Akamai has been doing this for years now. Cloudflare is just playing catch-up. I first saw an Akamai demonstration of this at one of their developer conferences about 10 years ago.
this post was submitted on 13 Jul 2026
108 points (98.2% liked)
Privacy
4809 readers
392 users here now
Icon base by Lorc under CC BY 3.0 with modifications to add a gradient
founded 3 years ago
MODERATORS
Yeah I thought that was common knowledge?
-
There's no way this can be abused. Ever.
-
There's no way a bot (AI or human built) could be used to simulate a human.
This is a perfect solution!
Well, that's terrifying.
This has always been the way captchas work, I guess they're expanding it to be always-on.
my understanding is Google's recaptcha has been doing this sort of thing forever, tracking mouse movements (as well as browser fingerprinting, IP address, and probably a million other tracking methods) to score a client as more or less likely to be human, and it's only when it's suspicious that it escalates to "pick the images that contain x"
I always thought the pick the images was just an excuse to get training data because it’s never “choose images that contain a bear frolicking in a meadow” it’s always “choose images of motorcycles, busses” or “locate the Abram’s tank hidden in the tree line”.
They do that as well, but its so annoying they probably just hold it back unless extra verification is needed.
This made me laugh out loud.
"Click or tap on all pictures of ARMED INSURGENTS TAKING COVER IN RUINED BUILDINGS until no more are left."
"follow the man with your mouse cursor until the light flashes" will be the next step in crowd sourcing for the army...
Por que no los dos?
...and probably can tell what you're typing.
It does not capture the actual keys being pressed, according to the company. It studies the timing and rhythm instead.
That is addressed in the article. Because it's JavaScript, we can verify this, and I'm sure that people will be scrutinising every revision of the code to check.
Because it’s JavaScript, we can verify this, and I’m sure that people will be scrutinising every revision of the code to check.
Have you ever seen obfuscated JS? I'm not saying it's impossible, but de-transpiling it into something for a human then analyzing it is not trivial work.
Don't bet on something not being terrible just because someone with the skill could maybe spend a lot of time doing the work.
Deobfuscators are fairly good IME. I haven't checked this code in particular, but I've never seen obfuscated JavaScript that was uninterpretable following deobfuscation
Congrats on being awesome at code analysis. Have at it for everyone, then.
But you can tell what a person is typing by their timing and rhythm. I don't have time right now, but there are articles on that.
True, people should search for "keystroke timing attacks". It's more effective if you include things like accelerometer data and audio.
We can see what Cloudflare's code is measuring and reporting to find out if those attacks would be possible.
Cloudflare's blog post about it has more information about how it works.
Indeed. It's linked in the third sentence of the article.
mixed feelings.
i want bots to be suppressed, but I also value my privacy.
has no one come up with a new decentralized internet yet?
Gopher, Gemini protocol, Usenet. Get on it!
thank you! Gemini seems to be similar to what I'm looking for.
Buran is a good browser for mobile. Theres a bunch for Linux, Lagrange works well.
new decentralized internet yet?
Several. Good luck enforcing your bank, doctor, rail operator, canteen, etc. to use it.
That may sound preferable to clicking every square containing a traffic light, but it also means Cloudflare is gathering a much broader picture of how visitors behave on a website.
Traditional bot protection tends to focus on specific moments. A visitor may face a challenge while logging in, creating an account, or completing a purchase. Once that challenge is passed, the rest of the browsing session may receive less attention.
Edit: a lot of popular Lemmy instances use cloudflare instead of annubis. I'm not sure what this specific instance uses.
The product in this article (Precursor) is not the same as what Lemmy instances use (Turnstile). Turnstile uses the same cryptographic proof-of-work puzzle as Anubis and does not track any of these other metrics. If you see a CAPTCHA-style "Verified" message with Cloudflare's logo, you're seeing Turnstile, not Precursor.
It's an enterprise product, for now. I suppose that depends on how deep pockets are.
Great! Can it work over VPN?
