Cloudflare Precursor uses session-long behavioral monitoring to detect bots by studying mouse movement, typing cadence, scrolling, and page activity.
  • massacre@lemmy.worldEnglish
    291·
    6 天前

    1. There’s no way this can be abused. Ever.

    2. There’s no way a bot (AI or human built) could be used to simulate a human.

    This is a perfect solution!

    • GreenCrunch@piefed.blahaj.zoneEnglish
      17·
      6 天前

      my understanding is Google’s recaptcha has been doing this sort of thing forever, tracking mouse movements (as well as browser fingerprinting, IP address, and probably a million other tracking methods) to score a client as more or less likely to be human, and it’s only when it’s suspicious that it escalates to “pick the images that contain x”

      • ToiletFlushShowerScream@piefed.worldEnglish
        25·
        6 天前

        I always thought the pick the images was just an excuse to get training data because it’s never “choose images that contain a bear frolicking in a meadow” it’s always “choose images of motorcycles, busses” or “locate the Abram’s tank hidden in the tree line”.

    • Deebster@infosec.pub
      16·
      7 天前

      It does not capture the actual keys being pressed, according to the company. It studies the timing and rhythm instead.

      That is addressed in the article. Because it’s JavaScript, we can verify this, and I’m sure that people will be scrutinising every revision of the code to check.

      • treadful@lemmy.zipEnglish
        20·
        6 天前

        Because it’s JavaScript, we can verify this, and I’m sure that people will be scrutinising every revision of the code to check.

        Have you ever seen obfuscated JS? I’m not saying it’s impossible, but de-transpiling it into something for a human then analyzing it is not trivial work.

        Don’t bet on something not being terrible just because someone with the skill could maybe spend a lot of time doing the work.

        • canihasaccount@lemmy.world
          61·
          6 天前

          Deobfuscators are fairly good IME. I haven’t checked this code in particular, but I’ve never seen obfuscated JavaScript that was uninterpretable following deobfuscation

          • treadful@lemmy.zipEnglish
            43·
            6 天前

            Congrats on being awesome at code analysis. Have at it for everyone, then.

      • pelespirit@sh.itjust.works
        10·
        7 天前

        But you can tell what a person is typing by their timing and rhythm. I don’t have time right now, but there are articles on that.

        • Deebster@infosec.pub
          10·
          7 天前

          True, people should search for “keystroke timing attacks”. It’s more effective if you include things like accelerometer data and audio.

          We can see what Cloudflare’s code is measuring and reporting to find out if those attacks would be possible.

  • IphtashuFitz@lemmy.worldEnglish
    7·
    6 天前

    Akamai has been doing this for years now. Cloudflare is just playing catch-up. I first saw an Akamai demonstration of this at one of their developer conferences about 10 years ago.

  • Maeve@kbin.earth
    8·
    7 天前

    That may sound preferable to clicking every square containing a traffic light, but it also means Cloudflare is gathering a much broader picture of how visitors behave on a website.

    Traditional bot protection tends to focus on specific moments. A visitor may face a challenge while logging in, creating an account, or completing a purchase. Once that challenge is passed, the rest of the browsing session may receive less attention.

    Edit: a lot of popular Lemmy instances use cloudflare instead of annubis. I’m not sure what this specific instance uses.

    • YoSoySnekBoi@kbin.earth
      6·
      6 天前

      The product in this article (Precursor) is not the same as what Lemmy instances use (Turnstile). Turnstile uses the same cryptographic proof-of-work puzzle as Anubis and does not track any of these other metrics. If you see a CAPTCHA-style “Verified” message with Cloudflare’s logo, you’re seeing Turnstile, not Precursor.

      • Maeve@kbin.earth
        6·
        6 天前

        It’s an enterprise product, for now. I suppose that depends on how deep pockets are.