I have noticed that some CAPTCHA pages, like Cloudflare’s, simply ask you to check a box to proceed. There is no clicking on traffic lights or entering characters. How does clicking on a check box tell them I am not a robot?

  • Czele@lemmy.world
    link
    fedilink
    arrow-up
    45
    ·
    10 months ago

    Its not sure how it exactly works, but most probably this captcha processes a lot of data like your mouse movement, mouse click but also your browser fingerprints, search history and ip. You can actually get ‘traffic lights’ test from this clicking button captacha if You have privacy protection in place, such as using brave, tor, firefox or mullvad browser and/or vpn, pluse some privacy browser extensions

    • ⓝⓞ🅞🅝🅔@lemmy.ca
      link
      fedilink
      arrow-up
      4
      ·
      10 months ago

      I suspected this was the case! Like a silly human, I’ve been intentionally “wiggly” with my mouse movements for this very reason, hoping i don’t have to do a harder form of capthca. Haha. Now I only know I’m only a little crazy for doing so.

      • Cinner@lemmy.worldB
        link
        fedilink
        arrow-up
        5
        arrow-down
        1
        ·
        edit-2
        10 months ago

        And, cloudflare creates a proxy (including it’s own SSL certificate by default!) between you and every cloudflare site. So they’re able to see all data, even on https secured pages.

        And they make up a huge portion of the Internet 😊

        don’t forget about 1.1.1.1, cloudflare’s dns.

  • hperrin@lemmy.world
    link
    fedilink
    arrow-up
    25
    ·
    edit-2
    10 months ago

    You passed the test before you clicked the checkbox. Your mouse movement, momentary pause, IP address, browsing history, etc, gave away that you’re a human.

      • hperrin@lemmy.world
        link
        fedilink
        arrow-up
        15
        arrow-down
        1
        ·
        10 months ago

        Because it measures how your mouse moves to the checkbox. If there was nothing to move to, you wouldn’t move your mouse.

        • Zoot@reddthat.com
          link
          fedilink
          arrow-up
          8
          ·
          10 months ago

          I get the checkbox even on mobile sometimes, I imagine as long as you’re not perfectly hitting the center pixel it knows you’re human.

    • JackGreenEarth@lemm.ee
      link
      fedilink
      English
      arrow-up
      0
      ·
      10 months ago

      I don’t think random websites get access to my browser history without me explicitly giving them permission.

      • hperrin@lemmy.world
        link
        fedilink
        arrow-up
        6
        ·
        edit-2
        10 months ago

        They pretty much do if they’re run through something like Cloudflare or they use Google Analytics. That probably covers about 80% of websites. Not the website, but the company that’s running the Captcha.

        • JackGreenEarth@lemm.ee
          link
          fedilink
          English
          arrow-up
          3
          ·
          10 months ago

          Why do so many websites use cloudflare? Isn’t the Internet meant to be decentralised and resilient? It’s not so resilient if so much is dependent on the servers of one company.

  • cozy_agent@lemmy.world
    link
    fedilink
    arrow-up
    26
    arrow-down
    2
    ·
    10 months ago

    Big part of the internet is going through Cloudflare these days, so it tracks you as you browse, and does something clever to figure out if you’re a robot. Google can do the same, they’ll have a cookie on you. If they’re not sure they’ll show you one of those challenges.

  • key@lemmy.keychat.org
    link
    fedilink
    English
    arrow-up
    17
    ·
    edit-2
    10 months ago

    Rather than try to unilaterally deprecate and replace CAPTCHA with a single alternative, we built a platform to test many alternatives and rotate new challenges in and out as they become more or less effective.

    With Turnstile, we adapt the actual challenge outcome to the individual visitor or browser. First, we run a series of small non-interactive JavaScript challenges gathering more signals about the visitor/browser environment. Those challenges include, proof-of-work, proof-of-space, probing for web APIs, and various other challenges for detecting browser-quirks and human behavior. As a result, we can fine-tune the difficulty of the challenge to the specific request and avoid ever showing a visual puzzle to a user.

    Turnstile also includes machine learning models that detect common features of end visitors who were able to pass a challenge before. The computational hardness of those initial challenges may vary by visitor, but is targeted to run fast.

    https://developers.cloudflare.com/turnstile/

    TL;DR A bunch of heuristics that it’s hard to spoof all of. Fun side effect of this method is that if you spoof your user agent, you’ll often end up locked out in a loop. Lack of a captcha fallback is obnoxious.

