Secrets behind online security checks

You're just about to buy gig tickets, register a new email account or start writing a blog. Then suddenly you are asked to copy some squiggly characters into a box - why? We explain what these security checks are for and root out one of their more surprising uses. 

 

A CAPTCHA (Completely Automated Public Turing Test to Tell Computers and Humans Apart) is a simple online test, primarily designed to make sure that you are a human and not a computer. Put simply, computers or robots cannot read these distorted characters, and humans can. But there are other uses too - for example; with every word you type into one of these boxes you are helping to digitise a book or newspaper.

WHY THEY'RE USED
CAPTCHAs are used by a large percentage of websites that require users to input data, therefore making them vulnerable to spam - that could be unsolicited commercial promotion or out and out vandalism. Web editor for Global Cool Chris Deary explains: "Essentially, CAPTCHAs are there to protect the integrity of a website, both in terms of the front end user experience and the back end data that the website collects from its users."
There are three main examples of their uses:
1. Sites like TicketMaster use them to prevent scalpers (online touts) from buying every single ticket available and then selling them at a higher price elsewhere. TicketMaster's Carolyn Simms explains: "With over 80% of our tickets being sold online we use CAPTCHAs to prevent computer programs such as bots accessing our website.
"Bots are designed to purchase large numbers of tickets via simultaneous transactions. Without CAPTCHAs, they can purchase entire sections of tickets in less than a fraction of a second - which goes against our goal of a fair and equitable distribution of tickets to consumers."
2. Free email accounts such as Yahoo!, Hotmail and Gmail use them to prevent spammers gaining millions of accounts to send spam from. Any one account allows its holder around 200 messages a day. Without CAPTCHAs, spammers would have access to millions of accounts and the amount of spam we receive in our inboxes would dramatically increase.
3. Message boards and blogging sites use contact forms that allow visitors to either post comments to the site or send them directly to the web administrators. To prevent a bombardment of spam, many of these sites use CAPTCHAs. They don't stop humans posting offensive comments but they do prevent bots from posting hundreds of spam messages automatically.
GOOD OR BAD?
But CAPTCHAs certainly have their critics. Web editor Chris Deary says: "They are by no means 100 per cent foolproof. The strength of a CAPTCHA depends on the quality of its implementation and some spammers can bypass the weaker ones with character recognition software. Also, many genuine users find them irritating and difficult to read."
Matt Mullenweg founding developer of blogging software WordPress agrees. He says: "CAPTCHAs are bad - they're supposed to tell robots from humans but sometimes it takes me 4-5 tries to decipher one. The world is moving to mobile, and they're even worse there. CAPTCHA is also useless against human spammers, which is a growing percentage of the total."
DIGITISING BOOKS
However Luis von Ahn, founder of reCAPTCHA - a website that uses CAPTCHAs to help digitise books and newspapers - believes they are not only essential to online security, but that the letters we type in have an incredibly useful byproduct. He explains: "About 200 million CAPTCHAs are solved by humans around the world every day. In each case, roughly ten seconds is spent. Individually, that's not a lot of time, but in total these little puzzles consume more than 150,000 hours of work each day. What if we could make positive use of this human effort?
"Companies such as Amazon are trying to digitise old books, which were written before the Internet age, and they do this by scanning. Scanning books is like taking a digital photo of each page and the computer needs to be able to decipher each word.
"A technology called OCR helps to computers to read text. But in books that were written over a hundred years ago, the text has faded. We take those words and get humans to decipher them, via CAPTCHAs - so every time you type in those squiggly letters, you help to digitise books."
"The CAPTCHA is pulling double duty. Not only is it verifying the contents of a digitised book, it's also verifying that the people filling out the form are actually people. In turn, those people are gaining access to a service they want to use." Each new word that cannot be read correctly by OCR is given to a user in conjunction with another word for which the answer is already known. The user is then asked to read both words. If they solve the one for which the answer is known, the system assumes their answer is correct for the new one. The system then gives the new image to a number of other people to determine whether the answer was correct.
While many find CAPTCHAs fiddly and not entirely legible, some Internet users like the challenge. Retired teacher, Nick Clarke says: "Humans are better at the sort of fuzzy logic required to do this, so in fact you get a little boost when they appear - it's a rare confirmation that you can do something that a robot can't."
ReCAPTCHA is currently in use by over 100,000 web sites and is transcribing over 40 million words per day.