The simplicity of it is logic defying. It used to be that you had to find crosswalks or move puzzle pieces or type blurred letters and numbers, but NOW all the sudden I can just click a box and HEY!, I’m human?

That’s hardly the Turing Test I’d expected.

  • @[email protected]
    link
    fedilink
    3510 months ago

    I always fail Cloudflare captchas because I’m clicking it with Vimium-C lol. I hate captchas for making me reach for my mouse. It also seems like a genuine accessibility issue if people who cannot use a mouse can’t pass a captcha.

    I’ve found that Google’s reCAPTCHA has also started rejecting me no matter what I do. I think it might be because my IP address is a VPN, but that’s pretty stupid; if I can pass the test by clicking the squares why not let me in?

    • @[email protected]
      link
      fedilink
      510 months ago

      The EXACT same thing has been happening with me and google captchas. I just switched to Proton VPn, and while I like it, the amount of capctchas I’ve had to poke through is ridiculous.

    • @[email protected]
      link
      fedilink
      110 months ago

      I’ve recently noticed the same thing with cloudflare and Google captchas while using a VPN. I just use Bing instead while on the VPN because I never get past the Google captchas, or at least I give up after 2 or 3.

      It also seems like the resolution of the browser has some impact with cloudflare. If I open a browser window in the corner of the screen, I’m basically guaranteed to get more cloudflare captchas, but if I open it full screen I only get one, maybe two.

      • @[email protected]
        link
        fedilink
        110 months ago

        If I open a browser window in the corner of the screen, I’m basically guaranteed to get more cloudflare captchas, but if I open it full screen I only get one, maybe two.

        That’s interesting. If you run a browser full screen they can get your screen resolution as part of fingerprinting you; that’s why LibreWolf and Tor Browser have their letterboxing features. So they just don’t like browser users who take actions to improve their privacy, huh

    • Karyoplasma
      link
      fedilink
      2
      edit-2
      10 months ago

      reCAPTCHA is a failed project. It was initially designed to lock out bots while being trivial for a human to solve but, over the years, captchas became more unintuitive and bots more sophisticated. Bots are now way better at solving captchas than humans and it’s just a useless time sink.

    • Lemonculus
      link
      fedilink
      410 months ago

      I’ve found that when Google decides to throw me a captcha, literally no amount of solving them will ever persuade them to let me in. I went through 10 in a row before I gave up.

      Just seems like spite to me.

    • LaGG_3 [he/him, comrade/them]
      link
      fedilink
      English
      810 months ago

      I think it might be because my IP address is a VPN, but that’s pretty stupid; if I can pass the test by clicking the squares why not let me in?

      They want your tasty IP data

  • @[email protected]
    link
    fedilink
    4810 months ago

    Theres a few answrs to this

    1. It uses your movements before this to determine whether it feels like your a bot or not
    2. It makes you wait, the biggest issue with bots is they may try to log in say 50 different passwords for example, so if it takes 5 seconds to do each one it makes boting multiple acounts not worth it.
    3. Google uses catchphas with images to choose. They use this to train their own AI or data to sell
    • @[email protected]
      link
      fedilink
      110 months ago

      To elaborate on point 1, it’s about uniqueness and timing of the path the mouse takes to click the checkbox. If it’s too straight or consistent it will red flag you.

    • @[email protected]
      link
      fedilink
      English
      7
      edit-2
      10 months ago

      Smarter bots know how to easily avoid being detected based on the speed of their requests by simply adding a random delay to them. A few years ago we discovered a very slow speed credential stuffing attack (testing usernames & passwords) against my employers site. It was only testing one set of credentials every couple of minutes.

      Once we discovered it we didn’t block it though. We were able to spot the attack fairly easily once we knew what to look for, so we updated our system to always return a login failure no matter what credentials they sent.

  • Ellia Plissken
    link
    fedilink
    English
    2210 months ago

    I’ve been told that it’s analyzing your behavior from right before you click the button

    • @[email protected]
      link
      fedilink
      2310 months ago

      The newest models already know whether you’re a bot or not before the checkbox loads. A massive majority of the internet goes through Cloudflare so by the time you land on a site you already have what Cloudflare dubs a Bot Score based on your behavior across the web.

      Checking the box really just confirms what they already know. There’s a second form which I’m sure is even more prevalent than the checkbox that renders nothing, requires no user action, but can prevent form submission if you fail the check.

