Are you human? How CAPTCHA asks the wrong question & solves nothing

I hate spam. I also hate CAPTCHAs.

Spam's not just an issue for web site / app / email consumers, although it's a major annoyance. It's a huge problem for developers and those who run the services. While you might get 50 spams a day, say, the problem is that the servers used in the process of sending & transferring are getting hit a million times harder.

So, what's a body to do?

Test for other bodies, right?

CAPTCHA catches on

CAPTCHA was a term that we began to become familiar with in 2001 and 2002. It was invented in 2000, by a couple of folks from CMU and IBM, in response to problems with Y! chatroom spam. CAPTCHA stands for Completely Automated Public Turing test to tell Computers and Humans Apart. (I, personally, think they worked too hard on that one.)

Since then, it's transitioned from a bizarre, nigh unpronounceable oddity to an everyday annoyance that we accept with a sigh.

We now see CAPTCHA everywhere a service provider is afraid of losing resources to spambots.

And a number of places where there's no such likelihood, just because CAPTCHA has become a reflexive action—just like the black velvet dots for disguising smallpox scars became a fashion statement for the unafflicted.

The grand goal?

The whole point of CAPTCHA is to stop spammers in their tracks.

The method?

Stupid Human Tricks.

There are lots of things computers can't do but humans can. The best way to test if a body is a human or a spambot is to make it do human things. But rather than engaging in a dialog on Stoic philosophy or writing limericks, say, which are hard things to evaluate on the back-end, the CAPTCHA people came up with something a little more... visual.

The human brain is the best image processing computer in the world. Nothing we can program compares. We can detect patterns, especially faces and letters, in almost anything, no matter how distorted or fanciful.

So. Obvious conclusion ahead:

Let's distort text and make humans enter it! Yay!

70694F3E-760D-4050-9EC4-C1788D9F5597.jpg

The above example is a really old school CAPTCHA—one on the first, using the swirl distortion. It's really easy to read. Not just for humans: it can be cracked by software.

It didn't stay this way for long.

Failure, doom & destruction!

I once read that there are two basic levels of failure: Level 1, where you do the thing wrong, and Level 2, where you do the wrong thing.

CAPTCHA fails on both levels.

Level 1 failure: failure to operate as intended

CAPTCHA may have diminished spam dramatically... for a while. But like any spam-fighting technique, it doesn't operate in a vacuum.

Yes, CAPTCHA—supposedly a Stupid Human Trick hat trick—can be cracked.

The rolling out of CAPTCHA pissed off spammers who, in the finest tradition of salty stories, became bent on revenge. They found a number of ways to crack the early CAPTCHAs.

CAPTCHA images must get ever more difficult to parse, even for humans, necessitating the addition of a "reload" feature when the images are totally unreadable.

It's a death spiral.

There's an inevitable endgame coming:

Most CAPTCHA research to date has been limited to academic applications. Far more powerful algorithms will be required for commercial CAPTCHAs. As CAPTCHAs become more prevalent, bot programmers are expected to unleash armies of bots bent on breaking them. — PARC web page

Level 2 failure: it's the wrong thing, anyway

But the most intriguing aspect of cracking CAPTCHAs is that you don't have to crack CAPTCHAs to get around them.

Let's review:

  1. CAPTCHAs demand mad image processing skillz.
  2. What are the best image processing computers in the world? Humans.

Get it?

Computer science researchers know exactly how hard image processing with computers is, because that's a constraint they come up against in their research all the time.

But spammers are much better judges of human nature than computer science researchers.

There's no need to be an image processing whiz to defeat CAPTCHA. What you need to defeat CAPTCHA are warm bodies. Not even smart ones. Just living and breathing and neurologically firing.

Spammers simply farm out the CAPTCHA solving to those fleshy meatbots that do it like second nature: humans.

Thanks to Mechanical Turk you can get CAPTCHAs solved and open all the spammy fake accounts you want for about a nickel apiece. There are other online markets, too. Hell, hire a dedicated team!).

Even more cheaply, and probably even more speedily, you can use human's weaknesses as leverage (weaknesses other than money!).

