As you may already be aware, one of the hottest topics in tech right now is AI (Artificial Intelligence), and while I’m excited to start discussing it here in Bits & Bytes, it’s way too large a topic to cover in a single article (they’ll probably still be writing books about it when we all retire). So, over the next few months, we’ll be looking at different examples of how AI is being used today and the profound effect it’s had on the realms of data security, privacy, communication, and even digital media.
To start (and dovetailing from our previous discussions on web security), this month let’s look at the browser mechanism of CAPTCHA and why, thanks in no small part to AI, it’s been rendered mostly obsolete.
CAPTCHA Vs. AI
CAPTCHA (a loose acronym for “Completely Automated Public Turing test to Tell Computers and Humans Apart”) is what we call those annoying picture puzzles you have to solve in order to prove you’re not a robot. They come in different forms with varying levels of complexity, but the idea is that a computer should be unable to complete a CAPTCHA successfully while a human user should have no problem doing so. This is to prevent bots and scripts from doing things like submitting password forms thousands of times a second to brute force their way in, or buying up all the front row concert tickets before a human has a chance to make a single purchase.
While CAPTCHA seemed like a good solution at the time it was created, the advent of AI software that simluates human vision has rendered it mostly useless. Even popular AIs like ChatGPT have been solving CAPTCHAs successfully for years. This has forced implementers to try to make CAPTCHAs more and more difficult to stay ahead, but that ramp up in difficulty has done little else but create a more cumbersome experience for the human user without effectively solving the problem. And as if that wasn’t enough, every time a person solves a CAPTCHA successfully, their example can end up feeding into training algorithms that help AIs get better at solving them too.
All of this is to say that, with regard to their intended purpose, CAPTCHAs simply aren’t good enough anymore. So, faced with humanity’s encroaching irrelevance, what can be done?
Emerging Alternatives
Here’s a question: If AIs can be used to pass tests meant for humans, can AIs also create tests that humans don’t need to pass?
In other words, can AIs be used to solve the initial problem of testing for “humanness” that CAPTCHAs were originally created for?
That answer, as we’re beginning to see via new alternatives to CAPTCHA, is yes. Some companies like Apple, Google, and Ticketmaster are experimenting with different approaches, some of them proprietary, to cut down on the amount of human interaction needed to prove humanness. For instance, rather than requiring a person to, say, type random characters into a textbox, a web site could require that the person’s web browser draw some random text behind the scenes instead and then analyze the expected result to determine if it’s being controlled by a bot. Or, the site could use AI to monitor the movement of the mouse cursor in the page to determine whether there’s a real person controlling it.1
AIs can help provide a cool and innovative alternative to CAPTCHA, but it’s ultimately up to the company running the web site whether they implement an alternative or not. So what about the rest of us that don’t have those kinds of resources but still want to provide a better user experience without CAPTCHA?
Luckily for us, Cloudfare has come up with an easy-to-implement and free alternative to CAPTCHA called Turnstile. According to them, Turnstile “automatically chooses from a rotating suite of non-intrusive browser challenges based on telemetry and client behavior exhibited during a session” to verify humanness behind the scenes, all without requiring input from an actual human.
Of course, someday there may very well be an AI that can fool the CAPTCHA alternatives, and thus this constant one-up-manship will likely continue for years to come. Make sure you have an ample supply of popcorn.
https://news.yahoo.com/tired-proving-youre-not-robot-172457824.html