  • @[email protected]
    link
    fedilink
    610 months ago

    Apart from the mouse thing (which I’m skeptical about), cloudflare also correlates your traffic with other sites hosted on cloudflare. Bots typically don’t visit many sites, click around there, find another one, etc, whereas humans will have visited other sites, will be slower at clicking the button, will have left comments on some sites.

  • Platypus
    link
    fedilink
    English
    19210 months ago

    It tests whether your mouse movement looks human–we’re really bad at things like moving in straight lines, so it’s pretty evident from a mouse movement log whether you’re a human or a simple bot. It also takes a bunch of auxiliary browser/environment data into account. It’s not perfect, but it’s complicated enough to defeat to provide fine protection against cheap spam.

    • @[email protected]
      link
      fedilink
      1810 months ago

      I’ve learned from these that I must definitely move my mouse like a robot since it always asks me to do more puzzles afterwards. This is even if I try jiggling it around after clicking just to try and convince it.

      • @[email protected]
        link
        fedilink
        110 months ago

        This is really interesting… Can you elaborate? I’ve never one had a follow up to the check mark.

        I use a high dpi mouse, what do you use?

        Spoiler: I think resolution matters here. The top comment is wrong, if anyone cares enough to take notice…

        • @[email protected]
          link
          fedilink
          110 months ago

          Cheapest Logitech mouse I could find in the supermarket about 6-7 years ago.

          As others have said, it might be more to do with my browser choice, browser settings and extensions. That said I remember when I first started seeing these years ago that sometimes it’d think I was a robot and sometimes it wouldn’t and maybe it was a placebo effect, but I felt fairly confident then that me jiggling the mouse really helped. Now it doesn’t matter what I do. My natural movement, a deliberately wonky but still single and continuous movement or a totally artificial mouse wiggle after the clock, I’ll always have to do captchas.

      • I Cast Fist
        cake
        link
        fedilink
        2510 months ago

        Could also be browser settings. I often get infinite captcha’d on private Firefox tabs

        • @[email protected]
          link
          fedilink
          810 months ago

          Yeah this is my experience as well. I don’t have much technical knowledge about it, but Firefox with ublock seems to be the enemy of captcha and CloudFlare

    • Random_Character_A
      link
      fedilink
      4910 months ago

      Shitty situation if you are used to using hotkeys and only use mouse cursor when no other means are available by moving it using numpad.

      • Wugmeister
        link
        fedilink
        English
        3310 months ago

        Nah that’s different as well. What they are filtering out is

        • a mouse teleporting to the exact center of the checkbox
        • a mouse smoothly gliding in a straight line to the center if the checkbook
        • a mouse traveling in a straight line to the center of the checkbook with some momentary stutters to add noise

        Et cetera. Humans are much noiser than anything a python script will spit out. Of course there are ways to get around this, like recording and reenacting a human mouse movement, but the point of any capcha system is to make it significantly more difficult to bot, not impossible.

        • @[email protected]
          link
          fedilink
          410 months ago

          No OP was right. If the reCaptcha is on the same page as a login, and I use my password manager to fill the fields, I fail the reCaptcha almost every time. I have to manually paste in the user name and password separately to slow things down to act more human…

      • @[email protected]
        link
        fedilink
        4510 months ago

        If it’s in doubt it just gives you extra challenges. So in the end everybody will get there, or not and then fuck you I guess.

      • Tekhne
        link
        fedilink
        1410 months ago

        Yeah, never thought about this before, but how do blind users deal with captchas?

        • @[email protected]
          link
          fedilink
          English
          610 months ago

          Some provide screen-reader instructions, but most places barely remember blind people exist. It’s another example of people with disabilities being ignored and marginalised.

          And then even if they do remember blind people exist, they probably forget there are people who aren’t blind who can’t do their tests for other reasons, like dyslexia or dexterity impairments.

          And then you have hCaptcha who makes disabled people to sign up to their database to use their cookie.

    • @[email protected]
      link
      fedilink
      310 months ago

      This feels only partially accurate. I’m a web developer, and I know websites don’t track all of what you suggest. Can you clarify, or come clean on what actually takes place?

      Honestly, I doubt it… I’m sorry. I don’t mean to be abrasive.

    • @[email protected]
      link
      fedilink
      210 months ago

      Couldn’t I just record my mouse movements clicking on it a couple dozen times and randomly replay one of those recordings?

