The simplicity of it is logic defying. It used to be that you had to find crosswalks or move puzzle pieces or type blurred letters and numbers, but NOW all the sudden I can just click a box and HEY!, I’m human?
That’s hardly the Turing Test I’d expected.
Clicking the button doesn’t proof that you are a human. All the checks happen way before you even click the button (or sometimes even before visiting the website). Google also offers a similar button for their users and since cloudflare is also used on almost any website, they have a lot of data about you. They check your cookies, browser agent, device, settings, your IP address, if you use a VPN or proxy, etc. If you visited other cloudflare websites in the past with the same device or IP, and so on. So they know you and your device way before you even click the button. This is also the reason why you sometimes see a robot arm (made of Lego) clicking the button, and is still recognized as human. But as soon as you use a different IP address or a VPN (or even use a shared IP address, like in your company’s network) you have to solve CAPTCHAs. Of course they also check mouse movement, but this is only one part of many checks.
It tests whether your mouse movement looks human–we’re really bad at things like moving in straight lines, so it’s pretty evident from a mouse movement log whether you’re a human or a simple bot. It also takes a bunch of auxiliary browser/environment data into account. It’s not perfect, but it’s complicated enough to defeat to provide fine protection against cheap spam.
Interesting that my mouse movement is available to anyone who wants it.
It seems like a small step from that to accessing my keyboard.
They can only access it while you’re focused on their webpage. CORS is all about that.
If you click off to another web page and enter information or type of password into a secondary app they can’t gather that. As soon as they lose focus they lose the ability to capture your data.
Nbd, but it sounds like you’re talking about encapsulation of event capture (viewport stops receiving events after losing focus).
CORS is a protocol for client-side enforcement of a server-side security policy. It ensures that a resource request (e.g. “my-totally-safe-resource.wasm”) only loads from a location your server permits (e.g. “my-valid-origin.biz”, “friends-valid-origin.org”, etc).
There is a lot of other data available to sites you visit unless you are using some kind of fingerprint protection
If you’re using a webpage JavaScript can see your mouse cursor and anything you type. But only if the browser has focus. So if you’re typing in another window it can’t
Your mouse movement on that page is. Just like if you typed into the page.
It’s not tracking you in other windows and apps.
Your mouse movement and keyboard events are available to webpages that you’ve loaded, when the browser window is focused.
This isn’t nefarious - it allows websites to build nice UIs that most people enjoy using, most of the time.
There’s lots of shady stuff going on in browsers, this isn’t really one of them.
Hmm, I can think of some ways to misuse this. And I’m not very smart at all.
Say more
Like those sites that ask me to sign in using Google (or other options) and then Google asks me for the password?
Pretty easy to grab passwords I think.
To clarify, websites can’t capture keyboard events that were typed into a different website like you’re thinking. Think of going to a web game that let’s you use WASD for controlling your character. It’s able to capture those events on that page because its in focus. When a site goes out of focus (such as switching tabs or switching to another window that’s not the browser), it loses that ability. Overall, it’s very secure.
I was more wondering how you thought capturing the mouse movements would lead to security issues.
Those websites send you directly to Google, so they no longer have control of the web page when you’re entering your password.
This is why Google sign-in can’t be embedded and uses the password input type for the password type. Most SSOs do this as well.
I mean, how do you think websites work? Of course your mouse and keyboard events are available, otherwise you wouldn’t be able to interact with a website at all.
This was the slap on the head I needed. I now get what you mean by interact with my keyboard. In other words = can tell what I’m typing. Like perfectly normal function of websites.
I didn’t understand the “focus” party and how it helped. I think I said earlier, I’m not particularly smart.
Couldn’t I just record my mouse movements clicking on it a couple dozen times and randomly replay one of those recordings?
It could store the mouse movements to compare later.
My question is how is it not trivial to add a noise wave or some shit to the bot path? Obviously, I have zero technical knowledge of how bots, pathing, or anti-bot analysis works
It uses other signals too, like what other sites you’ve visited with that checkbox on it, what CloudFlare has seen your IP address doing in the past, etc.
The google one is able to see if you’re logged into a google account and take that into account.
There’s even a new variant of the Google captcha that is invisible and doesn’t even bother to show a checkbox.
This feels only partially accurate. I’m a web developer, and I know websites don’t track all of what you suggest. Can you clarify, or come clean on what actually takes place?
Honestly, I doubt it… I’m sorry. I don’t mean to be abrasive.
