Cloudflare's invisible CAPTCHA works by probing browsers with JavaScript
- Reference: 1664386923
- News link: https://www.theregister.co.uk/2022/09/28/cloudflares_new_captcha_killer_enters/
- Source link:
The widget is dubbed [1]Turnstile , and is described as "an invisible alternative" to today's CAPTCHA challenges. That said, it will fall back to a manual test as a last resort if it can't automagically verify a user is human. Cloudflare claims it can do all of that while maintaining a higher level of privacy than traditional CAPTCHA systems.
The internet infrastructure biz said a Turnstile test begins with the participating website running non-interactive JavaScript code that takes a look at the system and browser to determine whether it's in an automated environment or that there's likely a human at the computer. The JS code is embedded from challenges.cloudflare.com .
[2]
This script performs a bunch of background tasks in the browser, including "proof-of-work, proof-of-space, probing for web APIs, and various other challenges for detecting browser-quirks and human behavior," Cloudflare said.
[3]
[4]
"Turnstile also includes machine learning models that detect common features of end visitors who were able to pass a challenge before. The computational hardness of those initial challenges may vary by visitor, but is targeted to run fast."
Ultimately, the code uses a bunch of techniques to figure out if the website is being visited by a person as opposed to a software-controlled browser that's there in hope of committing ad-click fraud, signing up for a ton of accounts, or whatever.
[5]
When a human is detected, Cloudflare's backend system issues a token to the visitor's browser. When that user subsequently tries to do anything on the website – such as log in, search, or sign-up – the token can be presented to the site to confirm there isn't a bot at play, and everything will be allowed to work as expected. Since bots won't be issued these tokens, they can be stopped from doing anything further with the website.
[6]How CAPTCHAs can cloak phishing URLs in emails
[7]To CAPTCHA or not to CAPTCHA? Gartner analyst says OK — but don't be robotic about it
[8]Cloudflare launches campaign to 'end the madness' of CAPTCHAs
Turnstile, said to be derived from Cloudflare's [9]Managed Challenge feature, can be used for free on any website that wants to embed the thing, and by any netizen who doesn't block the JavaScript code, we're told.
These not-a-bot tokens – also known as Private Access Tokens, or PATs – were [10]developed with Apple: the latter [11]wants its operating systems to automatically issue the tokens to websites so that iOS (and soon macOS) users can skip having to complete CAPTCHAs.
For now, Turnstile can handle Apple's PATs or tokens issued by Cloudflare's backend. When more OSes support the tokens, they can be added to Turnstile, skipping the need for all that JavaScript probing, presumably.
"To date, [PATs] are only present for iOS 16 devices," Cloudflare Director of Product Reid Tatoris told us in an email. "In the future as more devices and clients take advantage of PATs, Turnstile will automatically utilize PATs anywhere they are compatible."
[12]
Outside of PATs, which are supposed to be anonymous, Cloudflare said Turnstile helps maintain user privacy by not using or looking at cookies. While Turnstile looks "at some session data (like headers, user agent, and browser characteristics) to validate users without challenging them," Cloudflare said it doesn't store data of any kind.
Instead, Cloudflare said it worked with equipment manufacturers to build profiles of devices that help it quickly validate hardware, letting Turnstile "abstract portions of the validation process, and confirm data without actually collecting, touching, or storing that data ourselves."
We note that, like Turnstile, other CAPTCHA widgets rely on JavaScript.
Click on the squares that include a web goliath
Besides inconvenience, Cloudflare said that CAPTCHA widgets come with a privacy trade-off due to who manages 98 percent of implementations: Google.
It was previously uncovered that [13]Google reCAPTCHA favored Google users, giving them the benefit of the doubt as long as reCAPTCHA could determine a user was logged into a Google account.
"Google says they don't use this information for ad targeting, but at the end of the day, Google is an ad sales company," Cloudflare said. Google previously told The Register reCAPTCHA collects hardware and software information and sends it to Google, but wouldn't say what it does with that data.
Cloudflare used reCAPTCHA until 2020, when it [14]dumped the service for hCaptcha, citing customer concerns and privacy issues around sending data to Google. Those concerns conveniently lined up with Google declaring it was going to begin charging heavy reCAPTCHA users, like Cloudflare, to access the service. ®
PS: Cloudflare also this week [15]introduced what it calls a zero-trust eSIM.