      • brianorca
        link
        fedilink
        510 months ago

        It’s also checking your other traffic. (Since Cloudflare handles traffic for so many companies.) Are you visiting other sites in a realistic fashion, or are you doing 99% of your traffic trying to do one thing over and over.

      • @[email protected]
        link
        fedilink
        710 months ago

        Clicking percision and reaction time are still measurable and the checkbox can fall back to other captcha tactics if it has low faith in the user.

    • @[email protected]
      link
      fedilink
      510 months ago

      My question is how is it not trivial to add a noise wave or some shit to the bot path? Obviously, I have zero technical knowledge of how bots, pathing, or anti-bot analysis works

      • nick
        link
        fedilink
        1310 months ago

        It uses other signals too, like what other sites you’ve visited with that checkbox on it, what CloudFlare has seen your IP address doing in the past, etc.

        The google one is able to see if you’re logged into a google account and take that into account.

        There’s even a new variant of the Google captcha that is invisible and doesn’t even bother to show a checkbox.

    • @[email protected]OP
      link
      fedilink
      910 months ago

      Interesting that my mouse movement is available to anyone who wants it.

      It seems like a small step from that to accessing my keyboard.

      • @[email protected]
        link
        fedilink
        English
        1010 months ago

        They can only access it while you’re focused on their webpage. CORS is all about that.

        If you click off to another web page and enter information or type of password into a secondary app they can’t gather that. As soon as they lose focus they lose the ability to capture your data.

        • @[email protected]
          link
          fedilink
          310 months ago

          Nbd, but it sounds like you’re talking about encapsulation of event capture (viewport stops receiving events after losing focus).

          CORS is a protocol for client-side enforcement of a server-side security policy. It ensures that a resource request (e.g. “my-totally-safe-resource.wasm”) only loads from a location your server permits (e.g. “my-valid-origin.biz”, “friends-valid-origin.org”, etc).

      • @[email protected]
        link
        fedilink
        English
        1610 months ago

        If you’re using a webpage JavaScript can see your mouse cursor and anything you type. But only if the browser has focus. So if you’re typing in another window it can’t

      • @[email protected]
        link
        fedilink
        English
        4510 months ago

        Your mouse movement and keyboard events are available to webpages that you’ve loaded, when the browser window is focused.

        This isn’t nefarious - it allows websites to build nice UIs that most people enjoy using, most of the time.

        There’s lots of shady stuff going on in browsers, this isn’t really one of them.

          • @[email protected]
            link
            fedilink
            710 months ago

            I mean, how do you think websites work? Of course your mouse and keyboard events are available, otherwise you wouldn’t be able to interact with a website at all.

            • @[email protected]OP
              link
              fedilink
              5
              edit-2
              10 months ago

              This was the slap on the head I needed. I now get what you mean by interact with my keyboard. In other words = can tell what I’m typing. Like perfectly normal function of websites.

              I didn’t understand the “focus” part and how it helped. I think I said earlier, I’m not particularly smart.

            • @[email protected]OP
              link
              fedilink
              210 months ago

              Like those sites that ask me to sign in using Google (or other options) and then Google asks me for the password?

              Pretty easy to grab passwords I think.

              • @[email protected]
                link
                fedilink
                1210 months ago

                Those websites send you directly to Google, so they no longer have control of the web page when you’re entering your password.

              • Aatube
                link
                fedilink
                910 months ago

                This is why Google sign-in can’t be embedded and uses the password input type for the password type. Most SSOs do this as well.

              • naticus
                link
                fedilink
                English
                510 months ago

                To clarify, websites can’t capture keyboard events that were typed into a different website like you’re thinking. Think of going to a web game that let’s you use WASD for controlling your character. It’s able to capture those events on that page because its in focus. When a site goes out of focus (such as switching tabs or switching to another window that’s not the browser), it loses that ability. Overall, it’s very secure.

                I was more wondering how you thought capturing the mouse movements would lead to security issues.

      • @[email protected]
        link
        fedilink
        210 months ago

        If loaded with pages didn’t have access to keyboard events, you wouldn’t be able to write comments on Lemmy posts. I’m not a front-end guy, but that should be limited to just white the browser is focused.

      • Shadow
        cake
        link
        fedilink
        1410 months ago

        Your mouse movement on that page is. Just like if you typed into the page.

        It’s not tracking you in other windows and apps.

