How do I know that you're you?

Original post:  Dec 8, 2014

It seems like we are getting closer to eliminating one irritant in our daily lives. When was the last time you had to enter a captcha?

These types of screens ask you to enter a set of characters that are deliberately obscured to make it difficult for automated "bots" to read using optical character recognition. It's supposed to separate out the humans who you typically want from the spammers and evildoers who you don't. As with any plan, there are now some sophisticated programs that can use crowdsourcing and other techniques to get past the captcha. Meanwhile, the rest of us suffer through the puzzles every time we have to reset a password.

Google has come up with a new technique. It's quite simple. All you will have to do is click on a checkmark. Most of the time, that will be it. Based on the track of your mouse, it can make an educated guess that is 60-80% accurate about whether or not there is a real person making the click or an automated program.

Here's an excerpt from the Wired article on this exciting development:

“For most users, this dramatically simplifies the experience,” says Vinay Shet, the product manager for Google’s Captcha team. “They basically get a free pass. You can solve the catptcha without having to solve it.”

Instead of depending upon the traditional distorted word test, Google’s “reCaptcha” examines cues every user unwittingly provides: IP addresses and cookies provide evidence that the user is the same friendly human Google remembers from elsewhere on the Web. And Shet says even the tiny movements a user’s mouse makes as it hovers and approaches a checkbox can help reveal an automated bot.

“All of this gives us a model of how a human behaves,” says Shet. “It’s a whole bag of cues that make this hard to spoof for a bot.” He adds that Google also will use other variables that it is keeping secret—revealing them, he says, would help botmasters improve their software and undermine Google’s filters.

Unfortunately, this is only for desktop users (for now). Smartphone and tablet users might have a different challenge:

For smartphone and tablet users, Google hasn’t simplified its captcha to a single click. Instead, it will show users a collection of images and ask them to make distinctions that might be tough for bots. For instance, it might display a picture of a cat and ask the user to tap the images that match it among eight photos of other cats, dogs, gerbils and leaves.

One last quote:

But Google’s Shet points out that when its captchas appear on other sites, Google will only be able to track the user’s movements over the captcha widget, not the whole page. And he argues that captchas are, by their very nature, good for privacy: They provide a way to show you’re a good user, rather than an evil bot, without logging in to a service or coughing up identifying details. “You don’t have to verify your identity,” Shet says, “to verify your humanity.”

Here is the link to the full article:  Google Can Now Tell You're Not a Robot With Just One Click | WIRED