the end of the captchas ?

Hello,

If you did not spend the last 15 years in a cave, you probably encountered this kind of things on a website :

Source : recaptcha

The captchas

These are captchas, aka " "Completely Automated Public Turing test to tell Computers and Humans Apart"). Basically this is a way to check if your website is being used by a human or a robot. It's very useful to prevent spam. It has evolved a lot over the years, there is a "cat and mouse" game being played behind bot makers who strive to solve them automatically because once you manage to solve them you can do pretty much everything online at a large scale without being stopped. Mostly blackhat (evil hacker) stuff, but not necessarely.

Basically, abusing systems.

For instance, suppose you have a service that is lending servers. You offer a free trial with access to a server for 2 hours. If it's protected by a captcha, as a bot maker, you can't abuse the system because it's not scalable at all :

You would need to solve the captcha manually all the time. But if you were to be able to register new accounts automatically, then you could have a lot of free servers to do stuff like crypto mining, ddos, spam attacks etc etc.

Over the years we saw the appearance of bizarre looking letters, moving captchas and a lot of other things, those were all solved at some point with traditional methods (aka not AI). for instance lots of the time if you invert the colours (black becomes white and white becomes black) and tweak the contrast, you can get rid of a lot of junk (like the random dots, lines etc) and then solve it.

The rise of AI

A while after, the need for AI data rose and we started to see captchas like this :

source : recaptcha

This is obviously images that were taken from their huge database of images from google street view, and this allowed them to classify thousands of addresses and then later train self driving cars. this also has a an advantage : if google has to gather data to solve these problems and can't solve them easily without resorting to gathering tons of human data, then your average bot maker certainly won't either.

This proven to be very effective and lasted for some time. But it also raised a lot of criticism because solving captchas is annoying, time consuming and very bad for disabled people's access.

With the rise of AI and deep learning, Reading distorted letters or house numbers became easy. So they had to one-up the botters once again.

Introducing recaptchav2 :

source : recaptcha

This solved a lot of the previous issues : There is a local check so that most of the time if you don't have a suspicious computer (for instance if your ip tries to solve 200 captchas per hours) you will pass the check without having to solve anything, so it's fast, easy to use, secure, and good for disabled people. The non stop need for data classification grew significantly with lots of images asking to classify tons of objects, buildings etc.

The issue is that Machine learning is better than ever and is beating us to lots of things. What this means is that now it's harder to draw the line "It's a human because a machine wouldn't be able to do this". For instance an academic study from the university of maryland created uncaptcha which can solve captchas with a 85% accuracy. another example

85% accuracy is HUUUGE.

And as time goes on, machines will be able to imitate humans better and better so very soon captchas will become useless.

So what can be done ? There is a solution that is more and more common nowadays.

Phone verification

It's obviously easy to get a phone number online and validate using that phone number, lots of services provide it. But it raises the price for an account dramatically. And if you try to register on a known website (steemit ? :D) You might end up paying for an already used phone number.

This is very very efficient, but it's also a terrible news for privacy. Now you need a phone to go online, and lots of people will know your phone number and can sell it to advertisers. I believe it's a bad thing but we don't really have another choice to keep out spammers.

Thanks for reading , what do you guys think ?

Some more ressources if you want to explore the subject :

https://www.wired.com/story/how-your-phone-number-became-the-only-username-that-matters/
https://www.google.com/recaptcha/intro/
https://github.com/ecthros/uncaptcha