      • whoareu
        link
        fedilink
        510 months ago

        There is a lot of other data available to sites you visit unless you are using some kind of fingerprint protection

  • @[email protected]
    link
    fedilink
    1810 months ago

    Clicking the button doesn’t proof that you are a human. All the checks happen way before you even click the button (or sometimes even before visiting the website). Google also offers a similar button for their users and since cloudflare is also used on almost any website, they have a lot of data about you. They check your cookies, browser agent, device, settings, your IP address, if you use a VPN or proxy, etc. If you visited other cloudflare websites in the past with the same device or IP, and so on. So they know you and your device way before you even click the button. This is also the reason why you sometimes see a robot arm (made of Lego) clicking the button, and is still recognized as human. But as soon as you use a different IP address or a VPN (or even use a shared IP address, like in your company’s network) you have to solve CAPTCHAs. Of course they also check mouse movement, but this is only one part of many checks.

  • @[email protected]
    link
    fedilink
    3310 months ago

    Clicking a check box might not be the definite quality that makes you a human, but pondering on the meaning of things and questioning your humanity with a curious introspective state of mind - THAT what makes you a human! I’m proud of you, fellow human!

    • @[email protected]OP
      link
      fedilink
      710 months ago

      Thank you for interacting with me! I am an AI intelligence bot designed by Decepticon Industries. Down with Autobots!

    • Black_Mald_Futures [any]
      link
      fedilink
      English
      1110 months ago

      They’re literally using captchas to train AI, that’s why you have to identify 50 ffucking bicycles and fire hydrants sometimes. I’m pissed off at all the fucking free work I’ve had to do just to log in to shit

  • Encephalotrocity
    link
    fedilink
    English
    1610 months ago

    I don’t know for certain, but I think it is simply looking at what you do with your mouse. If the movement is erratic, imprecise, and delayed it goes ‘yeah, that is either a cat that got lucky which is close enough or a human’. The reason I think this is that I’ve failed same site’s checks if my mouse just happens to be hovering over the checkbox when the prompt appears. Retry, move the mouse, success.

  • @[email protected]
    link
    fedilink
    English
    6410 months ago

    Proof of work, which becomes computationally expensive to scale, along with other heuristics based on your browser and page interaction. I believe it’s less about clicking the box and what happens after you’ve clicked the box.

    • SerotoninSwells
      link
      fedilink
      6310 months ago

      This is correct. I work in bot detections. There are baseline checks for various browser automation used as bot frameworks like Puppeteer or Playwright. Then there is basic analysis of server side and client side fingerprints; meaning, do the fingerprints you claim make sense. There are other heuristics too and I imagine Cloudflare is monitoring movements that point to automation. All of this happens after you click. I personally prefer this over Google’s captcha which frequently doesn’t recognize me as a human but is easily bypassed by bots.

    • @[email protected]
      link
      fedilink
      410 months ago

      I believe it’s less about clicking the box and what happens after you’ve clicked the box.

      I think it’s before, not after.

  • @[email protected]
    link
    fedilink
    310 months ago

    This all humans will be good for in the future, until they atrophy and become a mere appendage of machinegod.

  • @[email protected]
    link
    fedilink
    6210 months ago

    https://blog.cloudflare.com/turnstile-private-captcha-alternative/

    TL:DR cloudflare made a new recaptcha which does some complex math and other stuff on your browser, which done once has no noticable effect but if someone were to scrape websites at an absurd speed it slows everything down significantly.

    this is not only cool because you don’t have to manually solve the captcha, but also because it allows for low-speed scraping to be feasible, with tools like flaresolverr

    • newerAccountWhoDis [they/them]
      link
      fedilink
      English
      1510 months ago

      Thanks for being the only person in this thread who doesn’t joke or talk out of their ass order-of-lenin

      Quite interesting really and a genius solution (it they don’t lie about not stealing your data)

      • @[email protected]
        cake
        link
        fedilink
        510 months ago

        Didn’t the Soviets see geniuses and other intellectuals as a danger to society during the time this award was given out? Or are there incidents where this was given to scientists as well? I know you’re probably joking, but when I suddenly encounter Lenin’s head being used in a positive manner I have to look twice.

    • @[email protected]
      link
      fedilink
      2310 months ago

      That’s actually kinda cool. Punish the scrapers, but allow regular people to not waste time.

      Meanwhile, Google is having you find the zebra crossing for the 400th time…