WEBVTT Kind: captions Language: en 1 00:00:00.149 --> 00:00:02.610 Before you watch this video, to make sure you’re not a robot, 2 00:00:02.610 --> 00:00:05.660 please look at these pictures and identify the street signs, the cars, 3 00:00:05.660 --> 00:00:06.920 the fire hydrants, the shop fronts, 4 00:00:06.920 --> 00:00:08.010 the numbers on the front doors, 5 00:00:08.010 --> 00:00:10.009 and the ever-growing sense of frustration. 6 00:00:13.349 --> 00:00:18.120 In the late 90s the most popular search engine was AltaVista, and they had a spam problem. 7 00:00:18.120 --> 00:00:21.960 People were writing automated scripts to send in spam and malicious links to their 8 00:00:21.960 --> 00:00:24.080 finely crafted database of the web, 9 00:00:24.090 --> 00:00:27.190 and they needed to add a test that only humans could pass. 10 00:00:27.190 --> 00:00:30.190 Their solution was to add a question to the submission form that, 11 00:00:30.190 --> 00:00:31.949 back then, only a human could answer. 12 00:00:31.949 --> 00:00:35.820 In their case it was to identify a warped string of letters and numbers. 13 00:00:35.820 --> 00:00:40.340 Image processing wasn’t at the point where a computer could easily identify the squiggly letters, 14 00:00:40.340 --> 00:00:41.880 but it was trivial for a human. 15 00:00:41.890 --> 00:00:44.710 Or at least, trivial for a human with good eyesight. 16 00:00:44.710 --> 00:00:46.700 Accessible versions didn’t come along for a while. 17 00:00:46.700 --> 00:00:51.240 But that was one of the first public versions of what became known as a CAPTCHA; 18 00:00:51.240 --> 00:00:56.480 a Completely Automated Public Turing Test to Tell Computers and Humans Apart. 19 00:00:56.480 --> 00:00:59.290 A version called reCAPTCHA came along a few years later: 20 00:00:59.290 --> 00:01:01.590 it was used to help scan old books and newspapers. 21 00:01:01.590 --> 00:01:03.320 When a CAPTCHA was needed, 22 00:01:03.320 --> 00:01:07.530 the team would send one scanned word that they knew was right, deliberately distorted, 23 00:01:07.530 --> 00:01:11.490 and another word that their scanning systems weren’t sure about. 24 00:01:11.490 --> 00:01:12.970 The user would have to type in both: 25 00:01:12.970 --> 00:01:16.750 the known word was to check it was a human answering, they had to get that right, 26 00:01:16.750 --> 00:01:20.720 but the unknown word – after maybe a dozen people had agreed on what it was – 27 00:01:20.720 --> 00:01:23.260 that would be logged as part of the book scan. 28 00:01:23.270 --> 00:01:25.450 Google ended up buying reCAPTCHA. 29 00:01:25.450 --> 00:01:27.830 But by then, the arms race was well underway. 30 00:01:27.830 --> 00:01:30.810 The bot makers looked at reCAPTCHA as a challenge, 31 00:01:30.810 --> 00:01:32.280 and they rose to it admirably. 32 00:01:32.280 --> 00:01:35.890 First, they could train computers to read those messed up words. 33 00:01:35.890 --> 00:01:39.550 This was before the recent breakthroughs in machine learning and artificial intelligence, 34 00:01:39.550 --> 00:01:44.350 but even a fairly rudimentary system could solve reCAPTCHA well enough to let bot-makers 35 00:01:44.350 --> 00:01:48.159 create fake accounts and send spam some of the time. 36 00:01:48.159 --> 00:01:52.650 If the test was still too difficult, though, they could just pay humans. 37 00:01:52.650 --> 00:01:56.850 The bot makers set up systems where automated bots would fill in all the details, 38 00:01:56.850 --> 00:01:59.920 ready to send spam, and then when the CAPTCHA appeared, 39 00:01:59.920 --> 00:02:02.210 the bots would show it to human operators, 40 00:02:02.210 --> 00:02:04.720 hired from countries where the average income is low. 41 00:02:04.720 --> 00:02:08.670 Those humans got paid to sit there and solve CAPTCHA after CAPTCHA after CAPTCHA. 42 00:02:08.670 --> 00:02:12.689 After all, it’s only testing that there’s a human in the loop somewhere. 43 00:02:12.689 --> 00:02:16.500 You could even outsource your CAPTCHA solving needs to any one of dozens of companies 44 00:02:16.500 --> 00:02:19.060 who all competed on price and accuracy. 45 00:02:19.060 --> 00:02:20.770 Actually, you still can. 46 00:02:20.770 --> 00:02:24.290 Or you could get unsuspecting members of the public to solve CAPTCHAs for you. 47 00:02:24.290 --> 00:02:26.079 You could set up a web site with, er, 48 00:02:26.079 --> 00:02:29.400 some images that some people might want to see(!) 