91–100 of 170 posts
control+F accessibility no results Yeah so this mouse movement astrology is going to completely lock non-sighted/keyboard only users out of large swaths of the Internet isn't it.
I mean CF already forces 5 minutes of motorbike identification on anyone not in a whitelisted western country, so a small percentage of blind people is unlikely to worry them.
Earlier quoted context omitted.
Beating this would require a large amount of sophistication, not a small amount. Basic machine learning clustering will expose bots mouse+keyboard+touch behavior and discriminate them from humans. It will also likely discriminate against anyone with a disability and therefore using affordances like eye tracking. Just imagine how different a person with only one hand would look compared to a “typical” user!! This shou…
> It is super difficult to mimic all of these signals in a way that would cluster the same as typical humans. Not really, beat ML with ML. I won't disclose how to do it, because who knows who might read this, but you can easily do it with a model trained for that purpose.
I implemented all of this in hCaptcha 6 years ago, not just to distinguish bot from human but also to recognize the keyboard/mouse behavior of the same person signing up for many accounts or testing multiple credit cards. This kind of abuse detection was a part of Cloudflare when they switched to hCaptcha in 2020 and I had thought they already implemented all this themselves four years ago when they transitioned away…
that mouse cursor movement is very hard to replicate a real human with the amount of data that cloudflare has you could reproduce something close but cloudflare has seen probably trillions of movements that will be tough to beat
watching this carefully but i think this is the right approach
Earlier quoted context omitted.
> There is nothing stopping a bot from moving their cursor like a human. Sure, we could write a library that slows the bot down and makes it move the cursor in procedurally-generated curves with a certain degree of noise added... but its all extra work, and it all slows the bots down. Presumably they wouldn't reveal that part of the secret sauce if it was all of the secret sauce
Acting like a human is something scapers already do. Using residential proxies, using latest Chrome user agents, not moving/typing as fast, etc. This is just 1 more layer, moving mouse naturally.
Is this equivalent to Google Cloud Fraud Defense? https://cloud.google.com/security/products/fraud-defense
I expect this will be effective for maybe a day.
What prevents bots/agents from just adding "jitter" to their movements that mimics how humans move their cursor? I know there are other signals being used but this one in particular seems like it wouldn't be hard to beat with a small amount of sophistication from the bot.
control+F accessibility no results Yeah so this mouse movement astrology is going to completely lock non-sighted/keyboard only users out of large swaths of the Internet isn't it.
I mean CF already forces 5 minutes of motorbike identification on anyone not in a whitelisted western country, so a small percentage of blind people is unlikely to worry them.
control+F accessibility no results Yeah so this mouse movement astrology is going to completely lock non-sighted/keyboard only users out of large swaths of the Internet isn't it.
I'm guessing it's going to lock the non-sighted//keyboard only users out of the anonymous Internet. I'm guessing if you log in and give up your anonymity they'll consider you not a bot.
Other products in the space:
- Foil (https://usefoil.com/), I'm biased, a friend is building this
- Kasada https://www.kasada.io/
- DataDome (https://datadome.co/)
- Castle (https://castle.io/)
- Fingerprint (https://fingerprint.com/)
- HUMAN (http://humansecurity.com/)
- Google Cloud Fraud Defense, which is basically the updated reCaptcha (https://cloud.google.com/security/products/fraud-defense?hl=...)
- this, Cloudflare Precursor
It seems like some of the main reasons people care so far are:
- Preventing automated credential stuffing
- Preventing bots from creating a bunch of fake accounts (eg free trial abuse, which can also lead to high twilio SMS bills!)
- Reducing payment fraud
- Blocking LLM scraping
- Blocking automated scalpers (!) eg for tickers or sneakers
I'm curious to see which use cases end up dominating as the reason companies care about this. And I'm hopeful that my agents will still have good ways for me to browse and do things on the web on my behalf - eg detect agents and route them to an agent path, rather than blocking them.
(I'm interested in tools for detecting AI agents and seeing how this shifts as bot traffic goes way up.)