Cloudflare Turnstile

submitted by neolib from (self.technology)

So apparently this "verify you are human" bullshit is not CAPTCHA, but something called Cloudflare Turnstile (see https://www.cloudflare.com/products/turnstile/ ):

Cloudflare Turnstile is a free tool to replace CAPTCHAs

Turnstile delivers frustration-free, CAPTCHA-free web experiences to website visitors - with just a simple snippet of free code. Moreover, Turnstile stops abuse and confirms visitors are real without the data privacy concerns or awful user experience of CAPTCHAs.

Some interesting quotes from a post I just saw on HN:

For Turnstile, the actual act of checking a box isn’t important, it’s the background data we’re analyzing while the box is checked that matters. We find and stop bots by running a series of in-browser tests, checking browser characteristics, native browser APIs, and asking the browser to pass lightweight tests (ex: proof-of-work tests, proof-of-space tests) to prove that it’s an actual browser.

...

Second, we find that a few privacy-focused users often ask their browsers to go beyond standard practices to preserve their anonymity. This includes changing their user-agent (something bots will do to evade detection as well), and preventing third-party scripts from executing entirely.

https://blog.cloudflare.com/turnstile-ga/

HN discussion: https://news.ycombinator.com/item?id=37799413

all 3 comments
sorted by:
top
newinsightfulfun

[–]cant_even 3 insightful - 1 fun3 insightful - 0 fun4 insightful - 1 fun -  (0 children)

So we're at fault for blocking their malicious javascripts and deceiving their spyware "standard practices".

Got it.

[–]xoenix 1 insightful - 1 fun1 insightful - 0 fun2 insightful - 1 fun -  (0 children)

Makes sense, bots are getting better at captchas than humans.

[–]SoCo 1 insightful - 1 fun1 insightful - 0 fun2 insightful - 1 fun -  (0 children)

It's just softball terms for heavy duty, extremely invasive, browser fingerprinting. Since it fails so many times repeatedly, and requires completely disabling most security to access....I'm guessing the things they said are nonsense and it doesn't allow you in unless you are completely de-anonymized.