49 00:02:29.400 --> 00:02:31.230 and before they could visit, 50 00:02:31.230 --> 00:02:34.220 they’d have to prove they were human by solving a CAPTCHA. 51 00:02:34.220 --> 00:02:38.680 Which was copied straight from whatever site your bots were trying to get into. 52 00:02:38.680 --> 00:02:41.159 So then Google released reCAPTCHA version 2. 53 00:02:41.159 --> 00:02:44.090 Which is where you’re presented with a single check box, 54 00:02:44.090 --> 00:02:47.310 that you have to click on to prove you are not a robot. 55 00:02:47.310 --> 00:02:51.950 And clearly, any bots presented with that box would be honest and not click it. 56 00:02:51.950 --> 00:02:54.459 It’s not really about clicking the box. 57 00:02:54.459 --> 00:02:58.069 When you complete one of these new CAPTCHAs, extra data is sent. 58 00:02:58.069 --> 00:03:00.120 And Google is very cagey about what that data is, 59 00:03:00.120 --> 00:03:03.849 because everything they reveal is a clue for the people trying to break it. 60 00:03:03.849 --> 00:03:06.939 But that box is loaded into your browser from google.com, 61 00:03:06.939 --> 00:03:10.419 which means it can look at any login cookies that Google already have on your browser. 62 00:03:10.419 --> 00:03:11.790 Certainly if you clear your cookies, 63 00:03:11.790 --> 00:03:14.320 you are way more likely to get that secondary check 64 00:03:14.320 --> 00:03:17.459 that asks you to identify buses or fire hydrants. 65 00:03:17.459 --> 00:03:20.310 And maybe it checks how your mouse moves in the moments before clicking the box? 66 00:03:20.310 --> 00:03:24.370 And the exact position and length of time your finger tapped the phone screen? 67 00:03:24.370 --> 00:03:28.669 Plus a bunch of other things that Google all feeds into their giant machine-learning system. 68 00:03:28.669 --> 00:03:33.579 The only people that know for sure are the designers, and they aren’t telling. 69 00:03:33.579 --> 00:03:35.209 The CAPTCHA solving services, of course, 70 00:03:35.209 --> 00:03:37.290 are already offering a cost per thousand to solve these. 71 00:03:37.290 --> 00:03:39.620 It may be harder, but it’s not unbreakable. 72 00:03:39.620 --> 00:03:40.620 Using machine learning, 73 00:03:40.620 --> 00:03:45.639 bots can be trained to pass those secondary checks themselves, and to hide as humans, 74 00:03:45.640 --> 00:03:47.760 well, identifying the correct sections of the presented images 75 00:03:47.760 --> 00:03:51.380 is something that you can throw cloud machine learning at. 76 00:03:51.380 --> 00:03:54.220 And given that Google Cloud sells machine learning systems, 77 00:03:54.220 --> 00:03:57.870 it’s very likely that some of their servers are creating CAPTCHAs, 78 00:03:57.870 --> 00:04:00.150 and others are trying to break them. And, even then, 79 00:04:00.150 --> 00:04:02.520 you can just have humans on standby instead. 80 00:04:02.520 --> 00:04:05.480 So at the end of 2018, Google released reCAPTCHA version 3. 81 00:04:05.489 --> 00:04:08.519 And you might have already passed, or failed, one of those without knowing it. 82 00:04:08.519 --> 00:04:11.739 There’s no box to tick, no puzzles to solve: when you browse round a site, 83 00:04:11.739 --> 00:04:15.000 version 3 works in the background and watches what you do. 84 00:04:15.000 --> 00:04:17.709 By the time you’re posting a comment or signing up, 85 00:04:17.709 --> 00:04:21.389 it’s already assigned you a score based on how likely you are to be human. 86 00:04:21.389 --> 00:04:24.729 And again, Google is being very careful about saying how they’re working that out. 87 00:04:24.729 --> 00:04:28.740 But the answer is very likely “it's a machine learning system they're throwing everything into 88 00:04:28.740 --> 00:04:30.650 "and they don’t know it works either”. 89 00:04:30.650 --> 00:04:33.889 Hopefully they’re taking account of incognito mode, and accessibility tools. 90 00:04:33.889 --> 00:04:35.340 Because if you get a low score, 91 00:04:35.340 --> 00:04:39.639 maybe your comment will get sent to a moderator to check… or maybe it’ll just 92 00:04:39.639 --> 00:04:41.960 disappear into nothing and you'll never know. 93 00:04:41.960 --> 00:04:45.470 The bot makers, of course, are already working on the challenge. 94 00:04:45.470 --> 00:04:48.069 I signed up for a new bank account online a few months ago, 95 00:04:48.069 --> 00:04:53.620 and I had to send in a photo of my ID and a video of me holding that ID and waving. 