Get our [16]Tech Resources
[1] https://blog.cloudflare.com/turnstile-private-captcha-alternative/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YzTD@cYZdf8Rislwh2RYgQAAAEw&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YzTD@cYZdf8Rislwh2RYgQAAAEw&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YzTD@cYZdf8Rislwh2RYgQAAAEw&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YzTD@cYZdf8Rislwh2RYgQAAAEw&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2022/03/17/captcha_phishinbg_url/
[7] https://www.theregister.com/2021/06/22/to_use_captcha_or_not/
[8] https://www.theregister.com/2021/05/14/cloudflare_cryptographic_attestation_of_personhood_captcha_killer/
[9] https://blog.cloudflare.com/end-cloudflare-captcha/
[10] https://developer.apple.com/news/?id=huqjyh7k
[11] https://www.theregister.com/2022/06/21/believe_it_or_not_apple/
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YzTD@cYZdf8Rislwh2RYgQAAAEw&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://www.theregister.com/2019/06/28/google_recaptcha_favoring_google/
[14] https://www.theregister.com/2020/04/09/cloudflare_dumps_recaptcha/
[15] https://blog.cloudflare.com/the-first-zero-trust-sim/
[16] https://whitepapers.theregister.com/
So long as it runs on the device and only the token is returned to Cloudflare that's fine. If it is sending a bunch of information for them to determine whether you're a human or not this is no better than CAPTCHAs that turn humans into Google's slaves forcing them to work on their image recognition.
It looks like it might be OK, and PAT is an open source standard so could be adopted by others but I'd like to learn more about it because the devil is in the details. Here's what I found so far: https://blog.cloudflare.com/eliminating-captchas-on-iphones-and-macs-using-new-standard/
It adds more points of communication so it would slow things down, but at least this is something that is only done once and most sites won't care about it at all (i.e. only for stuff where they are currently using CAPTCHAs)
While I trust Cloudflare much more than Google
This isn't a good long term solution, and will not be immune to spoofing, false positives, false negatives, and all of the problems that plague CAPTCHAs and browser fingerprinting. The description of how it operates also makes me want to hate it. I have seen pages using the more intrusive versions of Cloudflares screening scripts, and they can delay page loads by seconds.
Every version of this idea has been a plague to users that run a tightened up browser config, use a cookie manager, or have their browser set to dump the cache on reloads. In addition, it's going to mean hassles for users on VMs and other platforms that the ad fraud gangs use, and that list will just expand as the fraudsters realize they are blocked and adapt.
Architecturally there is nothing here that will block them from making a counter move, so it's just another twist in the endless game of whack-a-mole.
If it means
that I never have to see another recaptcha with those shitty grainy to the point of almost illegibility, quit talking about it and just bring it on.
As for privacy, your'e on the internet, no matter what you do, the privacy invaders will always be one step in front.
The source
"The JS code is embedded from challenges.cloudflare.com."
Excellent! Now it's easy to block ;-)
Re: The source
And then you'll be presented with a cap ha and all the crap that goes with that.
Re: The source
I'm thinking the mention of the hosting sitename is acknowledgement that people are concerned about what code runs on their browsers. I appreciate them saying challenges.cloudflare.com is what to block or not block. It lends hope that they are aiming to run above board.
Cloudflare's choices of awareness
Serving a fake postal site asking for your credit card? Don't care. Serving stores selling fake or illegal drugs? Don't care. Spam click-through loggers, key loggers, PI loggers, credit card loggers, command and control systems... Don't care. They're not the Internet police!
A bot viewing an advertisement? A bot polluting a credit card logger? Throws all resources at blocking and policing those data patterns. Deploys invasive checkpoints for visitors. Adds tracking cookies for monitoring access patterns.
xCAPTCHA and Turnstile Over-Use, Turnstile CPU Load?
I can understand requiring some sort of evidence you're human before allowing you to sign up for an account ("When that user subsequently tries to do anything on the website – such as log in, search, or sign-up – the token can be presented to the site to confirm there isn't a bot at play"), but less-so for logins, and not for searches.
For any given user, signing-up is a relatively rare event; I don't mind the occasional xCAPTCHA. How much CPU does this new method use? Many people browse from low-CPU-power devices.
maintaining a higher level of privacy than traditional CAPTCHA systems
So it'll never catch on, then.
And what if you block JS?
So they block your access?
Re: And what if you block JS?
Same if you tried another JS CAPTCHA widget and there was no fall back. You'll get told to turn on JavaScript or you can't verify you're a human.
C.
Re: And what if you block JS?
Good. That confirms it then. I am not a human. I do not enable JS. I always knew something about me was artificial. Now I know for sure. I am a Robot.
Dear world, I present to you the first completely sentient and functional Robot: me.
BOT-AID
Since bots won't be issued these tokens, they can be stopped from doing anything further with the website.
Maybe some kind philanthropists can donate tokens to these poor bots beforehand.
Stopped me from one website
I've stopped shopping at a motorcycle website where I've already spent a fair wedge. They hit me with this (or something like it) when I tried to buy something, and it wouldn't let me through.
So I bought my birthday/Christmas present (a $900 helmet) elsewhere.
To the extent that Turnstile is using methods that are an invasion of privacy, one would hope for a browser that does not allow such methods anyway, as they are a privacy risk regardless of Turnstile.