Computers are better than humans at a lot of complex calculations, but we still have them beat on some small problems.
That’s why a very simple test has protected some of the world’s biggest Web sites for so long. Go online to perform a routine task–buying sports tickets, for example–and you’ll see a picture of random squiggly letters.
The Web site asks you to type the letters you see, something a computer can’t do without some sophisticated programming. That keeps hackers from using software to repeatedly enter information on the sites or sending spam through online e-mail services or blogs.
But the defenses finally are crumbling. Computer scientists are working on replacements for the test, knowing that computers are learning to read even the messiest scribbles.
The distorted-letter test “is getting to the point where it’s almost defeated” by computer scientists in the laboratory, said Luis von Ahn, a postdoctoral fellow at Carnegie Mellon University’s computer science department.
“The ones not yet defeated by computers are really hard to read for humans. But they’ll be defeated pretty soon,” von Ahn said.
Researchers aren’t trying to beat the distorted-letter tests to ambush Web sites, of course. They use it to make computers better at recognizing text.
But if computer scientists can figure out how to beat the tests, hackers won’t be far behind. The next wave of tests will have to present problems that computer researchers and cybercriminals have barely begun to tackle with artificial intelligence.
Carnegie Mellon’s research team trademarked a name for these computer-or-human tests: captcha. It’s an acronym that stands for “Completely Automated Public Turing test to tell Computers and Humans Apart.” Turing refers to Alan Turing, a British logician who proposed a theoretical test to judge whether computers were good at imitating humans.
The current captchas have protected Web sites for a remarkably long time in the ever-changing Internet world. Researchers at the pioneering search engine site AltaVista created one of the first squiggly letter tests in the late ’90s.
“Humans are much better at recognizing patterns than computers are. A 3-year-old can tell apart a man from a woman. Computers cannot do that,” said Andrei Broder, who was AltaVista’s chief scientist at the time.
Other researchers and companies began developing their own versions of the test. Ticketmaster added one in 2002, and it’s become an important part of the company’s defense against scalpers.
“There are not a lot of ways, at the end of the day when a transaction is being made, to tell if someone is an automated bot or a human, and this helps us to identify that,” said Bonnie Poindexter, a spokeswoman for the ticketing agency owned by IAC/InterActiveCorp.
The character-recognition tests come in several varieties. Ticketmaster uses a string of letters that does not appear to be warped much. But diagonal lines crisscross around the letters, and the background is sometimes grainy.
Google’s Blogger service, on the other hand, uses no background. But the letters roll and swirl as if they have been caught in a wave.
There are ways to beat the text-based captchas, and not all of them are high-tech. Some computer experts have done it simply by looking for patterns in the random characters or the computer language used to generate them. Some hackers have been rumored to pay people to enter the correct information or entice them to do it by offering free pornography.
But computer researchers also are beating text captchas simply by developing computers that are sophisticated enough to read them. In the same way that supercomputers have been developed to beat chess masters by making millions of decisions in an instant, computers also can learn to “read” and detect patterns by making a series of complex calculations.
Fortunately, people can find patterns in other ways that stymie computers. Carnegie Mellon’s Pix program, for instance, shows four pictures that have relatively little to do with each other except for one common element–a cow, for instance, or a cup. Other researchers are experimenting with similar image-based captchas.
More Top Picks Best Kyusu Teapots
And some sites, including the Blogger service, offer an audio alternative for people with visual impairments. In the audio test, a voice speaks a series of numbers over background static, and the user must type the correct sequence to access the site.
Researchers continue to tweak the text-based captchas, too, using colorful backgrounds or breaking the letters apart to fool the bots. But with every change, they face the danger of making the captcha too difficult for people to read.
Advocates for Web users with disabilities already are concerned that captchas keep the visually impaired from accessing the sites they need.
Text-based captchas have another problem. It’s unclear who owns the rights to the technology. When AltaVista developed its test, Broder and his team patented the idea. Through several mergers and acquisitions, the patent fell into the hands of Hewlett-Packard Co.
HP no longer owns the patent, said Brigida Bergkamp, a spokeswoman for the technology giant. She declined to disclose what had happened to the patent.
Carnegie Mellon researchers must decline requests for software code for text captchas because the patent rights are unclear, von Ahn said.
“We’re a little upset about that,” he said.
But it may not matter, since text captchas are becoming more and more vulnerable.
“We knew this was going to happen. It was just a matter of time,” von Ahn said.