What is a captcha?

A captcha is an automated system for differentiating humans from robots on the internet, mainly to avoid finding your site's content spammed with all kinds of links.

The word "CAPTCHA" is a distortion of the word "capture" in English, and it is sometimes considered an acronym for "Completely Automated Public Turing test to tell Computers and Humans Apart".

In reality, the acronym came after the creation of the "CAPTCHA" trademark, registered by Carnegie Mellon University, Pennsylvania.

To put it briefly: A captcha is a widget that must be solvable by a human, but not by a machine.

Invention

The concept of human detection was theorized as early as 1996 and implemented for the first time in 1997 by AltaVista, in order to avoid indexing requests for certain websites on the search engine by robots.

Example of an AltaVista captcha

Like any technology meant to protect a system, it would have to enter fierce competition with all the systems developed to bypass or get around it.

This is what is called, in security, the cat and mouse game!

And the more powerful the technology becomes, the harder it is to find workarounds. For more than ten years, captchas evolved, forcing users to:

• Solve mathematical operations
• Transcribe a word from an audio file
• Recognize characters in blurred images
• etc...

One of the biggest contributors to these developments was Yahoo, which did everything it could to prevent its "chat rooms" from being polluted by robots posting promotional messages.

All companies developed their own systems, until...

Revolution

It was in 2009, with their system called "reCaptcha," that 7 researchers from Carnegie Mellon University revolutionized the world of human vs. robot verification in the digital world.

The concept: Use archives (books and articles) and integrate them into a classic captcha service in order to digitize these paper writings.

This is what is called "implicit crowdsourcing"

Each time, reCaptcha would offer two words: one already digitized, and the other not.

The first word served to distinguish humans from machines, and the other served to advance the digitization of the archives. Among all the answers for the second word, there would be an automatic arbitration across all the responses provided by users.

This was the first time a captcha service would generate revenue for a company, instead of losing money (due to the costs associated with the service).

This is what led the company to offer this service for free to anyone and any business wishing to integrate this plugin on their site, and this is what allowed captchas to be truly democratized across the web.

Within a few months, reCaptcha was able to digitize 20 years of New York Times archives.

In September 2009, Google acquired the company reCaptcha to accelerate the digitization of its "Google Books" service.

Image recognition

Starting in 2012, OCR (Optical Character Recognition) algorithms became efficient enough that text-based Captchas became powerless against many robots.

Google then found a workaround: using images from its StreetView service:

Users' answers would then allow Google to train their own image and object recognition algorithms on very reliable data sets!

This method is much more reliable for filtering out robots, but also much more time-consuming for humans.

Google therefore adopted a much faster but also... controversial method...

One-click captchas

Integrating a captcha service on a site also means integrating a third-party script... This means that this script will have access to information previously stored in cookies.

Such as a session identifier, for example

And this is how Google was able to develop a nearly invisible captcha service:

This captcha works in three stages:

• If Google has enough information about the user, then the captcha will be invisible and is automatically validated
• Otherwise, it will simply be enough to check a box, which will allow the service to detect the "human" side of mouse movements
• If there is still doubt, Google will display an image recognition test

While this solution seems less restrictive for visitors, it poses a real problem in terms of personal data usage, and conflicts with European and French legislation.

Alternatives

If you are looking to integrate a robot prevention system in the form of a captcha, but with a service that respects personal data (and is effective), you can try the hCaptcha service, which meets all the criteria!

And requires no additional GDPR declaration.