough,
CAPTCHA’s weren’t invented to stop hackers. They were actually invented by hackers to get around
content screening and filtering. You see, back in the 80s and 90s, computers couldn’t read text
inside images very well, especially if they were squiggly. So, obscure images with text became the
go to way for dubious people to communicate about shady topics online without triggering any content
filtering algorithms. Hackers would take this even one step further by incorporating something called
leetspeak. You know how you can type “hello” on a calculator using numbers? Well, it turns out
that there’s actually a name for this, leetspeak, and there’s an official way to use it. Computers
weren’t very good at interpreting leetspeak either, so leetspeak plus squiggly images became
the go to way to communicate about nefarious topics online. Eventually though, at the turn of
the century, this would catch the eyes of someone from the other side: Carnegie Mellon University.
A couple of researchers here figured that if this strategy could be used to trick computers
for bad things, it could also be used to trick computers for good things. One of the biggest
issues online at the time was spambots and this was way worse than we have it today. Nowadays,
spambots are usually just annoying and tell you to contact them through WhatsApp. But, back in
the day, spambots were spreading deadly viruses like iloveyou, infecting tens of millions of
computers and causing billions of dollars worth of damage. So, naturally, these researchers wanted to
limit bots from accessing certain resources which led to the creation of CAPTCHA in 1999. CAPTCHA
stands for Completely Automated Public Turing test to tell Computers and Humans Apart. And
it was basically just a piece of code that could dynamically generate those seemingly harmless but
infinitely frustrating tests. At first though, it wasn’t too bad. In fact, it was actually easy for
humans and hard for bots with humans boasting a success rate of 97%. Seeing this, it didn’t
take long for entrepreneurs to start implementing this technology into their platforms, the first of
which being Max Levchin. If you’re not familiar with Max, he was one of the cofounders of PayPal
and was serving as the company’s CTO. At the time, PayPal was a prime target for hackers due to their
generous new account bonuses of $10 to $20. And let’s just say the company was burning a boatload
of money trying to keep up this promotion for real users. This was the case until one night when
a PayPal engineer named David Gausebeck would have an epiphany. Why not use that hacker thing
to fight hackers? He would email his idea to Max that night, and by the time he got to the office
the next day, Max would already be half way done with development. From there, it didn’t take long
for PayPal to push out the feature in 2001, and it quickly became an internet staple as everyone from
eBay to Google adopted it. For years, it seemed like this was the perfect solution to stop hackers
from wasting resources and causing damage online, but this golden period didn’t last forever.
HACKERS STRIKE BACK: With all these mega companies trying
to block hackers, you would think that they would have no chance. But time and time again, this has
proven to be false, and one of the main reasons for this is that hackers simply have a far better
risk to reward ratio. If they’re able to get through the security of Google or Apple, they have
the prospect of making millions if not tens of millions. For Google and Apple on the other hand,
while such losses are somewhat annoying, they’re by no means a top priority. It makes far more
sense for them to focus on protecting market share and creating the next big thing as this is worth
billions if not tens of billions. So, eventually, hackers and researchers would both develop AIs
and programs that could crack these relatively simple questions. It was clear that CAPTHAs needed
to be taken to the next level, but it didn’t make sense for each company to develop these
increasingly difficult CAPTCHAs by themselves. It was simply too much effort. What they needed was
a centralized service with a dedicated team that could always stay one step ahead of hackers. Enter
Google. In September of 2009, Google would acquire reCAPTCHA from the original Carnegie Mellon
researchers for an undisclosed amount. Honestly, it was probably a really small amount for Google,
maybe $5 or $10 million. But, given that the researchers were having trouble trademarking their
findings, their only alternative to making more money was to build a full on company around this,
so they would agree to the deal. Google, on the other hand, would turnaround and 200 IQ this. Yes,
they would go ahead and use it for data collection but we’ll get to that later.
They actually had a 200 IQ move way before that. Why generate useless pieces of text for people
to transcribe when you can get them to transcribe useful pieces of text? You see, around this time,
Google was trying to digitize the entirety of the world’s newspapers and books for Google Books.
But, it turns out that it was quite difficult for computers to optically recognize text from older
books and newspapers. So, Google decided that it would be a great idea to incorporate these
hard to read words into CAPTCHA tests. For one, if Google’s AIs couldn’t decipher them,
it was unlikely that malicious AIs could. And two, Google could literally get paid by websites and
companies to transcribe these old books using free labor, and lots of it. Back in the day,
people were solving 60 million captchas every single day, and even if we assume that it only
takes 5 seconds on average to complete, we’re talking about over 83,000 hours of labor. If
Google wanted to hire this same amount of man power, they would have to hire over
10,000 employees. Even at minimum wage, that would cost them $145 million per year, but using
this strategy, Google was getting paid to do this, and this takes us into the era of Google CAPTCHA.