  • a4ng3l@lemmy.world
    link
    fedilink
    arrow-up
    12
    ·
    10 months ago

    Given the prevalence of cloudflare they could basically assess the trust level of your ass by cross checking how trusted you are on other services also behind cloudflare. If you aren’t utterly suspicious elsewhere you’re likely not a bad agent.

  • ThisIsNotHim@sopuli.xyz
    link
    fedilink
    English
    arrow-up
    8
    ·
    10 months ago

    I had read (in a comment here, so take with a grain of salt) that some had started doing Proof of Work.

    I.E. they ask the visiting computer to do some math. This is potentially less annoying to people than clicking on traffic lights or typing unreadable text, but could get costly if you’re using bots.

      • RegalPotoo@lemmy.world
        link
        fedilink
        English
        arrow-up
        17
        ·
        10 months ago

        It doesn’t block them exactly, but it’s trying to make it uneconomical to target the site using bots - if it now takes 1 second to perform the action rather than 1/100th of a second, you now need 100x more bots to achieve the same effect

  • DrownedRats@lemmy.world
    link
    fedilink
    arrow-up
    7
    ·
    10 months ago

    Slight tangent, but if you want to pass the “click on all the images with traffic lights” first time, select one that’s obviously wrong then go back and “change your mind” computers don’t do that and 9/10 times it’ll pass you first time!

  • Kissaki@feddit.de
    link
    fedilink
    English
    arrow-up
    6
    ·
    10 months ago

    Cloudflare announced their CAPTCHA replacement Turnstile here in 2023

    They don’t particularly go into the technical details, but announce:

    We don’t rely on tracking user data, like what other websites someone has visited, to determine if a user is a human or robot. Our business is protecting websites, not selling ads, so operators can deploy Turnstile knowing that their users’ data is safe.

    The tracking reference is about Google captchas using logged-in user account and tracking information to gain confidence in a user being a person and not requiring challenges for them.

    Simple CAPTCHA systems give you a challenge to complete, to show you are human. (As the Cloudflare post points out, it’s most of the time easier for bots to solve challenges than it is for humans. But botters still require expertise and solutions.)

    Sophisticated CAPTCHA systems may use any information the web-browser sends them to make a guess on whether the user is human or not, according to probabilistic models. For example the click interaction means you move your cursor, which can be tracked and analyzed against patterns.

  • Zachariah@lemmy.world
    link
    fedilink
    arrow-up
    6
    ·
    10 months ago

    I have two guesses:

    1. Low bar just checks that it gets clicked.
    2. Script on the pages watches mouse movements, etc., and bases its decision on that data.
    • otp@sh.itjust.works
      link
      fedilink
      arrow-up
      5
      ·
      10 months ago

      I’m pretty sure it’s just number 2.

      A program will click the box and hit submit instantly. Or it’d move in a perfectly straight line to either the centre of each or the edge of each and click as quickly as possible.

      Real human movements are not as precise.

  • 🇰 🌀 🇱 🇦 🇳 🇦 🇰 ℹ️@yiffit.net
    link
    fedilink
    English
    arrow-up
    3
    ·
    10 months ago

    How you move or type is one reason. I only ever get challenge things when I am using remote desktop which recently changed how keyboard input is sent. Instead of going each key like it was being typed on the actual machine, it sends a whole line of text at once. Doing this tends to trigger the automation detection and challenges you with the “find all the traffic lights” bullshit.

  • stoy@lemmy.zip
    link
    fedilink
    arrow-up
    3
    ·
    10 months ago

    I remember a talk about this I watched on YT about this, but I can’t find it now.

    But the way it was described to work was that it looked at how you interacted with the page, how you mouse pointer moved, if it moves too straight between interactive points, how randomly it moves, if you are entering text in a field, how slow are you and do you make mistakes, how do you correct those?

    Then when you click the tickbox it decides based on all those factors if you are human or if you are a bot.

    Those captcha checks on a blank page are probably checking mouse movements, IP, User Agent and more stuff like that to determine it more checks are needed, though it might even be a fake captcha to act like a loading screen

  • Fake4000@lemmy.world
    link
    fedilink
    English
    arrow-up
    2
    ·
    10 months ago

    Captchas without a visible challenge use behavioral analysis to differentiate between human users and bots by monitoring mouse movements, keyboard inputs, and other behaviors.