Just here for good conversation with good people.
There’s a whole world of tools you can use that do that for you now. It’s easier than ever. To me it’s concerning. The level of automation, coupled with a halfway decent LLM, can give you the ability to summon hordes of fake humans to social media. I can’t help but think it’s why X and Reddit don’t use any kind of anti-bot solution.
Trust me, my team and I often feel at odds with the part that infringes on privacy. As someone that enjoys and wants more privacy, I wish there were other solutions that didn’t create a type of dragnet. If it assuages some of your fears, I’ve never heard of the fingerprinting being sold or used outside of detections.
ALTCHA uses a proof-of-work mechanism to protect your website, apps, APIs, and online services from spam and unwanted content.
Unlike other solutions, ALTCHA’s Captcha alternative is free, open-source and self-hosted, does not use cookies nor fingerprinting, does not track users.
Emphasis are mine. I honestly do not know how this statement is possible. Captcha-less, proof-of-work solutions have to fingerprint on some level. It’s essentially having the browser prove it is what it claims to be. I get what they’re trying to say but it’s marketing. That said, I don’t know everything and maybe they have some method I’m not aware of. Grains of salt all around.
Given that the last updates to this repo were five years ago, I’m not too sure if it’s still valid. I don’t follow Cloudflare bypasses but I am fairly certain there are more successful frameworks and services now. The landscape is evolving quickly. We are seeing a proliferation of “bot as a service”, captcha passing farms, dedicated browsers for botting, newsletters, substacks, Discord servers, you name it. Then there are the methods you don’t readily find much talk on like custom modified Chrome browsers. It’s fascinating how much effort is being funneled into this field.
Thanks for reading and commenting!
Welcome to bot detection. It’s a cat and mouse game, an ever changing battle where each side makes moves and counter moves. You can see this with the creation of captcha-less challenges.
But to say captcha are useless because bots can pass them is somewhat similar to saying your antivirus is useless because certain malware and ransomware can bypass it.
Yes, the industry is well aware of this. We do behavioral detection on both sessions and IPs. This is fairly basic.
Thank you for reading and considering the information.
That’s very kind of you. Thank you for the kind words. 🍻
Greed. I honestly don’t know if they’re even aware of the problem. Most corporations have cut teams to the bone and I can’t see Cloudflare being an exception. The janitor is probably writing detection rules now.
I get why you’re frustrated and you have every right to be. I’m going to preface what I’m going to say next by saying I work in this industry. I’m not at Cloudflare but I am at a company that provides bot protection. I analyze and block bots for a living. Again, your frustrations are warranted.
Even if a site doesn’t have sensitive information, it likely serves a captcha because of the amount of bots that do make requests that are scraping related. The volume of these requests can effectively DDoS them. If they’re selling something, it can disrupt sales. So they lose money on sales and eat the load costs.
With more and more username and password leaks, credential stuffing is getting to be a bigger issue than anyone actually realizes. There aren’t really good ways of pinpointing you vs someone that has somehow stolen your credentials. Bots are increasingly more and more sophisticated. Meaning, we see bots using aged sessions which is more in line with human behavior. Most of the companies implementing captcha on login segments do so to try and protect your data and financials.
The rise in unique, privacy based browsers is great and it’s also hard to keep up with. It’s been more than six months, but I’ve fingerprinted Pale Moon and, if I recall correctly, it has just enough red flags to be hard to discern between a human and a poorly configured bot.
Ok, enough apologetics. This is a cat and mouse game that the rest of us are being drug into. Sometimes I feel like this is a made up problem. Ultimately, I think this type of thing should be legislated. And before the bot bros jump in and say it’s their right to scrape and take data it’s not. Terms of use are plainly stated by these sites. They consider it stealing.
Thank you for coming to my Tedx Talk on bots.
Edit: I just want to say that allowing any user agent with “Pale Moon” or “Goanna” isn’t the answer. It’s trivially easy to spoof a user agent which is why I worked on fingerprinting it. Changing Pale Moon’s user agent to Firefox is likely to cause you problems too. The fork they are using has different fingerprints than an up to date Firefox browser.
How are you measuring this? On my end, when I look at the metrics I have available to me, the volume of bot requests that are passing captcha does not exceed that of humans. We continually review false positives and false negatives to make sure we aren’t impacting humans while still making it hard for bots.