my understanding is Google's recaptcha has been doing this sort of thing forever, tracking mouse movements (as well as browser fingerprinting, IP address, and probably a million other tracking methods) to score a client as more or less likely to be human, and it's only when it's suspicious that it escalates to "pick the images that contain x"
I always thought the pick the images was just an excuse to get training data because it’s never “choose images that contain a bear frolicking in a meadow” it’s always “choose images of motorcycles, busses” or “locate the Abram’s tank hidden in the tree line”.
It does not capture the actual keys being pressed, according to the company. It studies the timing and rhythm instead.
That is addressed in the article. Because it's JavaScript, we can verify this, and I'm sure that people will be scrutinising every revision of the code to check.
Because it’s JavaScript, we can verify this, and I’m sure that people will be scrutinising every revision of the code to check.
Have you ever seen obfuscated JS? I'm not saying it's impossible, but de-transpiling it into something for a human then analyzing it is not trivial work.
Don't bet on something not being terrible just because someone with the skill could maybe spend a lot of time doing the work.
Deobfuscators are fairly good IME. I haven't checked this code in particular, but I've never seen obfuscated JavaScript that was uninterpretable following deobfuscation
That may sound preferable to clicking every square containing a traffic light, but it also means Cloudflare is gathering a much broader picture of how visitors behave on a website.
Traditional bot protection tends to focus on specific moments. A visitor may face a challenge while logging in, creating an account, or completing a purchase. Once that challenge is passed, the rest of the browsing session may receive less attention.
Edit: a lot of popular Lemmy instances use cloudflare instead of annubis. I'm not sure what this specific instance uses.
The product in this article (Precursor) is not the same as what Lemmy instances use (Turnstile). Turnstile uses the same cryptographic proof-of-work puzzle as Anubis and does not track any of these other metrics. If you see a CAPTCHA-style "Verified" message with Cloudflare's logo, you're seeing Turnstile, not Precursor.
Akamai has been doing this for years now. Cloudflare is just playing catch-up. I first saw an Akamai demonstration of this at one of their developer conferences about 10 years ago.
31 Comments
massacre@lemmy.world · 27 pts · 22d
There's no way this can be abused. Ever.
There's no way a bot (AI or human built) could be used to simulate a human.
This is a perfect solution!
DarkCloud@lemmy.world · 21 pts · 22d
This has always been the way captchas work, I guess they're expanding it to be always-on.
GreenCrunch@piefed.blahaj.zone · 16 pts · 22d
my understanding is Google's recaptcha has been doing this sort of thing forever, tracking mouse movements (as well as browser fingerprinting, IP address, and probably a million other tracking methods) to score a client as more or less likely to be human, and it's only when it's suspicious that it escalates to "pick the images that contain x"
ToiletFlushShowerScream@piefed.world · 23 pts · 22d
I always thought the pick the images was just an excuse to get training data because it’s never “choose images that contain a bear frolicking in a meadow” it’s always “choose images of motorcycles, busses” or “locate the Abram’s tank hidden in the tree line”.
Redkey@programming.dev · 15 pts · 22d
This made me laugh out loud.
"Click or tap on all pictures of ARMED INSURGENTS TAKING COVER IN RUINED BUILDINGS until no more are left."
SavinDWhales@lemmy.world · 4 pts · 22d
"follow the man with your mouse cursor until the light flashes" will be the next step in crowd sourcing for the army...
Beacon@fedia.io · 4 pts · 22d
Por que no los dos?
NotMyOldRedditName@lemmy.world · 1 pts · 22d
They do that as well, but its so annoying they probably just hold it back unless extra verification is needed.
pelespirit@sh.itjust.works · 16 pts · 22d
...and probably can tell what you're typing.
Deebster@infosec.pub · 16 pts · 22d
That is addressed in the article. Because it's JavaScript, we can verify this, and I'm sure that people will be scrutinising every revision of the code to check.
treadful@lemmy.zip · 19 pts · 22d
Have you ever seen obfuscated JS? I'm not saying it's impossible, but de-transpiling it into something for a human then analyzing it is not trivial work.
Don't bet on something not being terrible just because someone with the skill could maybe spend a lot of time doing the work.
canihasaccount@lemmy.world · 5 pts · 22d
Deobfuscators are fairly good IME. I haven't checked this code in particular, but I've never seen obfuscated JavaScript that was uninterpretable following deobfuscation
treadful@lemmy.zip · 0 pts · 22d
Congrats on being awesome at code analysis. Have at it for everyone, then.
pelespirit@sh.itjust.works · 10 pts · 22d
But you can tell what a person is typing by their timing and rhythm. I don't have time right now, but there are articles on that.
Deebster@infosec.pub · 10 pts · 22d
True, people should search for "keystroke timing attacks". It's more effective if you include things like accelerometer data and audio.
We can see what Cloudflare's code is measuring and reporting to find out if those attacks would be possible.
Maeve@kbin.earth · 8 pts · 22d
Edit: a lot of popular Lemmy instances use cloudflare instead of annubis. I'm not sure what this specific instance uses.
YoSoySnekBoi@kbin.earth · 5 pts · 22d
The product in this article (Precursor) is not the same as what Lemmy instances use (Turnstile). Turnstile uses the same cryptographic proof-of-work puzzle as Anubis and does not track any of these other metrics. If you see a CAPTCHA-style "Verified" message with Cloudflare's logo, you're seeing Turnstile, not Precursor.
Maeve@kbin.earth · 6 pts · 22d
It's an enterprise product, for now. I suppose that depends on how deep pockets are.
Deebster@infosec.pub · 8 pts · 22d
Cloudflare's blog post about it has more information about how it works.
who@feddit.org · 6 pts · 22d
Indeed. It's linked in the third sentence of the article.
Maerman@lemmy.world · 8 pts · 22d
Well, that's terrifying.
BloodMuffin@lemmy.ca · 8 pts · 22d
AntiBullyRanger@ani.social · 7 pts · 22d
Several. Good luck enforcing your bank, doctor, rail operator, canteen, etc. to use it.
bridgeenjoyer@sh.itjust.works · 6 pts · 22d
Gopher, Gemini protocol, Usenet. Get on it!
BloodMuffin@lemmy.ca · 2 pts · 22d
bridgeenjoyer@sh.itjust.works · 1 pts · 21d
Buran is a good browser for mobile. Theres a bunch for Linux, Lagrange works well.
IphtashuFitz@lemmy.world · 6 pts · 22d
Akamai has been doing this for years now. Cloudflare is just playing catch-up. I first saw an Akamai demonstration of this at one of their developer conferences about 10 years ago.
VitoRobles@lemmy.today · 3 pts · 22d
Yeah I thought that was common knowledge?
damnthefilibuster@lemmy.world · 5 pts · 22d
Great! Can it work over VPN?
onipa@feddit.org · 2 pts · 18d
Unfortunately, yes.
damnthefilibuster@lemmy.world · 1 pts · 18d
No but that’s good! Their current implementation is shit and doesn’t work over VPN!
Marija_@programming.dev · 2 pts · 16d
Mouse movements shouldn't become another fingerprint.
AntiBullyRanger@ani.social · -4 pts · 22d