Some brilliant folks source CAPTCHAs from the sites they wish to infiltrate and put them in front of download links for pirated copies of music, movies and porno.

The people seeking the music and porn will fill out the CAPTCHA for free, without thinking "Oh no! What if this CAPTCHA stands between Yahoo! Mail and one more spambot? How will I ever live with myself?"

A category failure at heart

The real way to stop spam is not to test if a request originates with a human. Humans are clever, devious and untrustworthy.

A better way to stop would be to identify spamminess from other metrics that are unique to spam: behavioral patterns, Bayesian filtering, keywords.

Not that I'm saying it's easy. There's a reason I'm not a computer science research scientist.

But, uh, need I say more?

posted in: design, development, the brain, usability    |     9 comments

Do "interesting details" really hurt learning?

Overcoming Bias has a little post that, for the most part, quotes the findings of a study on how "interesting details" affect learning.

The researchers found that "interesting details" decreased the student's understanding (transfer), while not affecting the student's memory (retention) of what they read/watched.

Case 1 was video trying to teach about how a cold virus infects the body.

Case 2 was a slide deck on digestion (the students read the presentation, there was no presenter).

Their Conclusion

The money quote (from the study):

Results are consistent with a cognitive theory of multimedia learning, in which highly interesting details sap processing capacity away from deeper cognitive processing of the core material during learning.

Huh. Interesting, right?

And now, some interesting details I've chosen for you:

  • the "interesting details" for Case 1 were not directly related to the matter at hand; they were about virii's "role in sex and death," not spiffy facts about the main topic, how a virus infects the body
  • the "interesting details" for Case 2 go unrecorded

This paper isn't showing up in any of the research libraries I have subscriptions to, or I'd dig deeper.

Probable Flaws

But based on this snippety snip, I'd wager that the following problems exist with the study's conclusion:

  • interesting details lower comprehension when they distract from the very specific topic at hand
  • "interesting" is in the eyes of the beholder (just because something's about sex or death doesn't make it interesting, natch—it could make the student feel uncomfortable, guilty, or disgusted, too, rather than interested)
  • intriguingly, the "interesting details" group did not remember (retain) any less, they just understood less, but they were tested on the main point, not the interesting details
  • the real key to aiding comprehension & retention is to focus, focus, focus on your point; if you can keep the focus on with interesting details, surely that will add to understanding rather than detract

Useful takeaways for every day life

Nevertheless, it serves as a good reminder that we all need from time to time: Stay on point. Which I will always imagine as a leaping dolphin with a ball on his nose, a cardboard cutout prop used in a 2nd grade writing lesson. Which kinda proves the, well, point.

Ever since my first couple talks, my presentation theory has boiled down to: A) people will only remember 1 entire thing from your 45-minute talk, so make it count, and B) making people laugh gets them more engaged, and more engaged people learn and remember more.

People balk when I tell them A, but my experience has upheld this idea. Once you choose your main point for A, that you want them to remember in full, you can only try to expose them to other ideas in the hope that they will remember them vaguely later, when they need them: Didn't I hear about a tool for this? Maybe I should Google instead of writing my own...

Now I will be sure to reduce even further any extraneous "interesting tidbits" that are not on focus.

posted in: reading, the brain, writing    |     6 comments

The economic downturn is not going to kill Wikipedia.

Please. Will the talking heads just shut up?

That dude who wrote that book slamming "amateurs," which I will not name because like hell I'm gonna give him free press, has written something else equally stupid. This time it's short, at least, and free, and therefore not nearly as offensive as the whole goddamn book.

So full of crap

But he is making the asinine and no doubt intentionally inflammatory argument that the economic downturn will make people stop contributing to insert media darling web 2.0 community here in favor of payola, Web 2.0 style.

When we think of the Great Depression, we imagine long lines of gaunt men, caps in hand, waiting for soup handouts. The equivalent photos of today's economic hard times -- displayed for free, of course, on Flickr -- may be represented by images of unemployed people in front of their computers cheerfully donating their labor to Wikipedia.

Oh, pleeeeeeeeeeeease.

