Proving that you aren’t a no-good spambot on the internet was simplified greatly with the advent of Google’s “No Captcha reCaptcha” which allows us to simply click inside the circle at the bottom of a form and thereby demonstrate our humanity. What’s actually going on with this elegant solution though and how Google are achieving this?
In the “old days” of course man and machine were pitted together in attempting to answer the same questions; 2+2=? or everyone’s favorite; typing the indecipherable characters in the graphic beside the box. Turns out though that the machines were smart and quickly learned how to decipher these pesky images better than us humans (thanks OCR team). The better solution which eventually evolved is remarkable in many ways.
Understandably, Google wasn’t about to reveal the precise mechanisms behind its solution (and allow it to be instantly bypassed by automated scripts). At first is was assumed that Google were checking to see if you were logged in to a Google account – this turned out to be partially true. Then is was assumed that they were timing your actions on the page; click too soon and you’re a bot but if you delay just enough – you’re human. Again, trsting this turned out to be just partially true. Google’s own ubiquitous Analtyics tool which most of the internet uses to track visitor behaviour online was also cited as the new Captcha’s secret method of comparing your past behaviour on other web sites with your behaviour on the current page containing a form. Again partially true. The solution seemed to be all these things and more.
All this is conjecture. While we plainly don’t know for certain, it’s evident that all of these methods and many more contribute to a unique profile which is used as benchmark, to confirm our humanity when required. It’s not a generic indicator of humanity defined by our ability to read distorted numbers or reassemble jigsaws but apparently a personalised profile which knows how we move our cursor (position, speed, acceleration), how we select form fields, our recent browsing and mouse/keyboard activity. This in information we don’t even know about ourselves. Habits and minute tics we are unaware we have and which anyone (human) casually observing us would equally be unaware of. But they exist. As unique and as identifying as fingerprints and a machine can spot, record and compile them and identify to a high degree of certainty that they are human; Human in their meandering uncertainty. Not randomised uncertainty which a machine could effortlessly emulate but dithering, distracted, thoughtful, focussed, driven, anxious, sleepy, coffee-fueled/starved uncertainty which it turns out has a bothersome non-random quality which machines don’t like. Being human then is more complex and more difficult to fake when you focus on the things that we’re not even aware of. A job ironically that machines excel at.
You can view an example of the Captcha in question on the footer of the page linked to below: