Comment

Comment on Cloudflare is free of CAPTCHAs; Turnstile is free for everyone

ayaya@lemdro.id ⁨8⁩ ⁨months⁩ ago

I’m not actually sure it’s particularly effective at stopping bots, considering how easy it is to spin up a docker container that can bypass it.. Ironically FlareSolverr wasn’t able to solve CAPTCHA so now with them gone it works even better.

source

Sort:hotnew top

Windex007@lemmy.world ⁨8⁩ ⁨months⁩ ago
Yeah, I’m pretty skeptical of the premise… it’s looking for browser “abnormalities”? I mean… there wasn’t a strong motivation to correct those abnormalities for bots when it didn’t matter. Now that it does, I just suspect they’ll correct those abnormalities.

Just because the abnormalities were present in the past doesn’t imply that it’s intrinsically more difficult to emulate browser behaviour than it is to defeat captchas. There just hasn’t been a reason to do so up until now.

source
- ryannathans@aussie.zone ⁨8⁩ ⁨months⁩ ago
  Ok so bypass it
  
  source
httpjames@sh.itjust.works ⁨8⁩ ⁨months⁩ ago
Nothing can stop 100% of bots. The goal with captchas like Turnstile is to use a significant portion of your resources to the point it’s expensive and slow to perform an attack.

Turnstile runs many background checks on your browser, so headless browsers automatically become futile.

JavaScript PoW challenges are performed that take up multiple seconds of execution time, memory and CPU. This alone is a deterrent because sequential attacks become extremely long to execute.

Concurrent attacks are still unfeasible because Turnstile ups the difficulty if it detects something is up, and receiving requests from thousands of botnet IPs is bound to trip an alarm.

source
DogMuffins@discuss.tchncs.de ⁨8⁩ ⁨months⁩ ago
I’m curious how easy it would be to bypass with significant volume though?

Like a few requests might get through but it would get fairly easy to detect dozens of requests from the same bot i think?

It’s also doing some “light” proof of work - this would be a PITA if you were trying a bot net attack or something.

source
verysoft@kbin.social ⁨8⁩ ⁨months⁩ ago
I mean it's always going to be an uphill battle, but I'd rather it stop some bots and be easier for me than make me do a million captchas that dont even work half the time and still not stop many bots.

source