In his best-selling book, Predictably Irrational, MIT behavorial economist Dan Ariely suggests that most of us are irrational when it comes to determining the value of our labor. I’m not sure.

Well, you know, that's just one uneducated man's opinion. Oh wait. Dan Ariely is an MIT behavioral economist. Who does genuine scientific research. And cites other people's genuine scientific research. There's, like, at least 3 decades of research on these topics.

And this guy is... a history major![1] (Would I like fries with this rant? Why... yes!)

So, about that point...

So how will today's brutal economic climate change the Web 2.0 "free" economy? It will result in the rise of online media businesses that reward their contributors with cash; it will mean the success of Knol over Wikipedia, Mahalo over Google, TheAtlantic.com over the HuffingtonPost.com, iTunes over MySpace, Hulu over YouTube Inc. , Playboy.com over Voyeurweb.com, TechCrunch over the blogosphere, CNN’s professional journalism over CNN’s iReporter citizen-journalism... The hungry and cold unemployed masses aren’t going to continue giving away their intellectual labor on the Internet in the speculative hope that they might get some "back end" revenue. "Free" doesn’t fill anyone’s belly; it doesn’t warm anyone up.

Oh NO! Better start shorting stock in Jimmy Wales!

But in reality, there's this thing called science

Most people don't do it for the "back end" revenue (which is a term I think he made up just then). They do it because they like to, because it gives them fuzzy feelings, because they like helping people, because that supports their self-image of being a helpful person, because it gets their name out there, and because they like basking in the warm glow of geek cred.

Everybody knows—or should know, in this age of cheap and accessible neuroscience/sociology popularization—that when you pay somebody for something (or even mention money), their reasoning flips a switch, from pleasure / social justifications (e.g. I'm posting on digg because it's fun! or I'm writing this Linux tutorial because it makes me feel good to help people, plus I get geek cred! or I'm helping you move your heavyass sofa because you're my friend and that's what friends do!) to economic justification (Like, dude! $1 for a digg post is so not worth me actually hunting down something NEW, here comes recycled blog spam. Or What the hell? You think $40 was enough to help you carry that damn couch? It was made out of fucking lead! Fuck you too!).

Once you've got somebody sitting there, economizing in their head about their effort vs your money, you're pretty much screwed. There's no way you can pay people what their actual effort is worth, with your Web 2.0 "business" (or friend-powered moving endeavor). Once they start thinking economically they'll see it's a waste of their time... and since you've sucked the joy out of it by making it work, they're gonna disappear. Poof!

Even when their coffers are already pretty empty. People have such an overpowering sense of fairness that they'd rather get nothing than receive an unfair cut.

But if you don't believe me, just look for the shining examples of paid-for content on the interwebs. Look at Squidoo. Look at Netscape's digg killer (quick! can you name it? I couldn't, I had to google it). Yahoo! Answers. Et cetera, ad nauseum.

Timely business book cliché

This is also illustrated in the har-har-aren't-we-businessmen-clever-nudge-nudge apocryphal story about the old man who couldn't get these noisy kids to stop playing in his yard, and believe you me, he tried everything right up to and including shaking his cane and calling them whippersnappers. Nothing worked. Until one fine day when he hit on the idea of paying them.

"Your young voices, so full of cheer, do me a world of good. I love to have you playing in my yard. It brightens up my day," he told them, "I'll give you each 50 cents each day to come play." At first the kids thought, "Score! Free money!" And yet, money was less powerful motivator than the joy of being annoying little bastards and so they slowly trailed off in their enthusiasm for playing—because now it had become work—until one day the old man told them he forgot his quarters in his other pants, and they never came back again.

Which just goes to show, you shouldn't piss off old dudes with lots of time and access to pop psychology books.

And if you're going to rope your friends into helping you move, do everyone a favor and pay them in beer, pizza and affection, not money.

And if you think you're going to write world-changing social software—or worse yet be a social software critic—do the world a favor and read a book on psychology first.

A special note for the one-uppers

PS — Don't bring up Mechanical Turk. It's a different case, and you know it.

[1] OK, the annoying dude also has a master's degree in polysci, but I remain unimpressed.

posted in: design, reading, the brain    |     11 comments