How do CAPTCHAs work without giving you a challenge task?

Submitted ⁨⁨8⁩ ⁨months⁩ ago⁩ by ⁨nodsocket@lemmy.world⁩ to ⁨[deleted]⁩

I have noticed that some CAPTCHA pages, like Cloudflare’s, simply ask you to check a box to proceed. There is no clicking on traffic lights or entering characters. How does clicking on a check box tell them I am not a robot?

source

Comments

Sort:hotnew top

hperrin@lemmy.world ⁨8⁩ ⁨months⁩ ago
You passed the test before you clicked the checkbox. Your mouse movement and momentary pause gave away that you’re a human.

source
Czele@lemmy.world ⁨8⁩ ⁨months⁩ ago
Its not sure how it exactly works, but most probably this captcha processes a lot of data like your mouse movement, mouse click but also your browser fingerprints, search history and ip. You can actually get ‘traffic lights’ test from this clicking button captacha if You have privacy protection in place, such as using brave, tor, firefox or mullvad browser and/or vpn, pluse some privacy browser extensions

source
key@lemmy.keychat.org ⁨8⁩ ⁨months⁩ ago

Rather than try to unilaterally deprecate and replace CAPTCHA with a single alternative, we built a platform to test many alternatives and rotate new challenges in and out as they become more or less effective.

With Turnstile, we adapt the actual challenge outcome to the individual visitor or browser. First, we run a series of small non-interactive JavaScript challenges gathering more signals about the visitor/browser environment. Those challenges include, proof-of-work, proof-of-space, probing for web APIs, and various other challenges for detecting browser-quirks and human behavior. As a result, we can fine-tune the difficulty of the challenge to the specific request and avoid ever showing a visual puzzle to a user.

Turnstile also includes machine learning models that detect common features of end visitors who were able to pass a challenge before. The computational hardness of those initial challenges may vary by visitor, but is targeted to run fast.

developers.cloudflare.com/turnstile/

TL;DR A bunch of heuristics that are hard to spoof. Fun side effect of this method is that if you spoof your user agent, you’ll often end up locked out in a loop. Lack of a captcha fallback is obnoxious.

source
- originalucifer@moist.catsweat.com ⁨8⁩ ⁨months⁩ ago
  also the subtle but not so subtle 'we will fingerprint errrrbody'
  
  so what do they do with that data?
  
  source
- leaky_shower_thought@feddit.nl ⁨8⁩ ⁨months⁩ ago
  in my experience, you can sometimes get away messing a token or two in the user string as long as it is one of the common ones out there. start injecting BeOS and other arcane values in and things get less reliable.
  
  source
DrownedRats@lemmy.world ⁨8⁩ ⁨months⁩ ago
Slight tangent, but if you want to pass the “click on all the images with traffic lights” first time, select one that’s obviously wrong then go back and “change your mind” computers don’t do that and 9/10 times it’ll pass you first time!

source
- THE_MASTERMIND@lemmy.today ⁨8⁩ ⁨months⁩ ago
  If this works you are the king of LPT.also i click a column and then unclick it right ?
  
  source
  - DrownedRats@lemmy.world ⁨8⁩ ⁨months⁩ ago
    I just click one square thats wrong then unclick it. Seems to work almost every time!
    
    source
    -> View More Comments
Kolanaki@yiffit.net ⁨8⁩ ⁨months⁩ ago
How you move or type is one reason. I only ever get challenge things when I am using remote desktop which recently changed how keyboard input is sent. Instead of going each key like it was being typed on the actual machine, it sends a whole line of text at once. Doing this tends to trigger the automation detection and challenges you with the “find all the traffic lights” bullshit.

source
Fake4000@lemmy.world ⁨8⁩ ⁨months⁩ ago
Captchas without a visible challenge use behavioral analysis to differentiate between human users and bots by monitoring mouse movements, keyboard inputs, and other behaviors.

source