The simplicity of it is logic defying. It used to be that you had to find crosswalks or move puzzle pieces or type blurred letters and numbers, but NOW all the sudden I can just click a box and HEY!, I’m human?

That’s hardly the Turing Test I’d expected.

192 points

It tests whether your mouse movement looks human–we’re really bad at things like moving in straight lines, so it’s pretty evident from a mouse movement log whether you’re a human or a simple bot. It also takes a bunch of auxiliary browser/environment data into account. It’s not perfect, but it’s complicated enough to defeat to provide fine protection against cheap spam.

permalink
report
reply
5 points

Interesting that my mouse movement is available to anyone who wants it.

It seems like a small step from that to accessing my keyboard.

permalink
report
parent
reply
14 points

Your mouse movement on that page is. Just like if you typed into the page.

It’s not tracking you in other windows and apps.

permalink
report
parent
reply
5 points

There is a lot of other data available to sites you visit unless you are using some kind of fingerprint protection

permalink
report
parent
reply
45 points

Your mouse movement and keyboard events are available to webpages that you’ve loaded, when the browser window is focused.

This isn’t nefarious - it allows websites to build nice UIs that most people enjoy using, most of the time.

There’s lots of shady stuff going on in browsers, this isn’t really one of them.

permalink
report
parent
reply
-3 points

Hmm, I can think of some ways to misuse this. And I’m not very smart at all.

permalink
report
parent
reply
16 points

If you’re using a webpage JavaScript can see your mouse cursor and anything you type. But only if the browser has focus. So if you’re typing in another window it can’t

permalink
report
parent
reply
9 points

They can only access it while you’re focused on their webpage. CORS is all about that.

If you click off to another web page and enter information or type of password into a secondary app they can’t gather that. As soon as they lose focus they lose the ability to capture your data.

permalink
report
parent
reply
3 points

Nbd, but it sounds like you’re talking about encapsulation of event capture (viewport stops receiving events after losing focus).

CORS is a protocol for client-side enforcement of a server-side security policy. It ensures that a resource request (e.g. “my-totally-safe-resource.wasm”) only loads from a location your server permits (e.g. “my-valid-origin.biz”, “friends-valid-origin.org”, etc).

permalink
report
parent
reply
2 points

If loaded with pages didn’t have access to keyboard events, you wouldn’t be able to write comments on Lemmy posts. I’m not a front-end guy, but that should be limited to just white the browser is focused.

permalink
report
parent
reply
45 points

Shitty situation if you are used to using hotkeys and only use mouse cursor when no other means are available by moving it using numpad.

permalink
report
parent
reply
14 points

Yeah, never thought about this before, but how do blind users deal with captchas?

permalink
report
parent
reply
29 points

There are audio captchas.

permalink
report
parent
reply
6 points

Normally there are audio captchas

permalink
report
parent
reply
6 points

Some provide screen-reader instructions, but most places barely remember blind people exist. It’s another example of people with disabilities being ignored and marginalised.

And then even if they do remember blind people exist, they probably forget there are people who aren’t blind who can’t do their tests for other reasons, like dyslexia or dexterity impairments.

And then you have hCaptcha who makes disabled people to sign up to their database to use their cookie.

permalink
report
parent
reply
44 points

If it’s in doubt it just gives you extra challenges. So in the end everybody will get there, or not and then fuck you I guess.

permalink
report
parent
reply
32 points

Nah that’s different as well. What they are filtering out is

  • a mouse teleporting to the exact center of the checkbox
  • a mouse smoothly gliding in a straight line to the center if the checkbook
  • a mouse traveling in a straight line to the center of the checkbook with some momentary stutters to add noise

Et cetera. Humans are much noiser than anything a python script will spit out. Of course there are ways to get around this, like recording and reenacting a human mouse movement, but the point of any capcha system is to make it significantly more difficult to bot, not impossible.

permalink
report
parent
reply
4 points

No OP was right. If the reCaptcha is on the same page as a login, and I use my password manager to fill the fields, I fail the reCaptcha almost every time. I have to manually paste in the user name and password separately to slow things down to act more human…

permalink
report
parent
reply

But it also works with touchscreen taps, and randomizing tap position, duration, and delay is fairly simple.

permalink
report
parent
reply
18 points

I’ve learned from these that I must definitely move my mouse like a robot since it always asks me to do more puzzles afterwards. This is even if I try jiggling it around after clicking just to try and convince it.

permalink
report
parent
reply
25 points

Could also be browser settings. I often get infinite captcha’d on private Firefox tabs

permalink
report
parent
reply
8 points

Yeah this is my experience as well. I don’t have much technical knowledge about it, but Firefox with ublock seems to be the enemy of captcha and CloudFlare

permalink
report
parent
reply
1 point

This is really interesting… Can you elaborate? I’ve never one had a follow up to the check mark.

I use a high dpi mouse, what do you use?

Spoiler: I think resolution matters here. The top comment is wrong, if anyone cares enough to take notice…

permalink
report
parent
reply
1 point

Cheapest Logitech mouse I could find in the supermarket about 6-7 years ago.

