June 2003

Excuse Me, Are You Human?

Anti-spam schemes that force people to prove they aren't machines won't work.

By Simson Garfinkel

If you have signed up for an e-mail account recently, you may have been forced to do something quite demeaning: prove that you are a human being. It's all part of the multipronged war being waged against purveyors of unsolicited e-mail, or spam. But this is one weapon that would best be abandoned.

I saw my first spam back in the 1980s. A typical message was from a California wholesaler offering cheap batteries to everyone in my MIT research group. Many people couldn't understand why I complained. "What's the big deal?" they asked. "Just hit delete.'" The big deal, as I saw it, was that unsolicited commercial messages failed a simple test of ethics: if everybody did it, e-mail would become unusable.

Twenty years later, my fears are being realized. Spam has gotten so bad, in fact, that companies are trying to fight it by developing automated approaches for distinguishing humans from computers. They're called "reverse Turing tests," or captchas-short for the more descriptive "completely automated public Turing test to tell computers and humans apart." What's driving research on captchas is the realization that a lot of spam is being sent out by automatons: if you can somehow tell the difference between an unattended computer program and one that's driven by a human, you can block the spam while letting through legitimate e-mail.

The irony that we now need to deal with computers masquerading as humans would not be lost on Alan Turing-the computer pioneer who said that a computer could be considered truly intelligent if it could indistinguishably emulate a human being. Rather than evaluating computers to see if they are smart enough, reverse Turing tests are designed to let people prove they are human.

Two popular Web-based e-mail services-Yahoo! and Microsoft's Hotmail-now employ captchas to prevent spammers from automatically signing up for hundreds of mail accounts that can then be used as spam launch pads. A junk-mail blocking service called Spam Arrest uses the technique to filter out machine-generated e-mail. All three services are based on the ability to visually recognize words-something that humans do well and computers do poorly. Sign up for a Yahoo! or Hotmail account, or send e-mail to a Spam Arrest user, and you might be presented with a fuzzy word against a complex and distracting background. To pass this pop quiz, you need to recognize the word and type it into your Web browser.

These tests are the devil. If widely deployed, they will waste our time and confound us-without solving their intended problems. "What's the big deal" this time? After all, Spam Arrest, Yahoo!, and Hotmail each require that you verify your humanity just once, right? After you get your Homo sapiens badge, you're free to e-mail all you want. By definition, captchas are designed to squander time: sending mail to a Spam Arrest user takes longer than sending mail to someone who doesn't use the service, because Spam Arrest requires that you play its little "prove you're a human" game.