Origins of CAPTCHA (Late 90s)

• AltaVista search engine faced spam problem
  • Automated scripts sending spam/malicious links to web database
  • Needed test only humans could pass
• First solution: warped string of letters/numbers
  • Image processing couldn't identify squiggly characters
  • Trivial for humans (with good eyesight)
  • Accessible versions came later
• Term: CAPTCHA = Completely Automated Public Turing Test to Tell Computers and Humans Apart

reCAPTCHA Development

• Created few years after original CAPTCHA
• Dual purpose: spam prevention + digitizing old books/newspapers
• Two-word system:
  • One known word (deliberately distorted) - verification human answering
  • One unknown word - scanning systems uncertain about
  • After ~dozen people agreed on unknown word, logged as part of book scan
• Google acquired reCAPTCHA

Bot Makers' Countermeasures

• Trained computers to read distorted words
  • Pre-modern machine learning/AI breakthroughs
  • Rudimentary systems could solve reCAPTCHA enough for fake accounts/spam
• Human solving services:
  • Bots filled details, showed CAPTCHA to human operators
  • Operators hired from low-income countries
  • Paid to solve CAPTCHA after CAPTCHA
• Dozens of companies competed on price/accuracy (still available)
• Deceptive websites: visitors solved CAPTCHAs copied from target sites before accessing content

reCAPTCHA v2

• Single checkbox: "I am not a robot"
• Not about clicking box - extra data sent to Google
• Google secretive about data collected (clues for attackers)
• Box loaded from google.com - accesses login cookies
• Clearing cookies increases likelihood of secondary check (buses/fire hydrants)
• Possible factors analyzed:
  • Mouse movement before clicking
  • Exact position/timing of finger tap on phone
  • Fed into Google's machine learning system
• Only designers know full methodology
• Solving services offer cost-per-thousand solutions
• Machine learning bots trained to pass secondary checks
• Google Cloud servers potentially creating/breaking CAPTCHAs simultaneously

reCAPTCHA v3 (End of 2019)

• No visible box/puzzles to solve
• Works in background while browsing
• Assigns human likelihood score before comment posting/signup
• Machine learning system analyzing everything
• Google doesn't fully understand how it works
• Considerations for incognito mode/accessibility tools needed
• Low scores: comments sent to moderator or disappear
• Bot makers already working on countermeasures

Escalating Security Measures

• Personal example: new bank account signup
  • Photo of ID required
  • Video holding ID and waving
  • Verifies specific human identity, not just humanity
• Bots increasingly indistinguishable from humans
• CAPTCHA methods becoming more intrusive
• Arms race continuing 20+ years

Password Manager Sponsorship (Dashlane)

• Recommendation to use password manager
• Dashlane.com/tomscott - free 30-day trial
• Limitations acknowledged:
  • Cannot protect against major government/industrial espionage
  • Physical hardware access compromises security
  • Human threats/violence bypass all security
  • UK law: criminal offense to refuse password to police with court order
• Benefits:
  • Different password for each service
  • Data breach alerts
  • Long, complicated, secure passwords
  • Autofill across devices
  • Auto-change passwords feature
• Code "tomscott" for 10% off purchase