How does CAPTCHA know you are not a robot?

What is CAPTCHA and why is it deployed?

CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a technology used to distinguish whether a user is a human or a bot. Bots - automated scripts or programmes - can abuse websites by sending spam, creating fake accounts or scrapping sensitive data. CAPTCHA prevents this by offering users a test that is easy for humans but difficult for bots.

How does the 'I am not a robot' tick box work?

The well-known 'I am not a robot' box, which is part of CAPTCHA, seems like a simple action at first glance, but a lot happens behind the scenes. When you click the box, the CAPTCHA service collects and analyses various signals to determine whether you are a human being. This is done in the following ways:

1. Behavioural analysis:

   • The movement of your mouse before clicking the tick is analysed. A human user often moves the mouse in an organic, slightly irregular manner, while a bot often makes a straight, fast movement.

   • The timing of clicking is measured. Humans have variable reaction speeds, while bots can often have exactly the same timing.
     

2. Browser and device data:

   • CAPTCHA looks at information about your browser and device, such as cookies, screen resolution and IP address. For example, if you have successfully completed a CAPTCHA before, that may be included in the assessment.

   • The CAPTCHA service may also consider your previous interactions on other websites that use CAPTCHA.
     

3. Flow analysis:

   • CAPTCHA checks whether your IP address has been used for suspicious activity recently. If your IP is associated with botnet attacks or massive automated requests, CAPTCHA will check more strictly whether you are human.

What happens after ticking?

When you click the 'I am not a robot' box, various data is collected and analysed by CAPTCHA to determine whether you are a human. There are three possible outcomes:

1. You are immediately recognised as human: If behavioural analysis and device data confirm that you are a real user, the tick is accepted without further action. Nowadays, it is increasingly common not to have to select images after ticking. This is because CAPTCHA is getting smarter and using more sophisticated behavioural analysis, such as measuring your mouse movements and click behaviour. When you are recognised as human based on these signals, it is no longer necessary to go through additional steps.

2. You will be given an additional test: If the analysis is not completely conclusive, you will be redirected to a classic CAPTCHA test, such as selecting images with traffic signs or traffic lights.

3. You will be considered a suspect: In exceptional cases, such as when suspicious bot-like interactions are detected, CAPTCHA can block your access to the site.

How you contribute to tomorrow's technology.

Besides protecting websites, CAPTCHA also plays a role in the development of artificial intelligence (AI). For example, when you select images with cars or traffic lights, your input helps train machine learning models. These technologies are getting better at recognising objects in images, which has applications in various sectors. Think of self-driving cars that need to recognise objects in their environment, or apps that need to tag faces or objects.

So, while performing a simple task, you contribute to improving technology that can change the future. It's a subtle way to advance technology without realising it. As the Oscar-winning film 'I am not a robot' shows: What we think of as a simple task can have a bigger impact than we realise. So the next time you have to select those images again, remember: You are not only helping the website, but also the technological developments of tomorrow.