In the wake of Data Collection getting some discussion in the media, and greater scrutiny by governmental bodies, I felt that there was perhaps too much focus on Facebook, and that something that Google has been doing has just skirted past everyone’s minds.

Captcha Paranoia

CAPTCHAs are everywhere. In the early days of the web, developers wanted a way to guarantee that certain users were real people, and not just automated tools.

Enter reCAPTCHA, Google’s solution to this problem. Solve a small problem that is difficult for an AI to do, and prove that you’re human, all by simply including a little bit of code on your website.

But there are many problems with that idea.

Many of these problems could be applied to all forms of CAPTCHA served by a central server, but considering the prevalence of Google’s reCAPTCHA, I think they are particularly poignant when combined with the overreach which I believe Google exercises.

Assumption about User Ability

The first is is that you, as a website owner, are making an implicit declaration that the users of your site be able to solve whatever problem is being asked.

In the early days this meant working on the assumption that your users would be able to read distorted text. Never mind if they speak another language, or have difficulty reading.

In more recent iterations of reCAPTCHA, this task is usually a visual recognition task. Perhaps better as it doesn’t require a language solution, but you are still requiring site visitors to understand what the question is asking.

I come across elderly users of the web who are confounded when faced with challenges such as this, because after all: “if i’m just trying to access mail, or read the news, why am I suddenly being asked to click on random pictures?” – Clicking on random stuff that isn’t what you were originally looking for is not a lesson we ought to be teaching novice internet users.

This also doesn’t help a new internet user from a foreign country, who might never have seen a storefront from an image of a British Street, or an American car, and when prompted to select one, might not be able to answer. Are they a robot because of this?

You might suggest using an audio-based reCAPTCHA? Well considering the recent Yanny vs Laurel discussion, I think that’s clear proof that you can’t rely on people responding with an absolute when hearing distorted or noisy audio.

You could ask that people be given help when solving these tasks, but then you’re not encouraging digital independence and mobility.

User Autonomy in Choice of Service

In this day and age, there is a large onus placed on the end user to agree to all kinds of Terms of Service, and Privacy Agreements. But captchas somewhat undermine your ability to choose whether to accept these.

In the case of Facebook, you could simply “opt out” by not having an account. You could use a resource blocker like uBlock Origin, or even add the IP addresses to your router’s HOSTs list.

You can’t do that with a service offered by Google. In order to complete a reCAPTCHA you have to allow connections to both google.com and gstatic.com. If you want to “opt out” of google, you have to give up access to any part of the web that requires solving a reCAPTCHA challenge.

Considering the data scandals that have happened recently, the ability to simply “opt out” of parts of the web you don’t want any dealings with is an important choice users should be able to make, but by using a centrally hosted internet challenge, you take some of that autonomy away from users.

Data is Valuable

I think it is somewhat arrogant that in reCAPTCHA, you are essentially doing work, and not receiving any compensation in return other than being afforded the luxury of accessing the site you were originally tring to get to.

Consider a service like Duolingo. In the original iteration of this service, users would do work by translating foreign text. Duolingo can offer this text translation service, and to the users that take part, they are given help in learning a new language.

Consider a service like Amazon Mechanical Turk. Participants complete small tasks of work in return for hard cash. They do some work in solving a problem, and they get paid.

With a reCAPTCHA, you are helping to train an AI for Google, or you are transcribing text for Google. Where is the compensation you are due, and would be given by other services in return for work? It feels like a bit of a hold to ransom if your choice is “do work for google or don’t access this site”.

Gatekeeping, by Google™

When a web owner puts a reCAPTCHA challenge on their site, they ask google to be the gatekeeper.

This is indeed be true of any internet challenge service, but if Google is the most prolific, then in effect most websites are implicitly voting for google to be the Gatekeeper of the web.

The other big gatekeeper that springs to mind, one whose business model incorporates a somewhat more transparent gatekeeping model, Cloudflare, even relies on Google to provide a challenge. Everything leads back to a single central service.

Whenever a government makes attempts to regulate access to the web, there is wide ranging discussion. But consider that at google’s discretion, they could easily prevent access to any site using a reCAPTCHA, without any notice to the site owner, and this simply passes everyone by.

Just by increasing the number of iterations of a captcha a user has to solve, Google could put off a large number of users from visiting certain websites. I can recall many instances where I’ve given up trying to access a site after having failed an Internet Challenge too many times.

You might think that seems far fetched but it is a known fact that Google attempts to suffocate potential competitors, and if their competitor used reCAPTCHA, Google could very easily use this to their advantage.

AI is Growing, so Whats Next?

As AI grows ever better, the makers of CAPTCHA services are going to have to look for ever more nuanced ways of testing to see if users are human.

One of the ways in which a company like Google could guarantee a check if you are a robot is by using many identifiers and tying these to how you use the service.

If AI are able to solve the captchas as they currently exist, and the only check is if you interact with Google, this poses a big problem – if you hide from google and it cant see you as real… Do you just get blocked completely?

While Google are not the only offender in many of the points I’ve made above, I just don’t see their dominance and indeed the concept of CAPTCHAS as sustainable in any way.