How many times have you had to confirm that you are a human? Or rather, that you are not a robot? A somewhat strange question to answer, one that makes the imagination run wild with scenarios worthy of Blade Runner. There are no replicants, though: just bots pretending to be human beings. 

What is a bot?

A bot is a programme capable of navigating autonomously online. A bit like bacteria, there are good bots and bad bots. The good ones help the web to function properly, such as the famous GoogleBot that helps make sites visible online and categorises them. The bad ones are used for fraudulent purposes by experienced hackers. 

The damage these bots can cause is not insignificant. Let us go into more detail about what can happen if a site comes under attack. For instance, it can happen

• a DoS (Denial of Service) attack: the hacker tries to block access to the network or resources of a computer, which means that users cannot use the services offered by the site
• a DDos (Distributed Denial of Service) attack: in this case, a computer network launches a combined attack on a site, for instance by saturating its systems
• a theft of users’ personal or access data: this can happen when a bot, for instance, repeatedly fills in a form on the site, until it gains access to a user’s account. Personal data can then be used to spread spam messages, fraudulent e-mails, etc.

A computer alone does not have the knowledge to understand whether the traffic on the site is bots or human beings. A filled-in form is a filled-in form, so how can you tell if it is a cyber attack or just a user looking for information?

This is where the Captcha comes in

The ‘Completely Automated Public Turing test to tell Computers and Humans Apart’ (more simply Captcha) is a security measure to counter malicious bots on sensitive pages or elements of a site, such as a form or a login page. It is a Challenge/Response authentication that the user must pass in order to proceed with the action to be performed. 

There are several types of Captcha: 

• the ‘oldest’ one , the ‘smwm’, was devised in the late 1990s by AltaVista, to prevent bots from reaching their search engine. The logic behind the ‘smwm’ is simple, although now obsolete due to the evolution of AI: a bot cannot recognise text composed of non-linear letters, but a human can. That is why users are asked to replicate a distorted text
• have you ever had to declare that you could recognise a traffic light? Graphical Captcha are still very common, although even here AI is beginning to prove itself capable of overcoming this security measure
• not to forget the logical or mathematical Captcha, in which the user is asked to solve simple questions, which the AI seems to have more difficulty solving than the cases described above

There are also two types of Captcha that are proving particularly effective:

• the so-called honeypot, which involves hidden forms within the site. Human users cannot see them and therefore do not fill them in, while bots reading the code encounter them and fill in the fields. In this way it is possible to know if a cyber attack is taking place
• the reCaptcha is the least disturbing of the security elements described. The user only has to put a tick to say that he or she is not a robot and can get on with what he or she was doing in a few moments. Why is it so simple? This technology analyses the user’s past behaviour: how he or she moved on the screen, clicks, scrolls made, typing speed, etc… In other words, all factors that rule out the presence of bots. The reCaptcha then assigns a ‘humanity’ score to each user and if an ambiguous score is found it triggers an additional test (recognition of an image, text, etc.). 

Bot vs. human: the Turing test 

It was the year 1950 and the magazine Mind published the article ‘Computing machinery and intelligence’, written by none other than mathematician Alan Mathison Turing. In this paper, Turing suggested a method to understand whether a machine could think like a human, namely the famous Imitation Game (better known as the Turing test). 

The Turing test goes like this: there is a person C who asks two other people (a man A and a woman B) questions. His task is to work out from the answers who is A (who must manage to fool C by trying to imitate B’s behaviour) and who is B. In the course of the test A must then be replaced with a machine without C’s knowledge. 

If C continues to guess with the same average as before who is A and who is B, then the machine can be considered intelligent, i.e. capable of formulating ideas and expressing concepts. 

To date, no machine has yet passed the Turing test, although with the attainment of ASI (Super Artificial Intelligence) this might come true. For now, this is just science fiction, but if you want to explore the subject further, you can go here.

What about you? Are you sure you are not a robot?