96 00:04:53.620 --> 00:04:55.830 That’s checking not just that I’m a human, 97 00:04:55.830 --> 00:04:58.629 but that I’m the one specific human I claim to be. 98 00:04:58.629 --> 00:05:02.050 Bots are becoming more and more indistinguishable from humans. 99 00:05:02.050 --> 00:05:06.080 Successful CAPTCHA methods are having to be more and more intrusive. 100 00:05:06.080 --> 00:05:07.949 The arms race continues, 101 00:05:07.949 --> 00:05:10.530 as it has done for twenty years or more. 102 00:05:10.530 --> 00:05:14.189 I’m going to do something very strange for a sponsorship segment now: 103 00:05:14.189 --> 00:05:16.360 I’m going to tell you about limits. 104 00:05:16.360 --> 00:05:18.780 I’ve said “you should use a password manager”. 105 00:05:18.780 --> 00:05:19.780 And it’s true. 106 00:05:19.780 --> 00:05:21.449 I use one, I recommend you do too. 107 00:05:21.449 --> 00:05:25.620 Which is why this video is sponsored by Dashlane, the password manager, 108 00:05:25.620 --> 00:05:27.560 if you go to dashlane.com/tomscott, 109 00:05:27.560 --> 00:05:30.210 you can get a free 30-day trial of Dashlane Premium, 110 00:05:30.210 --> 00:05:32.770 and I recommend you try it out for yourself. 111 00:05:32.770 --> 00:05:37.599 But there are some things that a password manager cannot help with. 112 00:05:37.599 --> 00:05:41.349 If you are worried that a major government is trying to steal your secrets, 113 00:05:41.349 --> 00:05:46.150 or industrial spies with millions of dollars of funding are targeting you specifically: 114 00:05:46.150 --> 00:05:49.319 well, you probably already have professional advice. 115 00:05:49.319 --> 00:05:53.500 After all, if someone actually gets to your computer’s hardware and installs stuff 116 00:05:53.500 --> 00:05:55.740 that pulls things right out of the physical memory… 117 00:05:55.740 --> 00:05:57.439 well, at some point, 118 00:05:57.439 --> 00:06:00.810 even a password manager has to decrypt the password, put it in memory, 119 00:06:00.810 --> 00:06:03.740 and pass it on to wherever you’re actually trying to log in to. 120 00:06:03.740 --> 00:06:07.389 If an attacker has physical access to the hardware, it’s over. 121 00:06:07.389 --> 00:06:12.479 And of course, the weak link in almost every security system is human. 122 00:06:12.479 --> 00:06:17.229 All the security in the world cannot protect you from someone threatening you with violence 123 00:06:17.229 --> 00:06:18.740 unless you type in your password. 124 00:06:18.740 --> 00:06:19.740 And in the UK, 125 00:06:19.740 --> 00:06:23.889 if the police have a court order requiring you to give them your password, 126 00:06:23.889 --> 00:06:26.760 it is a criminal offence to refuse. 127 00:06:26.760 --> 00:06:28.740 People have been jailed for it. 128 00:06:28.740 --> 00:06:31.000 Dashlane cannot help you with that. 129 00:06:31.009 --> 00:06:34.289 But using Dashlane means that every password is different, 130 00:06:34.289 --> 00:06:38.639 so when some online service that you signed up to years ago and forgot about gets breached, 131 00:06:38.639 --> 00:06:40.710 it’s no big deal. 132 00:06:40.710 --> 00:06:43.400 Actually, Dashlane will also warn you about data breaches 133 00:06:43.400 --> 00:06:46.360 with instant alerts for websites where you have accounts. 134 00:06:46.360 --> 00:06:50.699 Using Dashlane also means that every password is long, complicated and secure -- 135 00:06:50.699 --> 00:06:53.480 but you don’t have to try and type them in on your phone, 136 00:06:53.480 --> 00:06:56.749 because Dashlane will autofill them for you everywhere you go. 137 00:06:56.749 --> 00:07:01.009 It can even auto-change passwords for you on a lot of sites, with the click of a button. 138 00:07:01.009 --> 00:07:02.009 In short, 139 00:07:02.009 --> 00:07:06.759 using something like Dashlane means that passwords stop being this worrying pain in the ass and 140 00:07:06.759 --> 00:07:09.610 start being something that it’s really easy to deal with. 141 00:07:09.610 --> 00:07:14.509 I thought long and hard before accepting sponsorship for this series, but honestly: 142 00:07:14.509 --> 00:07:17.449 if you are techie enough to watch these videos, 143 00:07:17.449 --> 00:07:20.000 you should use a password manager. 144 00:07:20.000 --> 00:07:25.600 So: dashlane.com/tomscott for a free 30-day trial of Dashlane Premium, and if you like it, 145 00:07:25.600 --> 00:07:28.440 you can use the code “tomscott” for 10% off at purchase.