██████╗  ██████╗ ██╗  ██╗ █████╗ 
╚════██╗██╔═══██╗██║  ██║██╔══██╗
 █████╔╝██║   ██║███████║███████║
 ╚═══██╗██║   ██║██╔══██║██╔══██║
██████╔╝╚██████╔╝██║  ██║██║  ██║
╚═════╝  ╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═╝

Welcome to 3OHA, a place for random notes, thoughts, and factoids that I want to share or remember


3OHA

11 March 2026

Cuckoos and passwords

This week there has been news regarding birds and security, so here is another story.

Cuckoos are brood-parasitic birds. They lay their eggs in the nests of other species, leaving the hosts to raise their chicks. Cliff Stoll's classic book, The Cuckoo's Egg, is named after this behavior. To increase the chances of their eggs being accepted, cuckoos have evolved to lay eggs that closely resemble those of their host species in color and pattern. Furthermore, once a cuckoo chick hatches, it often pushes the host's eggs or chicks out of the nest to receive all the food from the foster parents.

This behavior has led to an evolutionary arms race between cuckoos and their host species. Some host birds have developed strategies to recognize and reject foreign eggs. Apparently, certain birds can visually identify specific types of cuckoos and eject them from the nest. Others abandon the nest entirely to start a new one elsewhere. However, this arms race often favors the parasites because of the extremely high cost of mistakenly rejecting one's own chicks. This is a natural trade-off in decision-making: The cost of a false positive (rejecting your own chick) is significantly larger than the cost of a false negative (raising a parasite). Malware detectors know this.

In response, certain birds, such as the superb fairy-wren (Malurus cyaneus), have developed a simple authentication protocol. The mother "teaches" a password, known as the incubation call, to her chicks while they are still in their eggs. This process starts on day 9 or 10. Evidence suggests that the vocal signature of each female is unique, becoming a parent-and-offspring-specific password used to detect parasites that have not learned the code.

The system works because of a timing gap: Fairy-wren eggs hatch after 15 days, giving them about 5 days to learn the password. In contrast, cuckoo eggs hatch after only 12 days, meaning they are only exposed to the mother's call for about 2 days. Because the cuckoo hatches too early, it fails to learn the password in time.

References

  1. M.E. Hauber, S.A. Russo, P.W. Sherman. A password for species recognition in a brood-parasitic bird. Proc. Biol. Sci. (2001) 268 (1471): 1041-1048. https://doi.org/10.1098/rspb.2001.1617
  2. D. Colombelli-Négrel, M.E. Hauber, J. Robertson, F.J. Sulloway, H. Hoi, M. Griggio, S. Kleindorfer. Embryonic Learning of Vocal Passwords in Superb Fairy-Wrens Reveals Intruder Cuckoo Nestlings. Current Biology (2012) 22 (22): 2155-2160. https://doi.org/10.1016/j.cub.2012.09.025



© 2026 Juan Tapiador