How do CAPTCHAs work without giving you a challenge task?
How do CAPTCHAs work without giving you a challenge task?
I have noticed that some CAPTCHA pages, like Cloudflare's, simply ask you to check a box to proceed. There is no clicking on traffic lights or entering characters. How does clicking on a check box tell them I am not a robot?
You're viewing a single thread.
Rather than try to unilaterally deprecate and replace CAPTCHA with a single alternative, we built a platform to test many alternatives and rotate new challenges in and out as they become more or less effective.
With Turnstile, we adapt the actual challenge outcome to the individual visitor or browser. First, we run a series of small non-interactive JavaScript challenges gathering more signals about the visitor/browser environment. Those challenges include, proof-of-work, proof-of-space, probing for web APIs, and various other challenges for detecting browser-quirks and human behavior. As a result, we can fine-tune the difficulty of the challenge to the specific request and avoid ever showing a visual puzzle to a user.
Turnstile also includes machine learning models that detect common features of end visitors who were able to pass a challenge before. The computational hardness of those initial challenges may vary by visitor, but is targeted to run fast.
https://developers.cloudflare.com/turnstile/
TL;DR A bunch of heuristics that it's hard to spoof all of. Fun side effect of this method is that if you spoof your user agent, you'll often end up locked out in a loop. Lack of a captcha fallback is obnoxious.
Incognito / ublock and vpn will often trigger a loop of captcha
I have been stuck in one its hell you will be hoping this will be the last.
I got stuck in one and couldn't even search for help because each result where people were complaining about it had a captcha preventing me from entering.
also the subtle but not so subtle 'we will fingerprint errrrbody'
so what do they do with that data?
Sell it to all the bidders.
in my experience, you can sometimes get away messing a token or two in the user string as long as it is one of the common ones out there. start injecting BeOS and other arcane values in and things get less reliable.