Prove Your Humanity

It’s time to log in to the system to do the thing. Alongside the area to enter your credentials is a box with a logo: Prove you’re human

Oh great, you think, not again. What’s it going to be this time?

Maybe you’ll be asked to click the images of birds, and somehow failing because one of the things that looked like a bird, well, wasn’t. Maybe you’ll be asked to click the squares containing traffic lights and have to judge individual pixels. Maybe there are images behind the letters, or the text is so warped you can’t read it. Maybe you have vision issues and need to use the aural equivalent, but are in a noisy environment and can’t hear it. Maybe it’ll just keep sending you new things. Maybe they’ll ask you to find the scary numbers.

You’ve wasted five minutes, and your blood pressure is up. Maybe it’s time to install a browser extension.

Whatever the excuse, forcing people to complete a CAPTCHA is simply dehumanizing. There are many problems with them: they are fundamentally inaccessible, many require cultural intelligence (deliberately, inadvertently, or nonsensically), they are incredibly difficult or obtuse, and they’re ethically questionable, as you’re providing free labor to train algorithms.

Adding injury to insult, CAPTCHAs are also ineffective. It may be cutting edge to solve CAPTCHAs using machine learning, but a prevalent technique involves automating humans, akin to Mechanical Turk — and these days there are specific services.

Automating this labor isn’t even new: in the mid-2000s, one of the first projects of my career involved scraping surreptitiously on behalf of a large company. They had a service which would accept images of CAPTCHAs, show them to their own users, and return a solution for our programs to try. It worked surprisingly well.

To make matters worse, our familiarity with CAPTCHAs is being exploited to install malware or steal information.

If you are serious about stopping automated uses of your system, there are less frustrating alternatives, new ideas (however cursed), and more comprehensive approaches. It’s a cat and mouse game — playing it subjects your system’s users to frustration in the best case and likely exploits them, and continued familiarity with CAPTCHAs will cause harm.