I have noticed that some CAPTCHA pages, like Cloudflare’s, simply ask you to check a box to proceed. There is no clicking on traffic lights or entering characters. How does clicking on a check box tell them I am not a robot?
I have two guesses:
- Low bar just checks that it gets clicked.
- Script on the pages watches mouse movements, etc., and bases its decision on that data.
I’m pretty sure it’s just number 2.
A program will click the box and hit submit instantly. Or it’d move in a perfectly straight line to either the centre of each or the edge of each and click as quickly as possible.
Real human movements are not as precise.
Remember, it’s not about filtering out robots, it’s about filtering out dangerous (as in spam, malware, etc.) things.
I mean, If you’re reeeeeeally good and reeeeeeally precise and reeeeally fast … then maybe you’re as dangerous as the robot. Maybe it’s just safer to keep you out. 🙃
Big part of the internet is going through Cloudflare these days, so it tracks you as you browse, and does something clever to figure out if you’re a robot. Google can do the same, they’ll have a cookie on you. If they’re not sure they’ll show you one of those challenges.
Captchas without a visible challenge use behavioral analysis to differentiate between human users and bots by monitoring mouse movements, keyboard inputs, and other behaviors.
Rather than try to unilaterally deprecate and replace CAPTCHA with a single alternative, we built a platform to test many alternatives and rotate new challenges in and out as they become more or less effective.
With Turnstile, we adapt the actual challenge outcome to the individual visitor or browser. First, we run a series of small non-interactive JavaScript challenges gathering more signals about the visitor/browser environment. Those challenges include, proof-of-work, proof-of-space, probing for web APIs, and various other challenges for detecting browser-quirks and human behavior. As a result, we can fine-tune the difficulty of the challenge to the specific request and avoid ever showing a visual puzzle to a user.
Turnstile also includes machine learning models that detect common features of end visitors who were able to pass a challenge before. The computational hardness of those initial challenges may vary by visitor, but is targeted to run fast.
https://developers.cloudflare.com/turnstile/
TL;DR A bunch of heuristics that it’s hard to spoof all of. Fun side effect of this method is that if you spoof your user agent, you’ll often end up locked out in a loop. Lack of a captcha fallback is obnoxious.
also the subtle but not so subtle ‘we will fingerprint errrrbody’
so what do they do with that data?
I have been stuck in one its hell you will be hoping this will be the last.
In non technical terms, some operating systems (eg iOS) will vouch that you are human. Which bypasses the need to click on things.
See https://support.apple.com/en-gb/guide/iphone/iph4f43a30c9/ios for details of how to turn it off