CAPTCHA BECOMES USELESS: Google’s clever
book idea gave them free labor for years, but eventually their AIs did become advanced enough
to decode any piece of text and so did malicious AIs leading us to our modern conundrum. At first,
Google would try to address this issue in the most obvious way possible, just make the CAPTCHA
harder. But, by 2014, it became clear that this wasn’t gonna work. CAPTCHAs had already become
the opposite of what they were supposed to be. Instead of being easy for humans and hard for
bots, they were hard for humans and a joke for bots. I’m not even kidding. Bots were passing
text CAPTCHAs 99.8% of the time while humans were only succeeding 33% of the time. Clearly,
text CAPTCHAs had reached the end of their useful lives, prompting Google to create the
famous I’m not a robot checkbox. The idea of this new CAPTCHA was that instead of trying to
test the intelligence of humans, it would test the imperfectness of humans. I know a lot of us like
to think that we’re mouse aficionados with our fancy gaming mice, but it turns out that humans
actually suck at using mice. If you zoom into our mouse movement, there’s actually a lot of quivers,
shakes, and general randomness. A bot on the other hand is able to click on the checkbox with precise
mouse movement or even no mouse movement at all. It can just call the backend code that
takes place when a mouse click happens, but this would be a mistake because Google is actually
looking for our imperfectness. This was not only a brilliant solution but it was easy for people
to use. I mean, you just click on the box, but there was one fatal flaw. This system doesn’t
really work on mobile devices because there is no mouse. So, Google turned to creating a better
version of the original text CAPTCHA. Bots had become really good at deciphering text, but they
couldn’t yet decipher images like crosswalks and invisible donkeys. And this led to the creation
of the modern CAPTCHA that we all hate today. Things didn’t get better from there either.
It didn’t take long for bots to be able to mimic the imperfect mouse movement of humans, and this
led to the picture CAPTCHA being ported over to computers as well. But, as you would guess, this
too was quickly solved. The most ironic part about this is that many of the so called hacks actually
use Google’s own image recognition technology to crack the CAPTCHA. So, more recently,
Google has opted to completely ditch tests altogether with reCAPTCHA v3. Instead,
the CAPTCHA is invisible and is constantly tracking your interaction with a given website
to assign you a dynamic risk score between 0 and 1. Website owners can set a threshold
under which users will be denied access to the given resource. But, it’s not really clear how
effective this really is, and judging by the history of CAPTCHA, it’s only a matter of
time until this too is circumvented if it hasn’t already. So, CAPTCHA’s have become
virtually useless, but if that’s the case, why in the world does everyone still use CAPTCHA?
THE STATE OF CAPTCHA: CAPTCHAs are no longer that
great at stopping bots, but that isn’t to say that they have no value for anyone. For Google,
CAPTCHA offers tremendous value. Before they were able to train their text recognition technology
and digitize books using CAPTCHA. Now, they’re able to collect millions of hours worth of human
image recognition and general website usage data that can be used for machine learning and training
AI. And it doesn’t stop right there either, Google is also able to collect data about our most
important online activity. For obvious reasons, our most important online activity is usually
guarded by CAPTCHAs giving Google direct access to this specific data which is way more valuable than
our general online usage. So, it’s no wonder why Google continues to push CAPTCHA and put resources
behind it, but what about companies and websites. Why use something that’s not even effective? Well,
the primary reason is why not? You see, as CAPTCHA became less and less effective, Google became more
and more generous with their free tiers for companies. Currently, Google offers the first
million calls to CAPTCHA every month for free. And most websites aren’t protecting access to
the website itself with CAPTCHA. Usually, CAPTCHA is used to protect new account creation, joining
a waiting list, buying a newsletter, etc. And even the best websites in the world only have a
conversion rate of 11% meaning that you would need to have nearly 10 million visitors to your website
every month before Google even charges you a dime. And even after that, they’re only gonna charge you
around a $1000 for every 10 million visitors. So, it’s really only the mega billion dollar companies
that are paying Google for CAPTCHA, and it’s a pretty negligible cost for them as well. So,
why not use it? Sure, it may let 90 or even 99% of bots pass right on through, but it costs next to
nothing or literally nothing and it may stop a few bots on occasion and give it a bit of
extra security. Not to mention, everyone else is using it, so using it will make your website look
more reputable. And that’s why everyone still uses CAPTCHA despite it being horrendously
ineffective and annoying. Do you hate CAPTCHAs? Comment that down below. Also, drop a like if you
suck at CAPTCHAs too. And of course, consider checking out our discord community to suggest
future video ideas and consider subscribing to see more questions logically answered.