Like so many this winter, Norine McMahon was searching for a Covid-19 vaccine appointment, hitting Refresh on her browser continuously. The Washington, DC, resident was elated to find an opening in late February, but delight turned to disappointment when she failed the captcha user-verification test, even though she swore she entered the letters and numbers correctly.
“Then I would do it really slowly to make sure I was getting it correct, because of course the pressure is on. It happened a dozen times. The captchas weren’t working,” says McMahon, 61, a facilities director who gave up that day but eventually secured an appointment.
“Captcha” stands for “completely automated public Turing test to tell computers and humans apart.” The Turing test was created in 1950 by Alan Turing, a British mathematician considered a founding father of artificial intelligence, to help determine whether a computer can demonstrate intelligent behavior similar to a person. Turing called it the “imitation game.” Luis von Ahn helped develop the modern captcha as a grad student at Carnegie Mellon University, where he is now a consulting professor, and later invented reCaptcha, which Google acquired.
The goal of captcha is to create tests or puzzles that humans can solve but bots can't—so you, a mere mortal, might have a shot at a decent seat to a Springsteen concert when they go on sale at 10:00.01 am.
It can be a tricky balance, especially as machines become more sophisticated.
“Usually artificial intelligence systems are capable of coping better than humans because, as an example, they don’t suffer from annoyance. They are infinitely patient, they don’t care about wasting time,” says Mauro Migliardi, associate professor at the University of Padua in Italy. He recently coauthored a paper summarizing 20 years of captcha versions and their effectiveness.
Google won’t say what share of the captcha market it has, but it appears dominant in the US, with the reCaptcha name seen frequently on various sites. For this story, Google requested that questions be submitted in writing and then answered them in writing, saying direct quotes could not be used.
Google has a reCaptcha “help” page, but its answers are underwhelming. One question asks, “This captcha is too hard,” to which Google answers, “Don’t worry. Some captchas are hard. Just click the reload button next to the image to get another one.” That help page also notes that Google uses captchas to train its AI, saying that the human effort that you and I put into solving them goes towards improving their products that digitize text, annotate images, and more.
Google’s support page did not answer other questions so many ask, especially about the photo grid challenges. If there is a sliver of a bus in a square, do you have to click it? When selecting traffic lights, do you click the poles? When asked these questions, Google advised selecting the majority of squares that have the bus or traffic lights.
Then there are the blurry photos, forcing users to move closer to the screen as they try to discern if there is a chimney in the fuzzy distance. Asked why the image reCaptchas are often blurry, Google said it works hard each day to reduce the number of captchas people need to solve, and says it improves its heuristics when it shows the “I'm not a robot” checkbox so that it doesn't show challenges to humans.
Meriem Guerar, a researcher at the University of Genoa, Italy, offered a simpler explanation for the poor quality of the images. “The challenge presents often noisy and blurry images in order to make it harder to recognize, for bots using state-of-the-art image recognition technologies,” says Guerar, who has coauthored papers with Migliardi on captcha. “Noise, distraction of images, making them blurry, these are known as anti-recognition mechanisms.”
Sometimes the captchas are flat-out wrong. Charles Bergquist said he felt a mix of amusement and frustration when he was asked to pick parking meters, was denied when he chose the one meter shown, and could only solve the puzzle by selecting the meter and two mailboxes. “It was frustrating that I couldn't get by it to get into the page that I wanted without feeding back incorrect information,” says Bergquist, who is director of the Science Friday radio program.
Goofs like this are frequently discussed on social media or the /r/captcha Reddit group that finds comedy in bad captchas. Another Reddit group, /r/CaptchaArt, with nearly 20,000 members, incorporates captchas into cartoons and other art.
Since captchas aren’t going away anytime soon, here are some tips to lower the frustration level with the captcha-solving process.
Remember, Captchas Provide Protection
It might be small comfort if you are stymied by a poor puzzle, but captchas are designed to protect the websites you visit, and ultimately you.
