I was having a conversation with my sister last month and we happened on the topic of CAPTCHAs.  She realized that a site she frequented, which uses a CAPTCHA to prove she is human, was getting harder and harder to complete. She started wondering if the underlying reason for the completion of this CAPTCHA was beyond just proving she was human. 

Well, she was right. ACAPTCHA(CompletelyAutomatedPublicTuring test to tellComputers andHumansApart) is an established mechanism for distinguishing automated bots from humans. There are a number of different kinds of CAPTCHAs including:

Sign up for our free newsletter.

These tests were designed not only to protect websites from spam, bots, and other abuses but also to serve a specific purpose in data collection and AI training. According to the Associated Press, Google’s ubiquitous use of reCAPTCHA technology, allowed it to digitize the entire Google Books archive and 13 million articles from the New York Times catalog, dating back to 1851.

As time has progressed and AI has gotten “smarter,” bad actors are able to fool CAPTCHAs into thinking the new bots they have developed are human. In response, CAPTCHAs have gotten more difficult and more involved. As AI has gotten more sophisticated, CAPTCHAs have become more complex. 

It’s getting to the point that some experts believe CAPTCHA designers will have to go a step further in order to stay ahead of machines. Because AI programs can be trained to tackle any cognitive task, they say we may need to transition to physical challenges, such as requiring users to rotate their phones or move them in a certain way as they would in a video game.  Of course, this could prove difficult for those who have challenges with movement, especially those involving eye-hand coordination.

A coalition of companies (including Google, Fastly, Cloudflare, and Apple,) has developed a more privacy-friendly mechanism for Apple devices called a Privacy Pass. The premise is that before we open a browser, we perform numerous actions on our phones and computers, such as unlocking them with our faces. These actions are hard for a bot to imitate.  On a Privacy Pass-enabled website, our devices will take all of that information and attest to our being human for us. This will then allow us to skip the captcha altogether. This data would never leave our devices and wouldn’t be shared with the website. Apple calls these signatures Private Access Tokens (PATs) and already leaves the feature on by default on iPhones running at least iOS 16.

Google also has developed technology for Android devices that focus on “device and app attestation” instead of implementing Privacy Pass directly. They accomplish this by using device verification instead of anonymous tokens to reduce the use of CAPTCHAs. Google calls this the Play Integrity API. When you use an app on your Android phone, this system runs invisible checks in the background to answer several questions, including:

If everything checks out, the app’s servers trust that you’re legitimate and let you proceed without showing you a CAPTCHA. According to Google, apps using this system have seen 80% less unauthorized or fraudulent usage compared to apps without it.

For those of you who still primarily use computers/laptops to engage in your Internet activities, the most established option is a free browser extension called “Silk – Privacy Pass Client,” developed by Cloudflare for Chrome and Firefox that implements the Privacy Pass protocol. It uses unlinkable cryptographic tokens to provide a better user experience on Cloudflare-protected websites by reducing the frequency of CAPTCHA challenges. When you visit a supporting site, the extension requests a token by having you solve a challenge, and then uses the token to anonymously prove you are not a bot on future visits.

Given all of the disparate implementations to stop spammers and bots across multiple platforms and devices, CAPTCHAs are not necessarily going away, but the current work toward alternatives is promising.