Shitty situation if you are used to using hotkeys and only use mouse cursor when no other means are available by moving it using numpad.
Nah that’s different as well. What they are filtering out is
- a mouse teleporting to the exact center of the checkbox
- a mouse smoothly gliding in a straight line to the center if the checkbook
- a mouse traveling in a straight line to the center of the checkbook with some momentary stutters to add noise
Et cetera. Humans are much noiser than anything a python script will spit out. Of course there are ways to get around this, like recording and reenacting a human mouse movement, but the point of any capcha system is to make it significantly more difficult to bot, not impossible.
No OP was right. If the reCaptcha is on the same page as a login, and I use my password manager to fill the fields, I fail the reCaptcha almost every time. I have to manually paste in the user name and password separately to slow things down to act more human…
This never happens to me, I always instantly autofill with my password manager.
If it’s in doubt it just gives you extra challenges. So in the end everybody will get there, or not and then fuck you I guess.
Yeah, never thought about this before, but how do blind users deal with captchas?
Some provide screen-reader instructions, but most places barely remember blind people exist. It’s another example of people with disabilities being ignored and marginalised.
And then even if they do remember blind people exist, they probably forget there are people who aren’t blind who can’t do their tests for other reasons, like dyslexia or dexterity impairments.
And then you have hCaptcha who makes disabled people to sign up to their database to use their cookie.
Normally there are audio captchas
There are audio captchas.
But it also works with touchscreen taps, and randomizing tap position, duration, and delay is fairly simple.
I’ve learned from these that I must definitely move my mouse like a robot since it always asks me to do more puzzles afterwards. This is even if I try jiggling it around after clicking just to try and convince it.
Could also be browser settings. I often get infinite captcha’d on private Firefox tabs
Yeah this is my experience as well. I don’t have much technical knowledge about it, but Firefox with ublock seems to be the enemy of captcha and CloudFlare
What if you’re on a phone or tablet?
Clicking percision and reaction time are still measurable and the checkbox can fall back to other captcha tactics if it has low faith in the user.
It’s also checking your other traffic. (Since Cloudflare handles traffic for so many companies.) Are you visiting other sites in a realistic fashion, or are you doing 99% of your traffic trying to do one thing over and over.
some of them are also less bot detection and more spam limiting and mitigation. cloudflare’s has more stuff built in I’m sure, but things like mCapcha are just proof of work, so if you’re trying to make a bunch of accounts or whatever, it’s really computationally expensive.
I guess Bots started figuring out the previous puzzles.
They’re literally using captchas to train AI, that’s why you have to identify 50 ffucking bicycles and fire hydrants sometimes. I’m pissed off at all the fucking free work I’ve had to do just to log in to shit
Does this box with a sliver of bicycle handlebar count as containing a bicycle?
It’s actually detecting you using emotion and aging. That’s the real test…
If I was walking in a desert and saw a tortoise on its back, struggling to get up, and I was not helping it
Listening to me talk about that birding hat I want to buy, checking thru Amazon to see if it’s on my wishlist.
Cloudflare has a bot score. Depending on how sus your bot score is you can use several different levels of verification. The checkbox you refer to is kind of in the middle. There is also a more complicated intrusive captcha and a totally transparent javascript. It’s a pretty slick system.
I like that when I’m on tor browser with VPN behind it they’re like “Yeah, cool, go on through”
Don’t mix tor plus VPN.
If you’re using tor browser without tor for some reason, carry on.
VPN behind it. So tor is under the VPN.
So, turn off my VPN that’s always running before I use the tor browser?
There are two ways to layer a VPN and tor:
- Tor over VPN; or
- VPN over Tor.
In the first option, you gain little. Tor already encrypts your traffic, so your ISP can’t see inside them. Technically, Tor over a VPN hides the fact that you’re using Tor from your ISP, but Tor’s snowflake does something similar if you need that.
In the second option, you’re revealing your VPN account information, which could theoretically be associated back to you. Tor adds nothing over just a VPN in this case.
So really, “no value in mixing,” which is distinct from “don’t mix.”
The latter implies a security risk could be created.
The risk of mis-ordering your layers is a security issue.
A security risk is created, you’re creating a permanent guard node by using your VPN with TOR. A lot of people downplay how serious this can be against a dedicated attacker. Sure, it may not matter for most, but for those with the right threat model, it will.
Why?
Basically bots would automatically click on it, teleporting the cursor to the very center of the button. They will do this within exact milliseconds of the page loading.
