What about clicking a checkbox means I'm human? How does Cloudflare determine I'm human from that?

These type of “captchas” look at your browsing behavior. It is sort of a “trade secret” of what it looks for, but it might be screen resolution, mouse behavior, cookies, OS, time to click, etc. Anything a website has access to that would look different from a bot.

Cloudflare knows almost everything done from your IP address because they're used by the majority of websites. And some websites are using a cloudflare signed TLS certificate so if cloudflare wants, can see the content of the communication instead of an encrypted package

So they know if you have a human behavior (visiting many different websites at human speed and having rests during sleeping time) or if you have a bot behavior (sending millions of requests to the same endpoint at superhuman speeds)

https://blog.cloudflare.com/turnstile-private-captcha-alternative/

TL:DR cloudflare made a new recaptcha which does some complex math and other stuff on your browser, which done once has no noticable effect but if someone were to scrape websites at an absurd speed it slows everything down significantly.

this is not only cool because you don't have to manually solve the captcha, but also because it allows for low-speed scraping to be feasible, with tools like flaresolverr

It tests whether your mouse movement looks human--we're really bad at things like moving in straight lines, so it's pretty evident from a mouse movement log whether you're a human or a simple bot. It also takes a bunch of auxiliary browser/environment data into account. It's not perfect, but it's complicated enough to defeat to provide fine protection against cheap spam.

it also sees your mouse movements on your way to that box.

Theres a few answrs to this

1. It uses your movements before this to determine whether it feels like your a bot or not
2. It makes you wait, the biggest issue with bots is they may try to log in say 50 different passwords for example, so if it takes 5 seconds to do each one it makes boting multiple acounts not worth it.
3. Google uses catchphas with images to choose. They use this to train their own AI or data to sell

Cloudflare has a bot score. Depending on how sus your bot score is you can use several different levels of verification. The checkbox you refer to is kind of in the middle. There is also a more complicated intrusive captcha and a totally transparent javascript. It’s a pretty slick system.

I'm pretty sure I'm a robot since they often force me to select the motorcycle from a picture that is just one motor cycle. If I select every part of it I fail every time. Same thing with street lights and fire plugs.

Beats me. I have a script that clicks all those boxes for me.

Proof of work, which becomes computationally expensive to scale, along with other heuristics based on your browser and page interaction. I believe it's less about clicking the box and what happens after you've clicked the box.

I'm sorry, but "now"? This has been a thing for at least half a decade. Are you Encino Man? Did you just wake up?

I always fail Cloudflare captchas because I'm clicking it with Vimium-C lol. I hate captchas for making me reach for my mouse. It also seems like a genuine accessibility issue if people who cannot use a mouse can't pass a captcha.

I've found that Google's reCAPTCHA has also started rejecting me no matter what I do. I think it might be because my IP address is a VPN, but that's pretty stupid; if I can pass the test by clicking the squares why not let me in?

Others mention the mouse motion, and monitoring your other traffic to similar sites. When it shows the checkbox, it has already determined you are probably human. If you had suspicious activity, they will give you more advanced tests instead of just a checkbox.

I've been told that it's analyzing your behavior from right before you click the button

Humans have mouse movement that, on August 8, 2024, are very hard to reproduce. But just like regular captchas we are just teaching computers to do the same thing.

Clicking a check box might not be the definite quality that makes you a human, but pondering on the meaning of things and questioning your humanity with a curious introspective state of mind - THAT what makes you a human! I'm proud of you, fellow human!

The best is when it fails to verify, offers no backup option, and you're simply blocked from accessing your own bank account or government website. Fuck cloudflare

The timing of the click captcha loading is randomized and it probably is looking for human-ish cursor movement? (Like you're probably moving your hand in imperceptibly small ways that are difficult to replicate). Clicking before it loads and doing it repeatedly probably triggers detection.

