Only humans allowed

A. On the internet, goes the old joke, nobody knows you’re a dog. This is untrue, of course. There are many situations where internet users are required to prove that they are human-not because they might be dogs, but because they might be nefarious pieces of software trying to gain access to things. That is why, when you try to post a message on a blog, sign up with a new website or make a purchase online, you will often be asked to examine an image of mangled text and type the letters into a box. Because humans are much better at pattern recognition than software, these online puzzles-called CAPTCHAs-can help prevent spammers from using software to automate the creation of large numbers of bogus e-mail accounts, for example.

B. Unlike a user login, which proves a specific identity, CAPTCHAs merely show that “there’s really a human on the other end”, says Luis von Ahn, a computer scientist at Carnegie Mellon University and one of the people responsible for the ubiquity of these puzzles. Together with Manuel Blum, Nicholas J. Hopper and John Langford, Dr von Ahn coined the term CAPTCHA (which stands for “completely automated public Turing test to tell computers and humans apart”) in a paper published in 2000.

C. But how secure are CAPTCHAs? Spammers stepped up their efforts to automate the solving of CAPTCHAs last year, and in recent months a series of cracks have prompted both Microsoft and Google to tweak the CAPTCHA systems that protect their web-based mail services. “We modify our CAPTCHAs when we detect new abuse trends,” says Macduff Hughes, engineering director at Google. Jeff Yan, a computer scientist at Newcastle University, is one of many researchers interested in cracking CAPTCHAs. Since the bad guys are already doing it, he told a spam-fighting conference in Amsterdam in June, the good guys should do it too, in order to develop more secure designs.

D. That CAPTCHAs work at all illuminates a failing in artificial-intelligence research, says Henry Baird, a computer scientist at Lehigh University in Pennsylvania and an expert in the design of text-recognition systems. Reading mangled text is an everyday skill for most people, yet machines still find it difficult.

E. The human ability to recognise text as it becomes more and more distorted is remarkably resilient, says Gordon Legge at the University of Minnesota. He is a researcher in the field of psychophysics-the study of the perception of stimuli. But there is a limit. Just try reading small text in poor light, or flicking through an early issue of Wired. “You hit a point quite close to your acuity limit and suddenly your performance crashes,” says Dr Legge. This means designers of CAPTCHAs cannot simply increase the amount of distortion to foil attackers. Instead they must mangle text in new ways when attackers figure out how to cope with existing distortions.

F. Mr Hughes, along with many others in the field, thinks the lifespan of text-based CAPTCHAs is limited. Dr von Ahn thinks it will be possible for software to break text CAPTCHAs most of the time within five years. A new way to verify that internet users are indeed human will then be needed. But if CAPTCHAs are broken it might not be a bad thing, because it would signal a breakthrough in machine vision that would, for example, make automated book-scanners far more accurate.