[flagged]
CAPTCHAs can still detect AI agents
31–40 of 76 posts
Re: CAPTCHAs can still detect AI agents
#32Apparently CloudFlare’s turnstile can’t, as evidenced by several public-facing CRUD and mail routines we maintain that no longer are warding off the spam.
Meanwhile the moment I (a human, of which I'm reasonably confident) see a Cloudflare captcha I nope immediately out of the site and block it forevermore in Kagi. It's not worth the waiting game. "Verifying..." lasts ages. The anime girl captcha works fine and provides no such annoyance.
You seem to think that having a random anime girl is not an annoyance. anything that deviates from showing me the content that I've requested is an annoyance. Just because you prefer A over B does not mean that A is not still an annoyance.
Re: CAPTCHAs can still detect AI agents
#33[deleted]
Re: CAPTCHAs can still detect AI agents
#34Adversaries do not have to wait for LLM models to evolve to mimic human process, they can simply evade the detection JavaScript that evaluates similarity. JavaScript is visible, can easily be reverse-engineered.
I don't think I've ever known of a captcha that handles the actual result decision in the front end. It's universally just the javascript required for some fancy puzzle UI, which forwards the state to some other endpoint to determine where you're redirected to (CF turnstile) or what signed token should be included in the form request (reCAPTCHA)
Re: CAPTCHAs can still detect AI agents
#35Adversaries do not have to wait for LLM models to evolve to mimic human process, they can simply evade the detection JavaScript that evaluates similarity. JavaScript is visible, can easily be reverse-engineered.
I don't think I've ever known of a captcha that handles the actual result decision in the front end. It's universally just the javascript required for some fancy puzzle UI, which forwards the state to some other endpoint to determine where you're redirected to (CF turnstile) or what signed token should be included in the form request (reCAPTCHA)
I should have been clearer and specific: state management is done on the backend, but collecting behavioral biometrics and device fingerprint is done using JavaScript, which can be manipulated.
Re: CAPTCHAs can still detect AI agents
#36Earlier quoted context omitted.
Google I would say yes, but what does Cloudflare gain? They don't run an ad network. Generally I'd say Cloudflare is pretty good to have as a guardian of the web compared to other options. They protect free speech and allow Tor users. Ever tried completing a reCaptcha on Tor?
Cloudflare gains things like this: https://blog.cloudflare.com/introducing-pay-per-crawl/ https://developers.cloudflare.com/browser-run/quick-actions/... They create a new problem and sell the solution.
God damn it.
Re: CAPTCHAs can still detect AI agents
#37Earlier quoted context omitted.
Google I would say yes, but what does Cloudflare gain? They don't run an ad network. Generally I'd say Cloudflare is pretty good to have as a guardian of the web compared to other options. They protect free speech and allow Tor users. Ever tried completing a reCaptcha on Tor?
Cloudflare gains things like this: https://blog.cloudflare.com/introducing-pay-per-crawl/ https://developers.cloudflare.com/browser-run/quick-actions/... They create a new problem and sell the solution.
Nowadays, somebody can just ask claude to build them a scraper/bot that hooks into a proxy network and all of a sudden they can easily send 20k+ reqs/min from hundreds or thousands of IPs cycling them as they get rate limited or banned. In my work, the scrapers have gotten way more aggressive in the last 2 years or so. Frankly, I'm happy there is a solution.
There may be things to criticize Cloudflare for, but the problem of bots and scrapers destroying the open web was getting worse no matter what.
Re: CAPTCHAs can still detect AI agents
#38Until they learn to do that. So cat and mouse. So nothing new.
They already have. Claude and OpenAI are not trying to write captcha-defying AI agents. These tests wouldn't hold up as well against proper bot operators who mimic user behaviour. However, the signals are still valid as part of a larger toolset.
Re: CAPTCHAs can still detect AI agents
#39CAPTCHAs are great. Exploiters get around them with proprietary anti-detect browsers and unethical residential proxies, while privacy browsers and affordable privacy VPNs get blocked and shadowbanned to death. Fingerprint.com, while not a CAPTCHA, gives you +3 suspicious score just for using privacy settings like adblock on your browser. This makes it harder to sign up for any sites that use fingerprint.com. https://…
Exploiters might get around them in isolation but they are easily caught at scale due to the opportunity cost being less than the cost of creating unique behaviour over many containers.
Re: CAPTCHAs can still detect AI agents
#40Captchas are primarily to punish users for not allowing tracking, or using the “right” services, they may prevent some bots as a side effect (or a pretence from the provider) but it’s mostly for google and cloudflare to abuse their monopolies.
Google I would say yes, but what does Cloudflare gain? They don't run an ad network. Generally I'd say Cloudflare is pretty good to have as a guardian of the web compared to other options. They protect free speech and allow Tor users. Ever tried completing a reCaptcha on Tor?
Tin hat folk say Cloudflare is CIA. I dunno