Proof of life

How many times have we squinted at curly letters, or clicked on squares with a traffic light just to prove: 'I'm not a robot'? Since 2000, CAPTCHA has been the trusty internet gatekeeper, evolving from distorted text to image grids, audio prompts, mini games. Over the past decade, this test has been slipping into the background. Take a look at how we created a form of invisible surveillance, who gets left out at the gate, and how we're inadvertently teaching the machine to see and think like us

- K Narayanan

Yahoo! — and to a lesser extent Hotmail — were the kings of the internet, in the late-1990s. Their free webmail services gave anyone with a modem a digital identity. But this openness had a fatal flaw: it was built on trust.

By 1999, that trust was being exploited by the first generation of spam bots.

The crisis revealed how vulnerable the internet had already become. A motivated teenager with a basic grasp of Python could write a simple script that could interact with websites directly. These programs didn’t need to understand the nuances of the internet. They just needed to recognise that, when they encountered an HTML field labelled “email_address”, they should inject a string of random characters, and when they saw a button labelled “Submit”, they should simulate a click.

These scripts transformed the internet into a playground for what became known as “script kiddies”: people who used pre-written code to cause chaos without truly understanding how it worked. The scripts were “headless”, meaning they didn’t need to load images or styling that a human would see. They operated on the raw text skeletons of websites, moving at the speed of the processor. Where a human might take two minutes to navigate a sign-up flow, a basic script could execute the same sequence in milliseconds.

By the time Yahoo! and Hotmail realised they had a problem, millions of fake accounts had been created by a handful of computers running on repeat.

This early automation was the primordial soup of the modern botnet.

Real-time attempts to monitor and track the origins of spam bots soon became far too unwieldy. Another solution would have to be found.