Why Are Bots Unable to Check "I Am Not a Robot" Checkboxes?

iStock.com/Oleksandr Hruts
iStock.com/Oleksandr Hruts

Oliver Emberton:

How complicated can one little checkbox be? You can't even imagine!

For starters, Google invented an entire virtual machine—essentially a simulated computer inside a computer—just to run that checkbox.

That virtual machine uses Google's own language, which they then encrypt. Twice.

But this is no simple encryption. Normally, when you password protect something, you might use a key to decode it. Google’s invented language is decoded with a key that is changed by the process of reading the language, and the language also changes as it is read.

Google combines (or hashes) that key with the web address you’re visiting, so you can’t use a CAPTCHA from one website to bypass another. It further combines that with “fingerprints” from your browser, catching microscopic variations in your computer that a bot would struggle to replicate (such as CSS rules).

All of this is done just to make it hard for you to understand what Google is even doing. You need to write tools just to analyze it. (Fortunately people did just that).

It turns out that these checkboxes record and analyze a lot of data, including: Your computer’s timezone and time; your IP address and rough location; your screen size and resolution; the browser you’re using; the plugins you’re using; how long the page took to display; how many key presses, mouse clicks, and tap/scrolls were made; and ... some other stuff we don’t quite understand.

We also know that these boxes ask your browser to draw an invisible image [PDF] and send it to Google for verification. The image contains things like a nonsense font, which (depending on your computer) will fall back to a system font and be drawn very differently. They then add to this a 3D image with a special texture, which is drawn in such a way that the result varies between computers.

Finally, these seemingly simple little checkboxes combine all of this data with their knowledge of the person using the computer. Almost everyone on the Internet uses something owned by Google—search, mail, ads, maps—and as you know, Google Tracks All Of Your Things™️. When you click that checkbox, Google reviews your browser history to see if it looks convincingly human.

This is easy for them, because they’re constantly observing the behavior of billions of real people.

How exactly they check all this information is impossible to know, but they’re almost certainly using machine learning (or AI) on their private servers, which is impossible for an outsider to replicate. I wouldn’t be surprised if they also built an adversarial AI to try to beat their own AI, and have both learn from each other.

So why is all this hard for a bot to beat? Because now you’ve got a ridiculous amount of messy human behaviors to simulate, and they’re almost unknowable, and they keep changing, and you can’t tell when. Your bot might have to sign up for a Google service and use it convincingly on a single computer, which should look different from the computers of other bots, in ways you don’t understand. It might need convincing delays and stumbles between key presses, scrolling and mouse movements. This is all incredibly difficult to crack and teach a computer, and complexity comes at a financial cost for the spammer. They might break it for a while, but if it costs them (say) $1 per successful attempt, it’s usually not worth them bothering.

Still, people do break Google’s protection [PDF]. CAPTCHAs are an ongoing arms race that neither side will ever win. The AI technology that makes Google’s approach so hard to fool is the same technology that is adapted to fool it.

Just wait until that AI is convincing enough to fool you.

Sweet dreams, human.

This post originally appeared on Quora. Click here to view.

What's the Difference Between Stuffing and Dressing?

iStock
iStock

For carbohydrate lovers, nothing completes a Thanksgiving meal quite like stuffing—shovelfuls of bread, celery, mushrooms, and other ingredients that complement all of that turkey protein.

Some people don’t say stuffing, though. They say dressing. In these calamitous times, knowing how to properly refer to the giant glob of insulin-spiking bread seems necessary. So what's the difference?

Let’s dismiss one theory off the bat: Dressing and stuffing do not correlate with how the side dish is prepared. A turkey can be stuffed with dressing, and stuffing can be served in a casserole dish. Whether it’s ever seen the inside of a bird is irrelevant, and anyone who tells you otherwise is wrong and should be met with suspicion, if not outright derision.

The terms are actually separated due to regional dialects. Dressing seems to be the favored descriptor for southern states like Mississippi, Tennessee, South Carolina, and Georgia, while stuffing is preferred by Maine, New York, and other northern areas. (Some parts of Pennsylvania call it filling, which is a bit too on the nose, but to each their own.)

If stuffing stemmed from the common practice of filling a turkey with carbs, why the division? According to HuffPost, it may have been because Southerners considered the word stuffing impolite, and therefore never embraced it.

While you should experience no material difference in asking for stuffing or dressing, when visiting relatives it might be helpful to keep to their regionally-preferred word to avoid confusion. Enjoy stuffing yourselves.

Have you got a Big Question you'd like us to answer? If so, let us know by emailing us at bigquestions@mentalfloss.com.

Why Do Tires Have to Be Filled With Air?

BookyBuggy/iStock via Getty Images
BookyBuggy/iStock via Getty Images

Paul Misencik:

This is an issue that has perplexed me for most of my life, because pneumatic tires filled with air seem like the last anachronistic, 19th-century component of a modern automobile, and an idea which should have disappeared many decades ago. In an era where even the internal combustion engine itself is giving way to electric motors, and where a new economy hatchback has exponentially more computing power than the Space Shuttle, pneumatic tires don’t seem to make sense any longer.

(And before I get flamed, I know modern tires are vastly more advanced and reliable and capable than their 1930s counterparts. Blowouts, which were a common occurrence when I was a kid, are pretty much unheard of today. Modern tires are great, but they are still vulnerable and maintenance-intensive in a way that doesn’t make any sense to me.)

Companies have experimented with non-pneumatic passenger vehicle tires in the modern age—one of the primary drivers was Michelin. But the tires weren’t filled with solid rubber. In fact, they didn’t even have sidewalls. They were open on the sides, and they had a support lattice of structural polyester ribs, with a ton of air space between the contact patch and the (now deformable) wheel.

One of the big problems with switching from pneumatic tires to non-pneumatic tires is the fact that the current air-filled tire is an important component of the suspension of a vehicle. The flex in the sidewall is a critical part of the compliance of the suspension and substantially affects a vehicle's ride and handling. (Which is why race car drivers sweat tire pressures at each corner of the vehicle so much, as even a small change in tire pressure can have a big effect on the handling and grip of a vehicle.)

If a company like Michelin wants to make a non-pneumatic tire, they'll improve their chances of finding success with it if the new design mimics the compliance and flex characteristics of the outgoing, air-filled models as closely as possible. That way, Michelin would be able to sell the new, non-pneumatic design as a retrofit to older vehicles whose suspensions were originally designed with pneumatic tires in mind. And that is hugely important because if they can’t, it becomes much more difficult to convince manufacturers to change over to the new design—particularly after the mild debacle of Michelin’s failed “TRX” metric tire idea of the 1980s, which required the use of a special wheel and which, despite being by most accounts a superior design in almost every way, never really took off. (Owners of 1980s Ferrari 512 Berlinetta Boxers and some Saab 900 turbos will know what I’m talking about here.)

Non-pneumatic Michelin tires are also rather weird looking, and it’s not clear which manufacturers, if any, would take the risk of being the first to offer them on a new car.

So that is the real issue: Any non-pneumatic tire design must be not only clearly superior to the pneumatic designs of the past, but it must be functionally identical to the outgoing models they would replace, and they must be visually acceptable to consumers.

I hope it happens, though. I hope someone cracks the nut. Pneumatic tires are a 19th-century application still being used on 21st-century vehicles, and at some point that needs to change.

This post originally appeared on Quora. Click here to view.

SECTIONS

arrow
LIVE SMARTER