When entering credentials or credit card information on websites, you might be asked to copy a series of words or a math sum to continue. While most of the time this is a quick step before you can continue your activity, many people wonder what a CAPTCHA is? And what is its purpose?

What is CAPTCHA

CAPTCHA stands for Completely Automated Public Turing test to tell Computers and Humans Apart. In other words, CAPTCHA determines whether the user is real or a spam robot. CAPTCHAs stretch or manipulate letters and numbers, and rely on human ability to determine which symbols they are.

How Does a CAPTCHA Work?

CAPTCHAs were invented to block spammy software from posting comments on pages or purchasing excess items at once. The most common form of CAPTCHA is an image with several distorted letters. It is also common to choose from a variety of images where you need to select a common theme.

The internet and computers are actually made up of a unique coding language. Computers find it difficult to understand languages because of the strange and intricate rules human languages take on, along with slang that humans use.

History of CAPTCHA

The term CAPTCHA was first used by computer scientists at Carnegie Mellon University in 2000. While the acronym makes sense (automated test to tell computers and humans apart), the Turing Test portion may be unfamiliar.

The Turing Test

Alan Turing, known as the father of modern computing, proposed this test as an experiment to see if machines could think or appear to think like humans. The Turing Test is based on imitation. An interrogator asks two participants a series of questions. One of the participants is a machine while the other is human. The interrogator does not know which one is which and attempts to guess which participant is a machine. If the interrogator fails to figure it out, the machine has passed the Turing Test.

While CAPTCHA is meant to trick machines and create a test that only humans pass, this test was created in order for the CAPTCHA application to present a variety of CAPTCHAs to different users.

Another reason why CAPTCHA is seen as difficult to read for computers is its visual component. Because the symbols are in an image format, it’s more difficult for computers to scan an image with text, especially when the text is distorted. Humans can look at an image and detect patterns more easily.

In addition to visual patterns, CAPTCHAs also come in an audible format for the visually impaired. In some cases, CAPTCHAs may ask a reader to interpret a short passage of text. It will then prompt the reader to take a short quiz of the material.

Who Uses CAPTCHA

CAPTCHA is used on a variety of websites that want to verify that the user is not a robot. First and foremost, CAPTCHA is used for verifying online polls. In 1999, Slashdot created a poll that asked visitors to choose the graduate school that had the best program for computer science. Students from the universities Carnegie Mellon and MIT created bots, or automated programs to repeatedly vote for their schools.

These schools received thousands of votes, while other schools only hit a few hundred. CAPTCHA came into play so that users could not take advantage of the polling system.

Another use of CAPTCHA is for registration forms on websites such as Yahoo! Mail or Gmail where people can create free accounts. CAPTCHAs prevent spammers from using bots to create a plethora of spam email accounts.

Ticket websites such as TicketMaster also use CAPTCHA to prevent ticket scalpers from over purchasing tickets for large events. This allows legitimate customers to purchase tickets fairly and keeps scalpers from placing thousands of ticket orders.

Lastly, web pages or blogs that contain message boards or contact forms use CAPTCHA to prevent spammy messages or comments. It does not prevent against cyberbullying, but does prevent bots from posting messages automatically.

Scammers Getting Smarter

Unfortunately, as technology and hackers become more advanced, so do their scamming tactics. While CAPTCHA is safe for the most part, cybercriminals have begun incorporating CAPTCHA into their false or fraudulent websites to make their scams more believable.

Here are some ways that cyber criminals can trick internet users:

  • The scam contains intriguing messages on your newsfeed. Ex. KIM KARDASHIAN NEVER BEFORE SEEN VIDEO LEAKED. Once you click on this post, you will need to enter a fake CAPTCHA code and be directed to a landing page. At this time, a virus takes over your account.
  • The scam contains an outlandish title ex. GIRL ACCIDENTALLY TEXTS MOM INSTEAD OF BOYFRIEND that intrigues users to read a story. The link leads to a fake news site where software hacking may begin.

How CAPTCHA Prevents Scammers

CAPTCHA has a variety of applications for keeping websites and users secure. These include but are not limited to:

  • Protecting email addresses from scammers
  • Protect website registrations
  • Protects online polling
  • Protects against email worms/junk mail
  • Prevents dictionary attacks
  • Prevents comment spamming on blogs

How to Keep CAPTCHA Codes Secure

If your website needs proper protection from scammers, it’s recommended to use a CAPTCHA. There are a few extra measure to take when using any CAPTCHA code:

Secure images: Images should be distorted randomly when presented to the user. With minor distortions, the image is more vulnerable to automated attacks.

Unique CAPTCHAs: If every site used similar CAPTCHA codes, hackers could catch on and create bots that would bypass this test. That’s why it’s important to change the type of CAPTCHAs every so often and avoid common mathematical equations such as 1+1.

Script Security: In addition to making sure your images are unreadable by computers, you should also ensure that there are no easy ways around the script level.

This includes:

  • A system passes the answer to the CAPTCHA in plain text as part of a web form.
  • A system where the solution to the same CAPTCHA can be used multiple times. It’s best to avoid any CAPTCHA scripts that are found freely on the web, as these are more vulnerable to attacks.

Accessibility: CAPTCHAs need to be accessible for every user. In this regard, CAPTCHAs cannot be based solely on reading text or choosing images. It’s important that users have the opportunity to opt for an audio CAPTCHA if needed.

If a website or blog owner chooses to forgo the use of CAPTCHA, they would have significant problems with spam registrants and comments on a daily basis. Many spammers or spam software look to find cracks in the system in order to hack your website. According to Microsoft research experts Kumar Chellapilla and Patrice Simard, humans have about an 80 percent success rate at solving any CAPTCHA, but machines only have a 0.01 success rate.  

Therefore, it is beneficial to use CAPTCHA in order to keep your website safe. While the idea of creating your own CAPTCHA sounds ideal, we don’t recommend creating one because of the many failure modes that you may run into. We recommend a website that creates one for you such as reCAPTCHA from Google. In order to keep your device safe in addition to CAPTCHA, be sure to download an antivirus to stay secure.  

Sources:

Dictionary.com | How Stuff Works | Digital Unite | Captcha |