ReCAPTCHA

Distributed Proofreaders was the first project to volunteer its time to decipher scanned text that could not be read by optical character recognition (OCR) programs. It works with Project Gutenberg to digitize public domain material and uses methods quite different from reCAPTCHA. The reCAPTCHA program originated with Guatemalan computer scientist Luis von Ahn, and was aided by a MacArthur Fellowship. An early CAPTCHA developer, he realized "he had unwittingly created a system that was frittering away, in ten-second increments, millions of hours of a most precious resource: human brain cycles". == Operation ==

reCAPTCHA v1 (human-assisted OCR) Scanned text is subjected to analysis by two different OCRs. Any word that is deciphered differently by the two OCR programs or that is not in an English dictionary is marked as "suspicious" and converted into a CAPTCHA. The suspicious word is displayed, out of context, sometimes along with a control word already known. If the human types the control word correctly, then the response to the questionable word is accepted as probably valid. If enough users were to correctly type the control word, but incorrectly type the second word which OCR had failed to recognize, then the digital version of documents could end up containing the incorrect word. The identification performed by each OCR program is given a value of 0.5 points, and each interpretation by a human is given a full point. Once a given identification hits 2.5 points, the word is considered valid. Those words that are consistently given a single identity by human judges are later recycled as control words. When six users reject a word before any correct spelling is chosen, the word is discarded as unreadable. It will ask the user to identify images of crosswalks, street lights, and other objects. It has been hypothesized that the data is used by Waymo (a Google subsidiary) to train autonomous vehicles, though an unnamed representative has denied this, claiming the data was only being used to improve Google Maps as of mid-2021. Google charges for the use of reCAPTCHA on websites that make over a million reCAPTCHA queries a month. reCAPTCHA v2 (checkbox) In 2013, reCAPTCHA began implementing behavioral analysis of the browser's interactions to predict whether the user was a human or a bot. The following year, Google began to deploy a new reCAPTCHA API, featuring the "no CAPTCHA reCAPTCHA"—where users deemed to be of low risk only need to click a single checkbox to verify their identity. A CAPTCHA may still be presented if the system is uncertain of the user's risk; Google also introduced a new type of CAPTCHA challenge designed to be more accessible to mobile users, where the user must select images matching a specific prompt from a grid. reCAPTCHA v3 and reCAPTCHA Enterprise (invisible) In 2017, Google introduced a new "invisible" reCAPTCHA, where verification occurs in the background, and no challenges are displayed at all if the user is deemed to be of low risk. == Implementation ==

The reCAPTCHA tests are displayed from the central site of the reCAPTCHA project, which supplies the words to be deciphered. This is done through a JavaScript API with the server making a callback to reCAPTCHA after the request has been submitted. The reCAPTCHA project provides libraries for various programming languages and applications to make this process easier. reCAPTCHA is a free-of-charge service provided to websites for assistance with the decipherment, Also, reCAPTCHA offers plugins for several web-application platforms including ASP.NET, Ruby, and PHP, to ease the implementation of the service. == Security ==

The main purpose of a CAPTCHA system is to block spambots while allowing human users. On December 14, 2009, Jonathan Wilkins released a paper describing weaknesses in reCAPTCHA that allowed bots to achieve a solve rate of 18%. On August 1, 2010, Chad Houck gave a presentation to the DEF CON 18 Hacking Conference detailing a method to reverse the distortion added to images which allowed a computer program to determine a valid response 10% of the time. The authors have not said if their system can solve recent reCAPTCHA images, although they claim their work to be intelligent OCR and robust to some, if not all changes in the image database. In an August 2012 presentation given at BsidesLV 2012, DC949 called the latest version "unfathomably impossible for humans"—they were not able to solve them manually either. == Criticism ==

The original iteration of reCAPTCHA was criticized as being a source of unpaid work to assist in transcribing efforts. A 13-month study published in 2023, "Dazed & Confused: A Large-Scale Real-World User Study of reCAPTCHAv2," found that reCAPTCHA provides little security against bots and is primarily a tool to track user data, and has cost society an estimated 819 million hours of unpaid human labor. Google stated in its privacy policy that user data collected in this manner is not used for personalized advertising. It was also discovered that the system favors those who have an active Google account login, and displays a higher risk towards those using anonymizing proxies and VPN services. Concerns were raised regarding privacy when Google announced reCAPTCHA v3.0, as it allows Google to track users on non-Google websites. and to cut down on operating costs since a considerable portion of Cloudflare's customers are non-paying customers. In response, Google told PC Magazine that the data from reCAPTCHA is never used for personalized advertising purposes. Accessibility Google's help center states that reCAPTCHA is not supported for the deafblind community, effectively locking such users out of all pages that use the service. Version 3 of reCAPTCHA is committed to restoring accessibility, as it is an invisible CAPTCHA, meaning users don't have to do anything manually. Instead, verification and differentiation between humans and robots occurs in the background, based on other criteria. In reality, many site owners still use the fallback feature of reCAPTCHA v2 and its visual or audio challenges. Eventually, this combination of invisible reCAPTCHA with reCAPTCHA v2 fallback challenges is still considered critical in terms of CAPTCHA accessibility. Interface In one of the variants of CAPTCHA challenges, images are not incrementally highlighted, but fade out when clicked, and replaced with a new image fading in, resembling whack-a-mole. Criticism has been aimed at the long duration taken for the images to fade out and in. == Derivative projects ==

reCAPTCHA also created the Mailhide project, which protects email addresses on web pages from being harvested by spammers. By default, the email address was converted into a format that did not allow a crawler to see the full email address; for example, "mailme@example.com" would have been converted to "mai...@example.com". The visitor would then click on the "..." and solve the CAPTCHA to obtain the full email address. One could also edit the pop-up code so that none of the addresses were visible. Mailhide was discontinued in 2018 because it relied on reCAPTCHA v1. == References ==