Did AI Bots Break the Captcha

AI Bots Break the Captcha

Most people don’t like passwords. In fact, navigating the various safeguards imposed by our different platforms, applications, and devices each day can be quite a pretty significant source of annoyance. However, we put up with the inconvenience as a small price for security—or at least, that’s what we believe.

One particularly challenging safeguard is CAPTCHA protection, employed across several websites and platforms. CAPTCHA requires users to decipher a barely legible sequence of letters and numbers, or to identify all the buses in a series of pictures. Again, we put up with these tests to make sure our account security doesn’t get compromised, but what if the safeguards aren’t so safe anymore? That’s precisely what AI is proving with recent advances in technology.

What is CAPTCHA?

Whether you’re resetting a forgotten password, verifying your identity, or undergoing another security procedure, chances are, you’ve run into CAPTCHA and reCAPTCHA technology at some point. CAPTCHA is a lengthy acronym that stands for Completely Automated Public Turing test to tell Computers and Humans Apart. In simpler terms, it’s named after the Turing test, a concept introduced by Alan Turing to differentiate between humans and computers. The objective is to pose questions in a manner that reveals whether the respondent is human or machine, based on the premise that computers calculate, but they don’t actually think.

For a variety of reasons, developers want to keep bots out of websites and platforms. For spam, security, and other reasons, there are strong efforts to make sure that the people accessing accounts and websites are really people, and so CAPTCHA was developed as a way to filter out bots and automated attacks. Given the adequate information, a computer can likely calculate a correct answer more quickly and more precisely than its human counterpart. However, if we complicate the information, things might not be so easy. For example, if the task is to copy a sequence of letters down, but the letters are written very illegibly, a person should be able to make out what the symbols resemble better than a computer. Or at least, that was the idea, and it had worked pretty well until recently.

AI vs CAPTCHA

Artificial Intelligence is a big umbrella term that encapsulates many specific theories and disciplines, including Machine Vision. While AI research is nothing new, it’s not until recently that the technology is powerful and accessible enough to be available to just about anybody for free. You just need an internet connection and a device to run programs like ChatGPT.

Part of that AI and machine vision research has gone into seeing how computers can start processing information similar to how humans process it. For example, when we’re thinking of what recipe to throw together for dinner, we might look through the pantry and see what we have on hand, and then make decisions from there. Traditionally, there are plenty of steps to take before a computer can help you out with these decisions. Even with ChatGPT, you would have to take down a list of items and share this list with the bot before it can return possible recipes. What if you were able to just point your phone camera at the pantry and ask, though? It’d be like having your own chef-trained friend next to you giving pointers. This is an example of computer vision being used in a very practical context.

Other examples are very common. As self-driving cars increasingly penetrate the market, the in-car computers must possess the ability to “perceive” their surroundings in a manner comparable to human perception. If you put obstacles in a simulation, a computer will probably be able to map out a safe route at safe speeds just fine. However, put that computer into the real world and tell it to learn the environment on its own—suddenly, lives are on the line, and it’s not so clear how to keep them safe. This is another example of computer vision being applied in our everyday lives.

However, power comes with responsibility. If computers are learning how to “see” the world how we do, they inevitably learn how to bypass some tests developed to exploit the fact that we don’t process information like computers—or at least, that we aren’t used to.

What Comes Next?

Research shows that AI bots are now more than capable of breaking CAPTCHA tests, and in many cases, they’re better than humans at doing so. One response to bolstering these defenses would be to make CAPTCHA and reCAPTCHA tests more difficult, however, the direct trade-off is that this would also make the tests more difficult for people who already find these tests tedious and annoying. The same study shows that these tests already motivate some degree of abandonment, meaning that the security systems meant to keep bots out are already keeping some actual users out as well.

Similar to traditional encryption methods, this issue isn’t a sudden or shocking realization. CAPTCHA developers themselves knew that this technology was limited, and that its days were already being counted as soon as it was put out. As AI continues to advance and, specifically, advances in such a way to imitate human thinking and perception, security checks and safeguards will have to be reimagined. Two-factor authentication is already one implementation that relies less on being able to think differently than a computer, and more on just having an authorized device on hand. Surely, even more sophisticated and elegant solutions are already in development.

The CAPTCHA problem is an interesting look into the behind-the-scenes of tech development and problem-solving. Especially when it comes to security implementations, the development of more advanced technology begets its own subproblem of safety. As we create smarter technology, we must create smarter ways of protecting our privacy and autonomy. This is not a new problem, but it will take new faces as we continue to introduce new technology.