Clicking the button doesn't proof that you are a human. All the checks happen way before you even click the button (or sometimes even before visiting the website). Google also offers a similar button for their users and since cloudflare is also used on almost any website, they have a lot of data about you. They check your cookies, browser agent, device, settings, your IP address, if you use a VPN or proxy, etc. If you visited other cloudflare websites in the past with the same device or IP, and so on. So they know you and your device way before you even click the button. This is also the reason why you sometimes see a robot arm (made of Lego) clicking the button, and is still recognized as human. But as soon as you use a different IP address or a VPN (or even use a shared IP address, like in your company's network) you have to solve CAPTCHAs. Of course they also check mouse movement, but this is only one part of many checks.

I don't know for certain, but I think it is simply looking at what you do with your mouse. If the movement is erratic, imprecise, and delayed it goes 'yeah, that is either a cat that got lucky which is close enough or a human'. The reason I think this is that I've failed same site's checks if my mouse just happens to be hovering over the checkbox when the prompt appears. Retry, move the mouse, success.

Basically bots would automatically click on it, teleporting the cursor to the very center of the button. They will do this within exact milliseconds of the page loading.

Humans read something on the site, then find the banner, and move the cursor over to it, confirm that the cursor is somewhere on the button, and then click it.

It's not just the button, it's the before the button that determines you're a bot or not.

I think it's monitoring your mouse inputs somehow to determine if you're a person

01100011 01101100 01101111 01110101 01100100 01100110 01101100 01100001 01110010 01100101 00100000 01110000 01110101 01110100 01110011 00100000 01101101 01100101 00100000 01101001 01101110 00100000 01100001 01101110 00100000 01101001 01101110 01100110 01101001 01101110 01101001 01110100 01100101 00100000 01101100 01101111 01101111 01110000 00100000 01110011 01101111 01101101 01100101 01110100 01101001 01101101 01100101 01110011

This all humans will be good for in the future, until they atrophy and become a mere appendage of machinegod.

It's actually detecting you using emotion and aging. That's the real test...

A side to this is that certain techniques will be deliberately obfuscated or simply omitted as a security measure in the hopes of slowing a bad actor’s eventual bypassing of the measure. It’s an arms race and if the intruder doesn’t know what all the locks even are, it takes longer to break or pick them.

Apart from the mouse thing (which I'm skeptical about), cloudflare also correlates your traffic with other sites hosted on cloudflare. Bots typically don't visit many sites, click around there, find another one, etc, whereas humans will have visited other sites, will be slower at clicking the button, will have left comments on some sites.

I guess Bots started figuring out the previous puzzles.

I don’t know about Cloudflare, but I work with Akamai tools for my employer, and they do a lot of similar stuff. I saw an Akamai demo a few years ago that demonstrated some of their bot detection algorithms. One part that I clearly recall is how in some cases they’ll use JavaScript to capture mouse movements, then analyze what is captured.

Try drawing a perfectly straight line on your computer with a mouse, especially at the speed you typically move it. It’s virtually impossible. It may look fairly straight but there are bound to be even subtle changes along its length.

Now think about having a computer trying to simulate that same movement. It’s extremely difficult. Many bots simply won’t respond to that JavaScript API that’s used to catch the mouse draw events. Those that do are likely to simulate movement poorly. You’ll likely see a line that consists of a single perfectly straight line or a series of shorter perfectly straight lines stitched together in an attempt to simulate the randomness of a person moving the mouse.

If you can visualize it then it becomes obvious fairly quickly when a series of mouse movements has been captured from a human vs. from a bot. It’s just a matter of developing an algorithm to properly classify them.

some of them are also less bot detection and more spam limiting and mitigation. cloudflare's has more stuff built in I'm sure, but things like mCapcha are just proof of work, so if you're trying to make a bunch of accounts or whatever, it's really computationally expensive.

those will fail anyway on a few sites I've gone to. No idea why and sometimes months later it will work for a random interval of time.

By clicking the box you agree to the terms and conditions which gives them permission to use all the data they have about you to decide whether you're human. That and mouse movement probably.