“Alan Turing's captcha concept is, in itself, genius; but as the abilities of the robots become more sophisticated, captcha systems are becoming increasingly complex, leading to some very invasive user experiences,” says Matt Bliss, technical director at Bliss Digital in Hampshire, UK. After having to solve four captchas in a row, a frustrated Bliss redubbed the challenges as “complicated awkward patience test to tell crosswalks and hydrants apart.”
As an architect and developer, Bliss understands the purpose behind captchas, and he notes that the free tools to use them are easy to implement by web designers and developers. “Unfortunately, this can lead to them being implemented as a cheap fix in situations where less invasive and more user-friendly approaches would be more appropriate, but would inevitably cost more to design and adopt,” he said.
Understand That Captchas Keep Improving
It may not feel like it, but captcha designers are trying to ease your pain. Google said it is continually working with its customers to find the best balance between user friction and stopping bots. Google’s reCaptcha product started as words that bots had a difficult time dissecting, then evolved to click boxes and crosswalks to defend from fraud, not just bots. The third version of reCaptcha has no user interaction, relying instead on behavioral analysis, so there is a frictionless user experience, according to Google.
The fourth and latest version is reCaptcha Enterprise, which Google says offers unique capabilities built specifically for the enterprise and provides enhanced detection measures, such as extra-granular scores, reason codes for high-risk scores, and the ability to tune the risk analysis engine to the site’s specific needs.
Recent advances in AI have made automated programs better at recognition tasks than humans, said Guerar. She and her team created an alternative called cappcha (the second P stands for “physical”) based on humans’ ability to perform physical tasks instead of solving difficult cognitive problems. Actions include tilting a smartphone or making micro-movements while typing on a laptop. “The rationale behind cappcha is that bots, which are pieces of code, cannot perform physical tasks,” says Guerar. “There are actions that only a human can do.”
Update Your Browser
An outdated browser can trigger a verification challenge, according to Guerar and Migliardi. Keeping current on updates is another sign of humanity, the professors said. “A bot will probably not be careful in updating software,” said Migliardi.
Take Actions to Prove You Are Human
If the website you are visiting uses Google’s reCaptcha, log into your Gmail account before looking for tickets or appointments, says Guerar.
Also, allow cookies before you start searching, advises Guerar and Migliardi. ”Let them snoop,” said Migliardi. So-called invisible captchas work behind the scenes to verify you are human, and one way they do that is by analyzing your browsing history.
The professors noted the privacy concerns and suggested that people use tools to clear their history and remove cookies. But if quick access to a website is the priority, Migliardi recommends doing a short session of web surfing allowing cookies so Google already knows you’re a real person.
“Just go through a few websites and let them give you all the cookies they want. That will probably show that you are human. Do the cleanup just after you get the reservation for your vaccine and stuff like that,” said Migliardi. “It’s a little bit like going to the emissions test with a warm engine.”
Embrace the More Noteworthy Captchas
Some captchas are tolerable, even interesting.
While searching for NCAA tournament tickets in March, I discovered Ticketmaster was using a new version of captcha with a cartoon-y image overlaid with random items, such as a bicycle, T-shirt, and hammer, all of which had to be clicked in a specified order. Even though I was laser-focused on securing tickets to games at Hinkle Fieldhouse, I appreciated the new format and that the image wasn’t blurry. Ticketmaster, which last addressed captchas on its blog in 2014, did not respond to multiple requests for information about its latest captchas, and Google said it is not one of its reCaptchas.
Bergquist doesn’t mind when a captcha asks him to transcribe a line of handwritten text—“fancy ye olde script writing,” as he puts it—from a photo of an old document, such as a census record or ship manifest.
“Those I actually find kind of cool. It’s a bit of escapism, and I get to think about what this person or thing actually was, way back when, and also I feel like it’s making something somewhere more accessible to somebody. Like, somebody is actually going to use that information at some point about the census or the ancient ship cargo or whatever and improve the world somehow,” Bergquist says with a laugh.