Humans read something on the site, then find the banner, and move the cursor over to it, confirm that the cursor is somewhere on the button, and then click it.
It’s not just the button, it’s the before the button that determines you’re a bot or not.
A side to this is that certain techniques will be deliberately obfuscated or simply omitted as a security measure in the hopes of slowing a bad actor’s eventual bypassing of the measure. It’s an arms race and if the intruder doesn’t know what all the locks even are, it takes longer to break or pick them.
Humans have mouse movement that, on August 8, 2024, are very hard to reproduce. But just like regular captchas we are just teaching computers to do the same thing.
Whoa what happened on the 9th?
Recaptcha gained sentience
Aaaaand why would CloudFlare want to teach the computers to mimic mouse movements?
Proof of work, which becomes computationally expensive to scale, along with other heuristics based on your browser and page interaction. I believe it’s less about clicking the box and what happens after you’ve clicked the box.
I believe it’s less about clicking the box and what happens after you’ve clicked the box.
I think it’s before, not after.
I kinda think your browser makes sure you at least click before websites are allowed tracking things like your cursor.
I think the clicking is rather the part where you agree to allow your history to be checked, essentially.
Sorry for linking Reddit, but… https://www.reddit.com/r/askscience/s/Ws3Mr45qFV
This is correct. I work in bot detections. There are baseline checks for various browser automation used as bot frameworks like Puppeteer or Playwright. Then there is basic analysis of server side and client side fingerprints; meaning, do the fingerprints you claim make sense. There are other heuristics too and I imagine Cloudflare is monitoring movements that point to automation. All of this happens after you click. I personally prefer this over Google’s captcha which frequently doesn’t recognize me as a human but is easily bypassed by bots.
https://blog.cloudflare.com/turnstile-private-captcha-alternative/
TL:DR cloudflare made a new recaptcha which does some complex math and other stuff on your browser, which done once has no noticable effect but if someone were to scrape websites at an absurd speed it slows everything down significantly.
this is not only cool because you don’t have to manually solve the captcha, but also because it allows for low-speed scraping to be feasible, with tools like flaresolverr
Thanks for being the only person in this thread who doesn’t joke or talk out of their ass
Quite interesting really and a genius solution (it they don’t lie about not stealing your data)
Didn’t the Soviets see geniuses and other intellectuals as a danger to society during the time this award was given out? Or are there incidents where this was given to scientists as well? I know you’re probably joking, but when I suddenly encounter Lenin’s head being used in a positive manner I have to look twice.
Didn’t the Soviets see geniuses and other intellectuals as a danger to society
That’s actually kinda cool. Punish the scrapers, but allow regular people to not waste time.
Meanwhile, Google is having you find the zebra crossing for the 400th time…
*training their ai using humans
Oh, so it’s Hashcash; cool to see that idea getting real use.
those will fail anyway on a few sites I’ve gone to. No idea why and sometimes months later it will work for a random interval of time.
The timing of the click captcha loading is randomized and it probably is looking for human-ish cursor movement? (Like you’re probably moving your hand in imperceptibly small ways that are difficult to replicate). Clicking before it loads and doing it repeatedly probably triggers detection.
I used to think it was timing based, but now leaning on the idea that it just performs more fingerprinting in the background: user agent per ip pool, canvas or puppeteer checks.
This is correct. Those captchas are tracking everything they can and comparing it to other results to try and figure this out. Mouse movement, delay before you click, everything.
I’m sorry, but “now”? This has been a thing for at least half a decade. Are you Encino Man? Did you just wake up?
If you don’t know you don’t need to reply.
What’s the purpose of making fun of someone for asking a question to try to learn?
Ha! They must have missed the billboards, front page newspaper articles, TV reports, and public service annou- oh wait.
I have not been in a coma but…
I could possibly be the least aware person you’ve ever had a conversation with, digital or otherwise.
I used to have “weekends” that rotated to different two-day sets every year. One year I got Wednesday and Thursday. I told my wife, “It’s not so bad. At least Thanksgiving falls on a Thursday this year. I checked.” She looked at me and said, “Thanksgiving is on a Thursday every year.” I was over thirty. Had no idea.
She’s a very patient woman.
Maybe this is the first time their bot score was low enough to get through with just a tick.
Others mention the mouse motion, and monitoring your other traffic to similar sites. When it shows the checkbox, it has already determined you are probably human. If you had suspicious activity, they will give you more advanced tests instead of just a checkbox.