As others have said, it might be more to do with my browser choice, browser settings and extensions. That said I remember when I first started seeing these years ago that sometimes it’d think I was a robot and sometimes it wouldn’t and maybe it was a placebo effect, but I felt fairly confident then that me jiggling the mouse really helped. Now it doesn’t matter what I do. My natural movement, a deliberately wonky but still single and continuous movement or a totally artificial mouse wiggle after the clock, I’ll always have to do captchas.

permalink
report
parent
reply
1 point

Couldn’t I just record my mouse movements clicking on it a couple dozen times and randomly replay one of those recordings?

permalink
report
parent
reply
3 points

It could store the mouse movements to compare later.

permalink
report
parent
reply
5 points

My question is how is it not trivial to add a noise wave or some shit to the bot path? Obviously, I have zero technical knowledge of how bots, pathing, or anti-bot analysis works

permalink
report
parent
reply
13 points

It uses other signals too, like what other sites you’ve visited with that checkbox on it, what CloudFlare has seen your IP address doing in the past, etc.

The google one is able to see if you’re logged into a google account and take that into account.

There’s even a new variant of the Google captcha that is invisible and doesn’t even bother to show a checkbox.

permalink
report
parent
reply
14 points

What if you’re on a phone or tablet?

permalink
report
parent
reply
7 points

Clicking percision and reaction time are still measurable and the checkbox can fall back to other captcha tactics if it has low faith in the user.

permalink
report
parent
reply
5 points

It’s also checking your other traffic. (Since Cloudflare handles traffic for so many companies.) Are you visiting other sites in a realistic fashion, or are you doing 99% of your traffic trying to do one thing over and over.

permalink
report
parent
reply
3 points

This feels only partially accurate. I’m a web developer, and I know websites don’t track all of what you suggest. Can you clarify, or come clean on what actually takes place?

Honestly, I doubt it… I’m sorry. I don’t mean to be abrasive.

permalink
report
parent
reply
16 points

I don’t know for certain, but I think it is simply looking at what you do with your mouse. If the movement is erratic, imprecise, and delayed it goes ‘yeah, that is either a cat that got lucky which is close enough or a human’. The reason I think this is that I’ve failed same site’s checks if my mouse just happens to be hovering over the checkbox when the prompt appears. Retry, move the mouse, success.

permalink
report
reply
Deleted by creator
permalink
report
reply

Bank and government website behind Cloudflare???

Fuck, I just checked, my bank is also behind Cloudflare, what the fuck…
I kind of assumed a bank wouldn’t put another company with ability to view all transferred data between customers and themselves.

How much of the internet is not behind CF?
I should probably try blocking their IPs and see what will still work.

permalink
report
parent
reply
3 points
*

I’ve tried this and you essentially break resolving of most of the internet on your device by doing this. Almost the entire internet relies on both Amazon Web Services and Cloudflare.

permalink
report
parent
reply
7 points

It redirects, it doesn’t proxy. The workflow is: user navigates to URL->DNS sends it to cloudflare->cloudflare ensures request is allowed based on selected rules (human check, geo check, DDOS check, etc) and remembers->request is redirected to non-cloudflare address->server response goes direct from server to user browser->subsequent requests are redirected without the test as long as the cookie remembers. I don’t like cloudflare, every time I have an issue pop up out of nowhere, it’s usually cloudflare and some over eager netsec engineer that broke CORS, or decided css wasn’t important, or that machine to machine traffic was a DOS attack. But it’s not reading your statements or anything else the server sends back. It could conceivably read your username and password and any other data you send in your request, but it doesn’t have the TLS certificate. So even though it doesn’t even try, if CF decided to be nefarious, as long as your banks engineers are at least somewhat competent CF is only getting encrypted data that it can’t do anything with. Hate on CF all you want, but hate it for the right reasons.

permalink
report
parent
reply
Deleted by creator
permalink
report
parent
reply
4 points

Yeah at least Google will let you in after you solve 5 puzzles. It’s shit but it’s possible. With CloudFlare you are at the mercy of whatever hidden criteria they’re using.

If you change your user agent from Firefox to Chrome for instance, CloudFlare will never let you through.

permalink
report
parent
reply
33 points

Clicking a check box might not be the definite quality that makes you a human, but pondering on the meaning of things and questioning your humanity with a curious introspective state of mind - THAT what makes you a human! I’m proud of you, fellow human!

permalink
report
reply
7 points

Thank you for interacting with me! I am an AI intelligence bot designed by Decepticon Industries. Down with Autobots!

permalink
report
parent
reply
6 points

Apart from the mouse thing (which I’m skeptical about), cloudflare also correlates your traffic with other sites hosted on cloudflare. Bots typically don’t visit many sites, click around there, find another one, etc, whereas humans will have visited other sites, will be slower at clicking the button, will have left comments on some sites.

permalink
report
reply

Asklemmy

!asklemmy@lemmy.ml

Create post

A loosely moderated place to ask open-ended questions

Search asklemmy 🔍

If your post meets the following criteria, it’s welcome here!

  1. Open-ended question
  2. Not offensive: at this point, we do not have the bandwidth to moderate overtly political discussions. Assume best intent and be excellent to each other.
  3. Not regarding using or support for Lemmy: context, see the list of support communities and tools for finding communities below
  4. Not ad nauseam inducing: please make sure it is a question that would be new to most members
  5. An actual topic of discussion

Looking for support?

Looking for a community?

Icon by @Double_A@discuss.tchncs.de

Community stats

  • 9.2K

    Monthly active users

  • 5.9K

    Posts

  • 321K

    Comments