What about clicking a checkbox means I'm human? How does Cloudflare determine I'm human from that?
The simplicity of it is logic defying. It used to be that you had to find crosswalks or move puzzle pieces or type blurred letters and numbers, but NOW all the sudden I can just click a box and HEY!, I’m human? That’s hardly the Turing Test I’d expected.
Interesting that my mouse movement is available to anyone who wants it.
It seems like a small step from that to accessing my keyboard.
Your mouse movement on that page is. Just like if you typed into the page.
It’s not tracking you in other windows and apps.
Your mouse movement and keyboard events are available to webpages that you’ve loaded, when the browser window is focused.
This isn’t nefarious - it allows websites to build nice UIs that most people enjoy using, most of the time.
There’s lots of shady stuff going on in browsers, this isn’t really one of them.
Like those sites that ask me to sign in using Google (or other options) and then Google asks me for the password?
Pretty easy to grab passwords I think.
To clarify, websites can’t capture keyboard events that were typed into a different website like you’re thinking. Think of going to a web game that let’s you use WASD for controlling your character. It’s able to capture those events on that page because its in focus. When a site goes out of focus (such as switching tabs or switching to another window that’s not the browser), it loses that ability. Overall, it’s very secure.
I was more wondering how you thought capturing the mouse movements would lead to security issues.
This was the slap on the head I needed. I now get what you mean by interact with my keyboard. In other words = can tell what I’m typing. Like perfectly normal function of websites.
I think I Said earlier, I’m not particularly smart.
They can only access it while you’re focused on their webpage. CORS is all about that.
If you click off to another web page and enter information or type of password into a secondary app they can’t gather that. As soon as they lose focus they lose the ability to capture your data.
Nbd, but it sounds like you’re talking about encapsulation of event capture (viewport stops receiving events after losing focus).
CORS is a protocol for client-side enforcement of a server-side security policy. It ensures that a resource request (e.g. “my-totally-safe-resource.wasm”) only loads from a location your server permits (e.g. “my-valid-origin.biz”, “friends-valid-origin.org”, etc).
Some provide screen-reader instructions, but most places barely remember blind people exist. It’s another example of people with disabilities being ignored and marginalised.
And then even if they do remember blind people exist, they probably forget there are people who aren’t blind who can’t do their tests for other reasons, like dyslexia or dexterity impairments.
And then you have hCaptcha who makes disabled people to sign up to their database to use their cookie.
Nah that’s different as well. What they are filtering out is
Et cetera. Humans are much noiser than anything a python script will spit out. Of course there are ways to get around this, like recording and reenacting a human mouse movement, but the point of any capcha system is to make it significantly more difficult to bot, not impossible.
This is really interesting… Can you elaborate? I’ve never one had a follow up to the check mark.
I use a high dpi mouse, what do you use?
Spoiler: I think resolution matters here. The top comment is wrong, if anyone cares enough to take notice…
Cheapest Logitech mouse I could find in the supermarket about 6-7 years ago.
As others have said, it might be more to do with my browser choice, browser settings and extensions. That said I remember when I first started seeing these years ago that sometimes it’d think I was a robot and sometimes it wouldn’t and maybe it was a placebo effect, but I felt fairly confident then that me jiggling the mouse really helped. Now it doesn’t matter what I do. My natural movement, a deliberately wonky but still single and continuous movement or a totally artificial mouse wiggle after the clock, I’ll always have to do captchas.
It uses other signals too, like what other sites you’ve visited with that checkbox on it, what CloudFlare has seen your IP address doing in the past, etc.
The google one is able to see if you’re logged into a google account and take that into account.
There’s even a new variant of the Google captcha that is invisible and doesn’t even bother to show a checkbox.
This feels only partially accurate. I’m a web developer, and I know websites don’t track all of what you suggest. Can you clarify, or come clean on what actually takes place?
Honestly, I doubt it… I’m sorry. I don’t mean to be abrasive.
Bank and government website behind Cloudflare???
Fuck, I just checked, my bank is also behind Cloudflare, what the fuck…
I kind of assumed a bank wouldn’t put another company with ability to view all transferred data between customers and themselves.
How much of the internet is not behind CF?
I should probably try blocking their IPs and see what will still work.
Think you mean to respond to the other comment fyi
as long as your banks engineers are at least somewhat competent
Let’s be realistic here lol
Yeah at least Google will let you in after you solve 5 puzzles. It’s shit but it’s possible. With CloudFlare you are at the mercy of whatever hidden criteria they’re using.
If you change your user agent from Firefox to Chrome for instance, CloudFlare will never let you through.
Basically bots would automatically click on it, teleporting the cursor to the very center of the button. They will do this within exact milliseconds of the page loading.
Humans read something on the site, then find the banner, and move the cursor over to it, confirm that the cursor is somewhere on the button, and then click it.
It’s not just the button, it’s the before the button that determines you’re a bot or not.
Melatonin
Platypus
Shadow
linearchaos
Random_Character_A
This is fine🔥🐶☕🔥
Wugmeister
asudox
u/lukmly013 💾 (lemmy.sdf.org)
I Cast Fist
spankinspinach
Lucidlethargy
nick
Encephalotrocity
themoonisacheese
LaGG_3 [he/him, comrade/them]
davel
𝕸𝖔𝖘𝖘